MARKETING PARTNER DATA PROTECTION ADDENDUM

Virtual Marketing Services (Gibraltar) Limited or its Affiliate (“Company”) and the legal entity (“Marketing Partner”; each a "Party" and collectively "Parties") that entered into an agreement with the Company for the provision of the services (“Services”) described in the principal agreement entered into between the parties (as amended from time to time, the “Agreement”), are agreeing to these Data Protection Terms (“DPA”). This DPA is entered into by Company and Marketing Partner and supplements the Agreement, and shall be effective, and replace any previously applicable terms relating to their subject matter, during the duration of the Agreement.

If you are accepting this DPA on behalf of Marketing Partner, you warrant that: (a) you have full legal authority to bind Marketing Partner to this DPA; (b) you have read and understand this DPA; and (c) you agree, on behalf of Marketing Partner, to this DPA. If you do not have the legal authority to bind Marketing Partner, please do not accept this DPA.

  1. INTRODUCTION

    1. 1.1 This DPA reflect the parties’ agreement on the processing of personal data in connection with the Data Protection Laws.
    2. 1.2 Any ambiguity in this DPA shall be resolved to permit the parties to comply with all Data Protection Laws.
    3. 1.3 In the event and to the extent that the Data Protection Laws impose stricter obligations on the parties than under this DPA, the Data Protection Laws shall prevail

  2. DEFINITIONS AND INTERPRETATION

    1. In this DPA:
    1. 2.1 “Affiliate” means any person or entity directly or indirectly controlling, controlled by, or under common control with the Company. For the purpose of this definition, "control" (including, with correlative meanings, the terms "controlling", "controlled by" and "under common control with") means the power to manage or direct the affairs of the person or entity in question, whether by ownership of voting securities, by contract or otherwise.
    2. 2.2 “Approved Jurisdiction” means a jurisdiction approved as having adequate legal protections for data by the European Commission (or by the UK Information Commissioner's Office, where applicable), currently found here:
      https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
    3. 2.3 “Standard Contractual Clauses”means, as applicable, any and/or all applicable domestic and foreign laws, rules, directives and regulations, on any local, provincial, state or deferral or national level, pertaining to data privacy, data security and/or the protection of personal data, including the Data Protection Directive 95/46/EC and the Privacy and Electronic Communications Directive 2002/58/EC (and respective local implementing laws) concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), including any amendments or replacements to them, including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), Data Protection Act 2018 and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"), and any amendment or replacements to the foregoing.
    4. 2.4 “Data Protection Laws” mean module one of the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council from June 4th 2021, as available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en.
    5. 2.5 ”UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, which was entered into force on 21 March, 2022.
    6. 2.6 The terms “controller “data subject”, “personal data”, “processing”, “processor” and “personal data breach” as used in this have the meanings given in the GDPR.
    7. 2.7 Any reference to a legal framework, statute or other legislative enactment is a reference to it as amended or re-enacted from time to time.

  3. APPLICATION OF THIS DPA

    1. This DPA will only apply to the extent all of the following conditions are met:
    1. 3.1.1 Either Party processes personal data that is made available by the other Party in connection with the Agreement;
    2. 3.1.2 The Data Protection Laws apply to the processing of personal data.
    3. 3.1.3 This DPA will only apply to the Services for which the parties agreed to in the Agreement, which incorporates the DPA by reference.

