California Consumer Privacy Act Addendum

EFFECTIVE DATE: November 19, 2019

California Consumer Privacy Act Addendum 

This addendum to the Papathemes DPA is incorporated by reference into Papathemes’s Terms of Service at https://papathemes.com/terms-of-service/ entered into between Papathemes, Inc. and you (the “Client”), and reflects the parties’ agreement with regard to the use or access of personal information in accordance with the requirements of the California Consumer Privacy Act, when applicable.

1. Definitions.  

1. “CCPA” means the California Consumer Privacy Act of 2018 (Cal. Civ. Code §§ 1798.100 to 1798.199), as amended from time to time, and any related regulations and guidance provided by the California Attorney General pertaining to same. 
2. “Contracted Business Purposes” means the Services described in the Agreement for which Papathemes uses or accesses personal information on behalf of Client.
3. Terms defined in the CCPA, including “personal information” and “business purposes,” carry the same meaning in this CCPA Addendum. Papathemes is a “service provider” under the CCPA.

2. Papathemes’s CCPA Obligations.

1. Papathemes will only collect, use, retain, or disclose personal information for the Contracted Business Purposes as set forth in the Agreement.
2. Papathemes will not retain, use or disclose personal information outside of the direct business relationship between Client and Papathemes, except as authorized in the Agreement or under the CCPA.  
3. Papathemes will not collect, use, retain, disclose, sell, or otherwise make personal information available or process personal information (or allow any third party to process or access personal information) for Papathemes’s own commercial purposes or in a way that does not comply with the CCPA. 
4. Papathemes will limit personal information collection, use, retention, processing and disclosure (including through its service providers, suppliers, contractors or subcontractors) to activities reasonably necessary and proportionate to achieve the Contracted Business Purposes.
5. Papathemes shall not engage in any activity that may be considered a sale of personal information pursuant to the CCPA.  

3. Assistance with Customer’s CCPA Obligations.

1. Papathemes will reasonably cooperate and assist Client with meeting its CCPA compliance obligations and responding to CCPA-related inquiries, including responding to verifiable consumer requests. 
2. Both parties will comply with all applicable requirements of the CCPA when collecting, using, retaining, sharing or disclosing personal information.

4. Subcontracting.

1. Papathemes may use subcontractors to provide the Contracted Business Services as set forth in the Agreement and subject to the terms of this CCPA Addendum.  Any such subcontractor used must qualify as a “service provider” under the CCPA and Papathemes will not make any disclosures to the subcontractor that the CCPA would treat as a sale.
2. Papathemes remains fully liable to the Client for the subcontractor’s actions or inactions.

5. Processing Purposes and Details

1. The Contracted Business Purposes are providing the Services and processing the Client Data as set forth in the Agreement.
2. Personal Information Categories: This Agreement involves the following types of Personal Information, as defined and classified in CCPA Cal. Civ. Code § 1798.140(o).

Category	Specific Fields
A. Identifiers.	First name, last name, email address, telephone number, email data, system usage data, location data (IP address), and other electronic data/UGC (reviews, photos) submitted, stored, sent, or received by the Data Subjects.
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	First name, last name, email address, telephone number, email data, system usage data, location data (IP address), and other electronic data/UGC (reviews, photos) submitted, stored, sent, or received by the consumers.   Note: Some personal information included in this category may overlap with other categories.
C. Protected classification characteristics under California or federal law.	None.
D. Commercial information.	Purchased product/service.
E. Biometric information.	None.
F. Internet or other similar network activity.	IP Address. Papathemes also collect the activity of the consumer on the onsite widget, to provide this data later on to IPP, to indicate if the user read or navigated the UGC onsite widget prior to making the order, so IPP will know that this order can be contributed to the UGC as displayed on the site.
G. Geolocation data.	Extracted from IP Address.
H. Sensory data.	None.
I. Professional or employment-related information.	None.
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	None.
K. Inferences drawn from other personal information.	None.

 

1. Types of Consumers: End users of Client’s website.
2. The list of approved subcontractors is set forth in Section 2.6 of the DPA.