PRIVACY AND DATA SECURITY ADDENDUM

For the
Enterprise Terms of Service

1. Scope of Personal Data.

1. 1.1 Data Subjects. The Personal Data Subjects to be Processed may include: Customer’s employees, customers, and / or End Users.
2. 1.2 Data Elements. The Personal Data Elements to be Processed may include: name and email or postal address and IP address for End Users. In the case of an individual accessing a Customer’s account with MinMax, those elements plus phone number, and country location may be included.

2. Limitation on Use of Personal Data.

MinMax shall only Process Customer’s Personal Data to the extent necessary to perform the requested Services and in accordance with Customer’s instructions. MinMax shall not Process Customer’s Personal Data for any other purpose unless Customer specifically authorizes such purpose in writing.

3. Compliance with Laws.

MinMax shall comply with all applicable laws of the United States and the subject countries’ laws, rules and regulations applicable to MinMax’s performance under the Agreement, including but not limited to those applicable to the Processing of Personal Data (“Applicable Law”) when processing Customer’s Personal Data.

4. Notice and Consent.

It is understood and agreed that MinMax itself does not and will not, under this Agreement, collect Personal Data. Any Personal Data collected under this Agreement is collected by Customer. MinMax is exclusively a “data processor” under this Agreement. Accordingly, Customer represents and warrants to MinMax that, with respect to any Personal Data given to MinMax under this Agreement, in connection with MinMax’s Services, that Customer has (i) provided a legally-sufficient notice of the data collection to each individual and (ii) obtained consent from the individual to the use of the individual’s Personal Data.

5. MinMax Employees

1. 5.1

   MinMax shall take all reasonable steps to ensure the reliability of its employees or other personnel having access to the Personal Data, including the conducting of appropriate background and/or verification checks. MinMax shall perform the following background checks before an individual is hired:

   • SSN Validation
   • Prohibited Parties Check
   • Address History
   • National Sex Offender Registry
   • National Crime Search
2. 5.2

   MinMax shall limit access to Customer’s Personal Data to those employees who have a business need to have access to such Personal Data and shall ensure that such employees:

   1. 5.2.1 access data using individually identifiable authentication and secure log‑on processes when accessing the Personal Data;
   2. 5.2.2 have agreed in writing through their execution of Employment Agreements to protect the confidentiality and security of all Company Confidential Information, which the parties agree includes Personal Data provided under this Agreement; and
   3. 5.2.3 have received reasonable training regarding the handling of Customer Personal Data and Applicable Law to allow the employees to comply with the terms of this Addendum.

6. Subcontractors and Other Third Parties

1. 6.1 MinMax shall not subcontract its obligations under this Addendum without prior written consent from Customer. Where Customer grants MinMax consent to use subcontractors, MinMax shall do so in accordance with this Section.
2. 6.2

   If authorized to use subcontractors, in selecting and retaining subcontractors, MinMax shall:

   1. 6.2.1 Conduct appropriate due diligence on each subcontractor to ensure that it is capable of providing the level of protection for Customer’s Personal Data that is required by the Agreement including this Addendum, and provide evidence of such due diligence to Customer upon request;
   2. 6.2.2 Execute a written agreement with each subcontractor that includes provisions that are no less protective of the Personal Data than the requirements and obligations required by the obligations set forth in this Addendum including this Addendum; and
   3. 6.2.3 Remain liable for all the acts and/or omissions of the subcontractor.

7. Access and Other Requests

1. 7.1 MinMax shall, unless legally prohibited from doing so, notify Customer as soon as reasonably practical, and in any event within three (3) business days, of receiving any request or complaint related to any Customer Personal Data. Subject to the foregoing sentence, MinMax shall not respond to any requests for access to Personal Data unless Customer explicitly authorizes in writing MinMax to do so, unless MinMax has a legal obligation under Applicable Law to respond directly. If MinMax has a mandatory obligation under Applicable Law to respond directly, then it shall notify Customer of this requirement when making the initial notification and shall make commercially reasonable effort to comply with Customer’s reasonable requests in responding to such request.
2. 7.2 MinMax shall not, unless legally obligated to do so, disclose Personal Data to any third party without the prior written consent of Customer. Where any disclosure or transfer of Personal Data is required by law, MinMax shall, if on the advice of its counsel it is not otherwise prohibited from doing so, notify Customer and cooperate fully with Customer in any effort led by Customer to intervene and quash or limit such requests or respond to a governmental authority relating to the Personal Data that MinMax processes under this Addendum. If MinMax is legally required to respond to a Government Request, and MinMax has a legally-permitted opportunity to do so, MinMax, after consultation with Customer, shall only disclose the minimum amount of Personal Data necessary to comply with law or judicial process.
3. 7.3 MinMax shall correct and/or delete Personal Data upon Customer’s instructions, provided, however, that in all cases, MinMax is entitled to keep, and shall keep, Personal Data as necessary to meet regulatory obligations, preserve its records for financial auditing purposes, or similar legal requirements.