  4. ROLES AND RESTRICTIONS ON PROCESSING

    1. 4.1 Marketing Partner is an independent controller of personal data and Company is either an independent controller or a processor on behalf of an affiliated company acting as an independent controller.
    2. 4.2 Independent Controllers. Each Party:
      1. 4.2.1 is an independent controller of personal data under the Data Protection Laws;
      2. 4.2.2 as required under the Data Protection Laws, maintain accurate written records of all the processing activities conducted by that Party in relation to any Personal Data for the purposes of performing its respective obligations under the Agreement;
      3. 4.2.3 will individually determine the purposes and means of its processing of personal data;
      4. 4.2.4 will be responsible to ensure that any Personal Data collected and processed by such Party is accurate and remains accurate for the duration of its processing;
      5. 4.2.5 will comply with the obligations applicable to it under the Data Protection Laws with respect to the processing of personal data;
      6. 4.2.6 will be responsible to exercise and respond to any requests by data subjects to exercise their rights under Data Protection Law, including (but not limited to) Articles 15-22 of the GDPR (“Data Subject Rights”), and shall provide reasonable cooperation and assistance to the other Party in connection with exercising Data Subject Rights;
      7. 4.2.7 will promptly notify the other Party of any circumstances in which such Party is unable or becomes unable to comply with this DPA or Data Protection Laws, or any actual or potential changes to Data Protection Laws, if this shall affect the other Party’s ability to comply with its obligations under this DPA or Data Protection Laws.
    3. 4.3 Sharing of Personal Data. In performing its obligations under the Agreement, the Marketing Partner shall process personal data provided by the Company (i) only for the purposes set forth in the Agreement or as otherwise agreed to in writing by the Parties, provided such processing strictly complies with (a) Data Protection Laws, and (b) its obligations under the DPA (the “Permitted Purposes”), provided that it will not do or permit any act or omission which would cause the Company to incur any liability under Data Protection Laws, and (ii) solely during the term of the Agreement. Marketing Partner shall securely delete or return the copies of the disclosed personal data to the Company (by secure file transfer in such format as the Company reasonably requests) and cease the processing of the disclosed personal data, and shall certify to the Company to that effect, unless and only insofar as the processing of the personal data is required for the fulfillment of the Permitted Purposes or is permissible under Data Protection Laws, and in which case the Marketing Partner will inform the Company of any such requirement and only further process the personal data as necessary to comply with the foregoing. Each Party shall not knowingly share any personal data with the other Party that contains personal data relating to minors under 18 years.
    4. 4.4 Lawful grounds and transparency. Each Party shall maintain a public and easily-accessible privacy policy on its respective digital properties that is available via a prominent link that satisfies transparency disclosure requirements of Data Protection Laws. Each Party warrants and represents that it has provided data subjects with appropriate transparency regarding data collection and use and all required notices and obtained any and all consents or permissions necessary Data Protection Laws with regards to any personal data that is collected and disclosed by such Party to the other Party. Both parties will cooperate in good faith in order to identify the information disclosure requirements and each Party hereby permits the other Party to identify it in the other Party’s privacy policy, and to provide a link to the other Party’s privacy policy in its privacy policy.
    5. 4.4 Data Subject Rights. It is agreed that where either party receives a request from a data subject in respect of Personal Data controlled by such Party, then such Party shall be responsible to exercise the request, in accordance with Data Protection Laws.

  5. PERSONAL DATA TRANSFERS

    1. 5.1 Transfers of Personal Data Out of the European Economic Area. Either Party may transfer personal data outside the European Economic Area ("EEA") or an Approved Jurisdiction if it complies with the provisions on the transfer of personal data to third countries in the Data Protection Laws.
    2. 5.2 Where the GDPR or UK GDPR are applicable, to the extent either Party processes personal data outside the EEA or an Approved Jurisdiction, the Parties shall be deemed to enter into the Standard Contractual Clauses (and the UK Addendum, as applicable), which are incorporated herein by reference, subject to any amendment contained in Schedule A.
    3. 5.3 Subcontracting. Where either Party subcontracts the processing activities of personal data contemplated herein to a third party, it shall ensure that the such third party enters into written contractual obligations which are (in the case of a third party controller) no less onerous than those imposed by this DPA or (in the case of a third party processor) compliant with Article 28 of the GDPR. Each Party shall be liable for the acts or omissions of its subcontractors to the same extent it is liable for its own actions or omissions under this DPA.

  6. PROTECTION OF PERSONAL DATA

    1. 6.1 The Parties will provide a level of protection for personal data that is at least equivalent to that required under Data Protection Laws. Both Parties shall implement appropriate technical and organizational measures to protect the personal data.
    2. 6.2 In the event that Marketing Partner suffers a confirmed personal data breach with respect to personal data disclosed from the Company, Marketing Partner shall notify the Company without undue delay and the Parties shall cooperate in good faith to agree and action such measures as may be necessary to mitigate or remedy the effects of the personal data breach. In the event that a Party suffers a confirmed Security Incident, then such Party shall be responsible to notify the supervisory authority and/or the Data Subjects with respect to such Security Incident, as required under Data Protection Laws.

