Data Processing Addendum

This Data Processing Addendum ("DPA") applies when a client ("Client") has entered into a signed agreement with CPM One Source that incorporates this DPA (the "Agreement"), and we process personal information on the Client's behalf in providing services.

The version of this DPA incorporated into a signed Agreement governs that Agreement. Later versions posted here do not apply unless the Client agrees in writing. If this DPA conflicts with a signed Agreement, the signed Agreement controls.

Definitions

• "Client Personal Information": personal information that we process on behalf of the Client under the Agreement.
• "Data Protection Laws": applicable U.S. privacy and data protection laws, including the California Consumer Privacy Act, as amended ("CCPA").
• "Security Incident": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Information.
• "Subprocessor": a third party we engage to process Client Personal Information.

Terms not defined here have the meanings given in the Agreement or Data Protection Laws.

Roles of the Parties

The Client is the business or controller of Client Personal Information. CPM One Source is a service provider or processor, and processes Client Personal Information only on the Client's documented instructions.

Scope of Processing

• Subject matter: provision of storage, logistics, project management, inventory, and client portal services under the Agreement.
• Duration: the term of the Agreement, plus any period required to return or delete data.
• Nature and purpose: hosting, storing, organizing, and transmitting data as needed to perform the services.
• Categories of data subjects: Client employees, contractors, authorized portal users, guests, and other individuals whose information the Client provides.
• Categories of personal information: names, contact details, job titles, account credentials, delivery and location details, and inventory or project records containing personal information.

Service Provider Obligations

We will not:

1. Sell or share Client Personal Information.
2. Retain, use, or disclose Client Personal Information for any purpose other than performing the services, including any commercial purpose outside the Agreement.
3. Retain, use, or disclose Client Personal Information outside the direct business relationship with the Client.
4. Combine Client Personal Information with personal information received from other sources, except as permitted by Data Protection Laws.

We will comply with applicable obligations under Data Protection Laws and will notify the Client if we can no longer meet them.

Confidentiality

We ensure that personnel authorized to process Client Personal Information are bound by confidentiality obligations.

Security

We maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of Client Personal Information, as described in our Security Overview.

Subprocessors

The Client authorizes us to engage Subprocessors to provide the services. We will:

• Impose data protection obligations on each Subprocessor that are no less protective than this DPA.
• Remain responsible for each Subprocessor's performance.
• Give the Client at least 30 days' notice before adding or replacing a Subprocessor, during which the Client may object on reasonable data protection grounds.

A current list of Subprocessors is available on request at legal@cpmonesource.com.

Consumer Requests

We will promptly forward to the Client any request we receive from an individual about Client Personal Information, and will provide reasonable assistance for the Client to respond.

Security Incidents

We will notify the Client without undue delay, and no later than 72 hours, after becoming aware of a Security Incident affecting Client Personal Information. The notice will include available details about the nature of the incident, affected data, and steps taken in response.

Audits

On reasonable written request, no more than once per year, we will provide information needed to demonstrate compliance with this DPA, such as completed security questionnaires or summaries of relevant assessments.

Return and Deletion

On termination of the Agreement, we will return or delete Client Personal Information at the Client's choice within 30 days, unless retention is required by law.

Data Location

We and our Subprocessors process Client Personal Information in the United States, unless otherwise agreed in writing.

Regulated Data

This DPA does not cover protected health information under HIPAA or education records under FERPA. If the services involve such data, the parties must enter into a separate Business Associate Agreement or other appropriate agreement before that data is provided.

Changes to This Addendum

We may update this DPA from time to time. We will post the updated version with a new effective date. Updated versions apply to existing Agreements only as described at the top of this DPA.

Contact Us

CPM One Source, Inc.
6140 Malburg Way
Vernon, CA 90058
legal@cpmonesource.com
1-818-262-1367