8. Confidentiality.

All Personal Data shall be treated as confidential data in accordance with the terms of the confidentiality terms in the Agreement in addition to the terms herein. To the extent MinMax continues to retain any Personal Data after the Agreement or this Addendum terminates, MinMax’s obligations under this Addendum will continue for as long as any Personal Data is so retained.

9. Security.

MinMax maintains all appropriate technical, physical, administrative and organizational measures against theft, unauthorized or unlawful acquisition, access, or processing of or accidental loss, destruction, alteration, or damage to Personal Data, as well as any other minimum security requirements set forth in Applicable Law. MinMax ensures that such measures are appropriate to the type of data and the harm that might result from unauthorized or unlawful acquisition, access or processing or accidental loss, destruction, alteration or damage to the Personal Data.

1. 9.1 MinMax conducts a formal security awareness training program that educates all employees and contractors on the importance of information security, which also provides specific additional security training to certain employees and contractors of the Company depending on their job functions.
2. 9.2 General security awareness training is given to all employees annually and upon hire. The security awareness training includes the delivery and review of the MinMax Information Security Policy .All attendees shall acknowledge their review of the Information Security Policy annually. Those who do not attend the training will not be certified to work on company resources or handle sensitive information of any kind.
3. 9.3 Public Data – Electronic data MinMax intentionally shares with the public in the course of normal business are classified as public data. They require no special handling or destruction procedures. Examples of public data include website content, marketing material, and external communication through social media.
4. 9.4

   Classified Data – Electronic data or paper records which could cause harm to MinMax if made public are classified as confidential data. Examples of confidential data include the company’s financial information, internal emails, product roadmaps, details of partner contracts, product inventory, and proprietary source code.

   MinMax will grant access to confidential data to only those employees with a legitimate business purpose for the data. All employees must protect MinMax’s confidential data by following the storage and disposal requirements described in this document.

5. 9.5

   Personally Identifiable Information (PII) Data – PII is a special class of confidential data, which can be used to identify individual customers or employees. Examples of PII include names, addresses, email addresses, and, in the case of our Customers, phone numbers, and payment information within Customer’s account.

   MinMax will take steps to minimize the amount of PII we store, and only grant access to employees with a legitimate purpose for the data. All employees must protect Customers’ PII by following the storage and disposal requirements described in the Tango Card Security Policy.

6. 9.6

   Cardholder Data – Cardholder data is a special class of confidential data, which includes the primary account number (PAN) and card verification values (CVV2) associated with Customers’ credit cards. Computers and networks where MinMax stores cardholder data automatically fall into the scope of the Payment Card Industry Data Security Standard (PCI-DSS).

   MinMax (i) minimizes the amount of cardholder data we store, (ii) never stores card verification values post-authorization, and (iii) purges unnecessary cardholder post-authorization information. These data will also receive our highest level of security controls.

   All MinMax employees must be familiar with the storage, handling and destruction requirements for cardholder data.

10. Encryption.

1. 10.1 Except when transmitted over a secure network, MinMax will encrypt all records and files containing Personal Data in transmission and storage, including when Personal Data travels across public networks, are transmitted wirelessly, or are transported on a data storage device such as a computer service, or are otherwise transmitted beyond the logical or physical controls of MinMax’s network.
2. 10.2 MinMax will encrypt all records and files containing Personal Data that are stored on any portable media, including, but not limited to, laptops, mobile devices, and thumb drives. Customer acknowledges and agrees that the foregoing obligation of MinMax is subject to Customer not using email to transmit any Personal Data to MinMax, under any circumstances.
3. 10.3 MinMax will apply a current encryption technology that has been adopted by an established settings body, such as the Federal Information Processing Standards issued by the National Institute of Standards and Technology, which renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data.