  7. PROTECTION OF PERSONAL DATA

    1. Each Party shall:
    1. 7.1 appoint at least one representative as point of contact and responsible manager for all issues arising out of the Data Protection Laws (a "Designated Representative"); the Designated Representative(s) of both Parties will work together in good faith to reach an agreement with regards to any issues arising from time to time in relation to the processing of personal data in connection with the Agreement and this DPA;
    2. 7.2 use reasonable measures to consult with the other Party about any notices given to data subjects in relation to the processing of personal data under the Agreement;
    3. 7.3 inform the other Party (without undue delay) in the event that it receives a data subject request related solely and exclusively to the other Party's respective processing activities and provide all reasonable assistance to ensure data subject request are completed within the timeframe set out in Data Protection Laws;
    4. 7.4 provide the other Party with reasonable assistance (having regard to the data available to it) to enable the other Party to comply with any data subject request received by the other Party and to respond to any other queries or complaints from data subjects;
    5. 7.5 provide the other Party with such reasonable assistance as the other Party may reasonably request from time to time to enable the other Party to comply with its obligations under the Data Protection Laws including (without limitation) in respect of security, breach notifications, impact assessments and consultations with supervisory authorities or other regulators;
    6. 7.6 provide the other Party with such information as it may reasonably request in order to: (a) monitor the technical and organizational measures being taken to ensure compliance with the Data Protection Laws, or (b) satisfy any legal or regulatory requirements, including information reporting, disclosure and other related obligations to any regulatory authority from time to time;
    7. 7.7 in the event of an actual or potential personal data breach which does or is reasonably likely to affect the respective processing activities of both Parties, notify the other Party without undue delay, and liaise with the other Party in good faith to consider what action is required in order to mitigate or remedy the effects of the personal data breach in accordance with the Data Protection Laws, and provide such reasonable assistance as is necessary to the other Party to facilitate the handling of such personal data breach in an expeditious and compliant manner.

  8. DIRECT MARKETING

    1. To the extent that Marketing Partner collects or process personal data for the purpose of carrying out direct marketing activities (including, without limitation, email campaigns, phone calls or text-message campaigns; collectively “Direct Marketing”), which promote services or products offered by the Company and/or Marketing Partner and/or other third parties ("Communications"), then Marketing Partner shall:
    1. 8.1 Comply with any and all Data Protection Laws that apply to such activity, including without limitation the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and the e-Privacy Directive;
    2. 8.2 Ensure that is has provided the data subjects with any notice necessary as required under Data Protection Laws, prior to delivering any Communications;
    3. 8.3 Ensure that is has obtained and sufficiently recorded the data subjects’ affirmative consent (including recording of the user ID, timestamp, relevant domain and source, and other relevant data as necessary) prior to delivering any Communications;
    4. 8.4 Upon Company’s request, provide the Company with any and all records relating the data subjects’ affirmative consent and notices provided to the data subjects;
    5. 8.5 Ensure that any and all Communications include a clear and conspicuous notice of the opportunity to opt-out of receiving future Communications, in an easy manner;
    6. 8.6 Record and comply with any request to opt-out or unsubscribe from receiving Communications, as soon as technically feasible, and in any event within no later than twenty four (24) hours as of the receipt of such request;
    7. 8.7 Ensure that the recipient of a Communications shall not be required to pay a fee or provide any other information for the purpose of opting-out of receiving Communications;
    8. 8.8 Ensure that Communications are not delivered to any data subject that were indicated, either by the Company or otherwise, to be excluded from the receipt of Communications, as directed by the Company, from time to time.

  9. PRIORITY

    1. Effect of this DPA
    . If there is any conflict or inconsistency between the terms of this DPA and the remainder of the Agreement then, the terms of this DPA will govern. Subject to the amendments in this DPA, the Agreement remains in full force and effect.

  10. RESOLUTION OF DISPUTES WITH DATA SUBJECTS OR SUPERVISORY AUTHORITIES

    1. To the extent that Marketing Partner collects or process personal data for the purpose of carrying out direct marketing activities (including, without limitation, email campaigns, phone calls or text-message campaigns; collectively “Direct Marketing”), which promote services or products offered by the Company and/or Marketing Partner and/or other third parties ("Communications"), then Marketing Partner shall:
    1. 10.1 If either Party is the subject of a claim by a data subject or a supervisory authority or receives a notice or complaint from a supervisory authority relating to its respective processing activities ("DP Claim"), it shall promptly inform the other Party of the DP Claim and provide the other Party with such information as it may reasonably request regarding the DP Claim.
    2. 10.2 Where the DP Claim concerns the respective processing activities of one Party only, then that Party shall assume sole responsibility for disputing or settling the DP Claim.
    3. 10.3 Where the DP Claim concerns the respective processing activities of both Parties, then the Parties shall use all reasonable endeavors to cooperate with a view to disputing or settling the Claim in a timely manner; provided always that neither Party shall make any admission or offer of settlement or compromise without using all reasonable endeavors to consult with the other Party in advance.

