3.1 Confidential Information.
(i) “Confidential Information” means, with respect to Client, all Customer Transaction Data provided to Pix and, with respect to Pix, all non-public information related to Pix’s technology and/or business. Each party (as the “Receiving Party”) understands that the other party (the “Disclosing Party”) may disclose or otherwise make available Confidential Information. As the Receiving Party, each party agrees: (i) except as expressly provided under this Agreement, not to divulge to any third party any Confidential Information of the Disclosing Party; (ii) to give access to the Disclosing Party’s Confidential Information solely to those employees and contractors with a need to have access thereto for purposes of this Agreement (and who are bound by written confidentiality obligations as protective of the Disclosing Party’s Confidential Information as this Agreement); and (iii) to take the same security precautions to protect against disclosure or unauthorized use of the Disclosing Party’s Confidential Information that the Receiving Party takes with its own proprietary information, but in no event less than reasonable precautions to protect such Confidential Information. As the Disclosing Party, each party agrees that the foregoing will not apply with respect to any information that the Receiving Party can document (a) is or becomes generally available to the public without any action by, or involvement of, the Receiving Party, or (b) was in its possession or known by it prior to receipt from the Disclosing Party, or (c) was rightfully disclosed to it without restriction by a third party, or (d) was independently developed without use of any Confidential Information of the Disclosing Party. Nothing in this Agreement will prevent the Receiving Party from disclosing Confidential Information pursuant to any judicial or governmental order, provided that the Receiving Party (to the extent legally permissible) gives the Disclosing Party reasonable prior notice of such disclosure to contest such order.
(ii) Prior to providing any Customer Transaction Data to Pix, Client shall make all disclosures to, and obtain all consents from, each Client Customer necessary to comply with all Applicable Laws with respect to (i) Client’s providing the Customer Transaction Data to Pix and (ii) Pix’s processing and analyzing such Customer Transaction Data in accordance with this Agreement. Pix acknowledges that the Customer Transaction Data is Client’s Confidential Information and is subject to the obligations and restrictions set forth in Section 3.1 above.
(iii) Further, Client acknowledges and agrees that Pix may collect data related to Client’s use of the Pix Analytics services, which by way of illustration but not limitation includes the aggregate response rate and other aggregate measures of the Pix Analytics services’ performance and Client’s use of various aspects of the Pix Analytics services, and that no such information shall be deemed to be Client’s Confidential Information or information owned or controlled by Client.
3.2 Personal Information. This Section 3.2 applies only where the Client Customers for whom Client will provide personal information are residents of the State of California.
(i) Definitions. The following definitions and rules of interpretation apply in this Section 3.2: “CCPA” means the California Consumer Privacy Act of 2018, as amended (Cal. Civ. Code §§ 1798.100 to 1798.199), the CCPA Regulations (Cal. Code Regs. tit. 11, §§ 999.300 to 999.337), and any related regulations or guidance provided by the California Attorney General, terms defined in the CCPA, including personal information and business purposes, carry the same meaning in this Section 8.2; and “Contracted Business Purposes” means the services described in this Agreement for which Pix receives or accesses personal information.
(ii) Pix’s CCPA Obligations.
1. Pix will only collect, use, retain or disclose personal information for the Contracted Business Purposes for which Client provides or permits personal information access.
2. Pix will not collect, use, retain, disclose, sell or otherwise make personal information available for Pix’s own commercial purposes or in a way that does not comply with the CCPA. If a law requires Pix to disclose personal information for a purpose unrelated to the Contracted Business Purpose, Pix must first inform Client of the legal requirement and give Client an opportunity to object or challenge the requirement, unless the law prohibits such notice.
3. Pix will limit personal information collection, use, retention and disclosure to activities reasonably necessary and proportionate to achieve the Contracted Business Purposes or another compatible operational purpose.
4. Pix must promptly comply with any Client request or instruction requiring Pix to provide, amend, transfer or delete the personal information, or to stop, mitigate or remedy any unauthorized processing.
5. If the Contracted Business Purposes require the collection of personal information from individuals on Client’s behalf, Pix will always provide a CCPA-compliant notice at collection that Client specifically pre-approves in writing. Pix will not modify or alter the notice in any way without Client’s prior written consent.
6. Where the CCPA permits, Pix may aggregate, deidentify or anonymize personal information so it no longer meets the personal information definition, and may use such aggregated, deidentified or anonymized data for its own research and development purposes as well as for other commercial purposes, such as trendspotting or benchmarking. Pix will not attempt to or actually re-identify any previously aggregated, deidentified or anonymized data and will contractually prohibit downstream data recipients from attempting to or actually re-identifying such data.
(iii) Assistance with Client’s CCPA Obligations.
1. Pix will reasonably cooperate and assist Client with meeting Client’s CCPA compliance obligations and responding to CCPA-related inquiries, including responding to verifiable consumer requests, taking into account the nature of Pix’s processing and the information available to Pix.
2. Pix must notify Client if it receives any complaint, notice or communication that directly or indirectly relates to either party’s compliance with the CCPA. Specifically, Pix must notify Client within ten (10) working days if it receives a verifiable consumer request under the CCPA.
(iv) Subcontracting.
1. Pix may use subcontractors to provide portions of the Contracted Business Services. Pix cannot make any disclosures of personal information to the subcontractor that the CCPA would treat as a sale.
2. For each subcontractor used that will have access to personal information, Pix will give Client an up-to-date list disclosing:
a. The subcontractor’s name, address and contact information.
b. The type of services provided by the subcontractor.
c. The personal information categories disclosed to the subcontractor in the preceding 12 months.
3. Pix remains fully liable to Client for the subcontractor’s performance of its agreement obligations.
4. In the event that Pix audits a subcontractor’s compliance with its personal information obligations, Pix will provide Client with the audit results.
(v) CCPA Warranties.
1. Each party will comply with all applicable requirements of the CCPA when collecting, using, retaining or disclosing personal information.
2. Pix warrants that it has no reason to believe any CCPA requirements or restrictions prevent it from providing any of the Contracted Business Purposes or otherwise performing under this Agreement. Pix must, promptly after becoming aware of the same, notify Client of any changes to the CCPA’s requirements that might adversely affect its performance under the Agreement.