11. Audits

1. 11.1 Right to Audit. Subject to the provisions of this paragraph, Customer may, upon not less than thirty (30) days’ notice, request to conduct a full security audit, including, but not limited to, penetration or vulnerability testing of MinMax’s network and systems, including those of any Subcontractor, to identify the strengths and weaknesses of existing security arrangements and to verify compliance with MinMax’s obligations under this Addendum as well as MinMax’s overall compliance with this Addendum. Any such audit will be performed entirely at Customer’s expense and shall not disrupt any of MinMax’s ordinary operations. The findings and/or reports from any such audit shall be shared in full with MinMax at the same time such are given to Customer, and shall be deemed to also be MinMax’s Confidential Information. For clarity, MinMax may share any such findings or reports with a third party of its choosing, but Customer may not share any such findings or reports with any other third party. To the extent MinMax engages a Third Party auditor to perform a SSAE 16 (or any successor thereto) audit or other security audit of any of MinMax’s operations, information security program and disaster recovery/business continuity plan, MinMax may elect to share with Customer the findings of such security assessments or reviews. In the event MinMax engages a Third Party auditor to perform such audit and elects to share such audit findings, Customer will not have an independent right to also audit MinMax for the following twelve months, provided that MinMax confirms to Customer that MinMax has reviewed the results and taken appropriate action as applicable.
2. 11.2 Security Issues. If an audit reveals failure to comply with any requirement set forth in the Agreement or any vulnerability that has the potential to compromise Personal Data, MinMax shall promptly provide written notification of such issue to Customer. Within ten (10) business days thereafter MinMax or the Subcontractor (as applicable) shall remediate such issue or provide Customer with an acceptable plan and schedule for remediation. MinMax or the Subcontractor (as applicable) shall bear all reasonable costs for control re‑testing to verify the remediation of any such issue.

12. Data Breach.

1. 12.1

   If MinMax experiences a Data Breach (as defined in Section 18, below), then it shall as expeditiously as possible notify Customer after discovery. MinMax shall:

   1. 12.1.1 investigate and remediate the effects of the Data Breach, and, if expressly requested in writing by Customer, and counsel for MinMax agrees that such notice is required, notify Data Subjects and/or regulators of the Data Breach;
   2. 12.1.2 provide Customer with assurance reasonably satisfactory to Customer that such Data Breach shall not recur.
2. 12.2 Customer shall have the right to participate in any security investigation relating to the Data Breach. Provided MinMax is clearly at fault for the Data Breach, MinMax shall bear the expenses and direct damages to Customer (including any fines assessed by a regulatory body) associated with a Data Breach including, without limitation, any costs: (1) of providing notices of a Data Breach to affected individuals, and to state, federal, and/or foreign jurisdiction regulatory bodies; and (2) of remedying the Data Breach.

13. Return of Personal Data.

At the conclusion of the Agreement or at an earlier time upon Customer’s request or after the performance of the requested Services, MinMax shall immediately return to Customer and/or, at Customer’s request, securely destroy all of Customer’s Personal Data whether in electronic or hard‑copy form in its possession, custody, or control or in the possession, custody or control of any Subcontractor. Subject to the following sentence, if Customer requests destruction, then within sixty (60) calendar days of such request (unless a shorter period is required by Applicable Law), MinMax shall send Customer a written certificate of destruction. In the event MinMax’s ability to preserve data sufficient for meeting its regulatory obligations or for financial auditing purposes does not permit or would significantly interfere with MinMax’s ability to comply with the destruction of some or all Personal Data, MinMax warrants that it shall ensure the strict confidentiality of the retained Personal Data and that it shall not Process any Personal Data by or on behalf of Customer after termination of the Agreement, provided that any such retained Personal Data will continue to be subject to the terms of this Addendum.