  11. CHANGES TO THIS DPA

    1. 11.1 Company may change this DPA if the change is required to comply with Data Protection Laws, a court order or guidance issued by a governmental regulator or agency, provided that such change does not: (i) seek to alter the categorization of the parties as independent controllers of personal data under the Data Protection Laws; (ii) expand the scope of, or remove any restrictions on, either Party’s rights to use or otherwise process personal data; or (iii) have a material adverse impact on Marketing Partner, as reasonably determined by Company.
    2. 11.2 Notification of Changes. If Company intends to change this DPA under this section, and such change will have a material adverse impact on Marketing Partner, as reasonably determined by Company, then Company will use commercially reasonable efforts to inform Marketing Partner at least 30 days (or such shorter period as may be required to comply with applicable law, applicable regulation, a court order or guidance issued by a governmental regulator or agency) before the change will take effect.
    3. 11.3 If any of the Data Protection Laws are superseded by new or modified Data Protection Laws (including any decisions or interpretations by a relevant court or governmental authority relating thereto), the new or modified Data Protection Laws shall be deemed to be incorporated into this DPA, and each Party will promptly begin complying with such Data Protection Laws in respect of its respective processing activities.

Schedule A – Standard Contractual Clauses and the UK Addendum

  1. This Schedule A sets out the Parties' agreed interpretation of their respective obligations under the Standard Contractual Clauses.
  2. The Parties agree that for the purpose of transfer of Personal Data the following shall apply:
    1. Clause 7 of the Standard Contractual Clauses shall not be applicable.
    2. In Clause 11, data subjects shall not be able to lodge a complaint with an independent dispute resolution body.
    3. In Clause 17, option 1 shall apply. The Parties agree that the clauses shall be governed by the law of the Republic of Ireland.
    4. In Clause 18(b) the Parties choose the courts of Dublin, Ireland as their choice of forum and jurisdiction.
  3. The Parties shall complete Annexes I–II below, which are incorporated in the Standard Contractual Clauses by reference.
  4. To the extent the UK Addendum applies, the following shall apply:
    1. All the information provided under the Standard Contractual Clauses shall apply to the UK Addendum with the necessary changes per the requirement of the UK Addendum. Annex I below shall replace Annexes 1A and 1B of the UK Addendum, Annexes 2-3 shall be replaced with Annexes II-III below.
    2. In Table 4 of the UK Addendum, either party may terminate the agreement in accordance with section 19 of the UK Addendum.
    3. By entering into this DPA, the Parties hereby agree to the format changes made to the UK Addendum.

Annex I – Description of processing activities

A. Identification of Parties

"Data Exporter": the Company;
"Data Importer": the Recipient.

B. Description of Transfer

Data Subjects
  1. Company's end-users
Categories of Personal Data
The Personal Data transferred concern the following categories of data (please specify):
  1. Contact information (name, age, gender, address, telephone number, email address etc.)
  2. Device identifiers and internet or electronic network activity (IP addresses, GAID/IDFA, browsing history, timestamps).
Special Categories of Data (if appropriate)
The Personal Data transferred concern the following special categories of data (please specify):
  1. None
The frequency of the transfer
The frequency of the transfer:
  1. Continuous
Nature of the processing
The frequency of the transfer:
  1. Collection
  2. Recording
  3. Storage
  4. Disclosure, dissemination or otherwise making available
Purpose of the transfer and further processing
As defined in the Agreement.

Retention period
Personal Data will be retained for the term of the Agreement.

Annex I – Description of processing activities

Description of the technical and organizational measures implemented by the data importer (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Security Management

Recipient maintains a written information security management system (ISMS), in accordance with this Annex, that includes policies, processes, enforcement and controls governing all storage/processing/transmitting of Personal Data, designed to (a) secure Personal Data against accidental or unlawful loss, access or disclosure; (b) identify reasonable foreseeable and internal risks to security and authorized access to Recipient Network, and (c) minimize security risks, including through risk assessment and regular testing. The ISMS will include the following measures:

  • Recipient actively follows information security trends and developments as well as legal developments with regards to the services provided and especially with regards to Personal Data and uses such insights to maintain its ISMS, as appropriate.
Maintain an Information Security Policy

Recipient's ISMS is based on its security policies that are regularly reviewed (at least yearly) and maintained and disseminated to all relevant Parties, including all personnel. Security policies and derived procedures clearly define information security responsibilities including responsibilities for:

  • Maintaining security policies and procedures;
  • Secure development, operation and maintenance of software and systems;
  • Security alert handling;
  • User account administration;
  • Monitoring and control of all systems as well as access to Personal Data.

Personnel is screened prior to hire and trained (and tested) through a formal security awareness program upon hire and annually. For service providers with whom Personal Data is shared or that could affect the security of Personal Data a process has been set up that includes initial due diligence prior to engagement and regular (typically yearly) monitoring.
Personal Data has implemented a risk-assessment process that is based on ISO 27005.

Secure Networks and Systems

Recipient has installed and maintains a firewall configurations to protect Personal Data that controls all traffic allowed between Recipient's (internal) network and untrusted (external) networks, as well as traffic into and out of more sensitive areas within its internal network. This includes current documentation, change control and regular reviews.
Recipient does not use vendor-supplied defaults for system passwords and other security parameters on any systems and has developed configuration standards for all system components consistent with industry-accepted system hardening standards.

Protection of Personal Data

Recipient keeps Personal Data storage to a minimum and implements data retention and disposal policies to limit data storage to that which is necessary, in accordance with the needs of its customers.
Recipient uses strong encryption and hashing for Personal Data anywhere it is stored. Recipient has documented and implemented all necessary procedures to protect (cryptographic) keys used to secure stored Personal Data against disclosure and misuse. All transmission of Personal Data across open, public networks is encrypted using strong cryptography and security protocols.

Vulnerability Management Program

Recipient protects all systems against malware and regularly updates anti-virus software or programs to protect against malware – including viruses, worms, and Trojans. Anti-virus software is used on all systems commonly affected by malware to protect such systems from current and evolving malicious software threats.
Recipient develops and maintains secure systems and applications by:

  • Having established and evolving a process to identify and fix (e.g. through patching) security vulnerabilities, that ensures that all systems components and software are protected from known vulnerabilities,
  • Developing internal and external software applications, including web-applications, securely using a secure software development process based on best practices, e.g. such as code reviews and OWASP secure coding practices, that incorporates information security throughout the software-development lifecycle,
  • Implementing a stringent change management process and procedures for all changes to system components that include strict separation of development and test environments from production environments and prevents the use of production data for testing or development.
Implementation of Strong Access Control Measures

"Recipient Network" means the Recipient's data center facilities, servers, networking equipment, and host software systems (e.g. virtual firewalls) as employed by the Recipient to process or store Personal Data.
The Recipient Network will be accessible to employees, contractors and any other person as necessary to provide the services to the Company. Recipient will maintain access controls and policies to manage what access is allowed to the Recipient Network from each network connection and user, including the use of firewalls or functionally equivalent technology and authentication controls. Recipient will maintain corrective action and incident response plans to respond to potential security threats.
Recipient strictly restricts access to Personal Data on a need to know basis to ensure that critical data can only be accessed by authorized personnel. This is achieved by:

  • Limiting access to system components and Personal Data to only those individuals whose job requires such access; and
  • Establishing and maintaining an access control system for system components that restricts access based on a user’s need to know, with a default “deny-all” setting.

Recipient identifies and authenticates access to all systems components by assigning a unique identification to each person with access. This ensures that each individual is uniquely accountable for its actions and any actions taken on critical data and systems can be traced to known and authorized users and processes. Necessary processes to ensure proper user identification management, including control of addition/deletion/modification/revocation/disabling of IDs and/or credentials as well as lock out of users after repeated failed access attempts and timely termination of idling session, have been implemented.

User authentication utilizes at least passwords that have to meet complexity rules, which need to be changed on a regular basis and which are cryptographically secured during transmission and storage on all system components. All individual non-console and administrative access and all remote access use multi-factor authentication.
Authentication policies and procedures are communicated to all users and group, shared or generic IDs/passwords are strictly prohibited.

Restriction of Physical Access to Personal Data

Any physical access to data or systems that house Personal Data are appropriately restricted using appropriate entry controls and procedures to distinguish between onsite personnel and visitors. Access to sensitive areas is controlled and includes processes for authorization based on job function and access revocation for personnel and visitors.
Media and backups are secured and (internal and external) distribution is strictly controlled. Media containing Personal Data no longer needed for business or legal reasons is rendered unrecoverable or physically destroyed.

Regular Monitoring and Testing of Networks

All access to network resources and Personal Data is tracked and monitored using centralized logging mechanisms that allow thorough tracking, alerting, and analysis on a regular basis (at least daily) as well as when something does go wrong. All systems are provided with correct and consistent time and audit trails are secured and protected, including file-integrity monitoring to prevent change of existing log data and/or generate alerts in case. Audit trails for critical systems are kept for a year.

Security of systems and processes is regularly tested, at least yearly. This is to ensure that security controls for system components, processes and custom software continue to reflect a changing environment. Security testing includes:

  • Processes to test rogue wireless access points,
  • Internal and external network vulnerability tests that are carried out at least quarterly. An external, qualified party carries out the external network vulnerability tests.
  • External and internal penetration tests using Recipient's penetration test methodology that is based on industry-accepted penetration testing approaches that cover all the relevant systems and include application-layer as well as network-layer tests

All test results are kept on record and any findings are remediated in a timely manner. Recipient does not allow penetration tests carried out by or on behalf of its customers. In daily operations IDS (intrusion detection system) is used to detect and alert on intrusions into the network and file-integrity monitoring has been deployed to alert personnel to unauthorized modification of critical systems.

Incident Management

Recipient has implemented and maintains an incident response plan and is prepared to respond immediately to a system breach. Incident management includes:

  • Definition of roles, responsibilities, and communication and contact strategies in the event of a compromise, including notification of customers,
  • Specific incident response procedures,
  • Analysis of legal requirements for reporting compromises,
  • Coverage of all critical system components,
  • Regular review and testing of the plan,
  • Incident management personnel that is available 24/7,
  • Training of staff,
  • Inclusion of alerts from all security monitoring systems,
  • Modification and evolution of the plan according to lessons learned and to incorporate industry developments.
Recipient has also implemented a business continuity process (BCP) and a disaster recovery process (DRP) that are maintained and regularly tested. Data backup processes have been implemented and are tested regularly.
Physical Security
Physical Access Controls

Physical components of the Recipient Network are housed in nondescript facilities ("Facilities"). Physical barrier controls are used to prevent unauthorized entrance to Facilities both at the perimeter and at building access points. Passage through the physical barriers at the Facilities requires either electronic access control validation (e.g., card access systems, etc.) or validation by human security personnel (e.g., contract or in-house security guard service, receptionist, etc.). Employees and contractors are assigned photo-ID badges that must be worn while the employees and contractors are at any of the Facilities. Visitors are required to sign-in with designated personnel, must show appropriate identification, are assigned a visitor ID badge that must be worn while the visitor is at any of the Facilities, and are continually escorted by authorized employees or contractors while visiting the Facilities.

Limited Employee and Contractor Access

Recipient provides access to the Facilities to those employees and contractors who have a legitimate business need for such access privileges. When an employee or contractor no longer has a business need for the access privileges assigned to him/her, the access privileges are promptly revoked, even if the employee or contractor continues to be an employee of Recipient or its affiliates.

Physical Security Protections

All access points (other than main entry doors) are maintained in a secured (locked) state. Access points to the Facilities are monitored by video surveillance cameras designed to record all individuals accessing the Facilities. Recipient also maintains electronic intrusion detection systems designed to detect unauthorized access to the Facilities, including monitoring points of vulnerability (e.g., primary entry doors, emergency egress doors, etc.) with door contacts, or other devices designed to detect individuals attempting to gain access to the Facilities. All physical access to the Facilities by employees and contractors is logged and routinely audited.

Continued Evaluation

Recipient will conduct periodic reviews of the Security of its Recipient Network and adequacy of its information security program as measured against industry security standards and its policies and procedures. Recipient will continually evaluate the security of its Recipient Network to determine whether additional or different security measures are required to respond to new security risks or findings generated by the periodic reviews.