14. International Data and Transfers

1. 14.1 MinMax shall not process or transfer, nor permit any Subcontractor to Process or transfer, any Personal Data across national borders without Customer’s prior written consent.
2. 14.2 Upon Customer’s request, MinMax shall make commercially reasonable efforts to establish with Customer) mutually-agreed data transfer agreements or contractual clauses, prior to and in connection with any international transfers or Processing of Personal Data as set forth in the EU DATA TRANSFER AGREEMENT (the EU-approved standard clauses for international transfer of Personal Data) or, where applicable, contractual clauses required by other countries for international transfers of personal data. For clarity, nothing herein obligates MinMax to agree to any changes to these clauses or agreements as may be proposed by Customer.

15. Indemnity and Liability

1. 15.1 Indemnification. MinMax shall indemnify, defend and hold harmless Customer and/or relevant Customer Affiliates from and against any and all actual and direct damages related to a Data Breach.
2. 15.2 Remedies. MinMax’s indemnification obligations under Section 15.1 shall be in addition to any indemnification or similar obligations MinMax may have under the Agreement, including, without limitation, the obligation to pay for remediation efforts as provided in Section 12. Customer’s rights and remedies under this Addendum are not subject to any limitation of actions, arbitration provisions, or any other similar limiting provisions stated in the Agreement. Without limiting the foregoing: (i) there shall be no limitations on MinMax’s liability for direct and actual damages arising under this Addendum or otherwise relating to privacy, security, integrity or confidentiality of Personal Data, (ii) Customer shall not be precluded from immediately pursuing any rights or remedies it may have under or relating to this Addendum, and (iii) MinMax shall be liable for all indemnification obligations under Section 15.

16. Data Quality.

If Customer Personal Data is in the possession of MinMax and to the extent required by Applicable Law, MinMax shall preserve the accuracy and integrity of Personal Data, and, where required as part of the Services or as otherwise directed by Customer, MinMax shall update, amend, and correct Personal Data that is inaccurate or incomplete.

17. Third Party Beneficiaries

1. 17.1 Subject to Section 17.2, nothing in this Addendum shall confer any benefits or rights on any person or entity other than the parties to this Addendum.
2. 17.2 Provided Customer has provided written notice in advance to MinMax of the identity of and contact information for its Customer Affiliates, where the Services include the Processing by or on behalf of MinMax of the Personal Data of Customer Affiliates, each such Customer Affiliate may enforce the terms of this Addendum as a third party beneficiary against MinMax in respect to its Personal Data as if it were a party to this Addendum and the Agreement.

18. Definitions

In this Addendum, capitalized terms shall have the meanings set out below. Any capitalized terms not defined below or elsewhere in this Addendum shall have the meanings ascribed to these terms in the Agreement:

“Affiliate” means in relation to a party, any entity which (directly or indirectly) controls, is controlled by and/or under common control with that party.

“Personal Data” is any information provided to MinMax by Customer (or Customer’s Affiliate) relating to an identified or identifiable person; an identifiable person is one who can be identified, directly or indirectly (including in combination with other information) and that is required or requested by MinMax to provide its Services to Customer or Customer’s Affiliates. Personal Data under this Agreement shall only include information that is within the meaning set forth in any Applicable Law pertaining to Personal Data, personal information, and/or personally identifiable information if, and only if MinMax requires and requests such information in order to perform its Processing of the Data. For clarity, therefore, if Customer (or Customer’s Affiliates) provide to MinMax additional data that may be included in definitions of Personal Data under Applicable Law, but is not requested or required by MinMax to provide Services, while MinMax will take all commercially reasonable steps to protect such information, such extraneous information shall not be subject to (a) the liabilities and indemnification obligations set forth in Section 15, or (b) any obligation to update, correct or amend any such extraneous data.

“Data Breach” means a known or suspected unauthorized and/or unlawful access to, acquisition or Processing of Personal Data whether in electronic or hard‑copy form while it is within MinMax’s possession.

“Process” means any operation or set of operations that is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, return or destruction, and “processed,” or “processing” shall be construed accordingly.

“Security Safeguards” means those administrative, technical and physical privacy and security‑related measures commensurate with the Personal Data Processed by MinMax in performing the Services and consistent with applicable Laws, to protect against theft, loss and unauthorized access to or processing of the Personal Data, including, but not limited to, those designed to prevent a Data Breach.

“Transfer” means the moving of Personal Data from one location or person to another, whether by physical or electronic means; and the granting of access to Personal Data by one location or person to another, by physical or electronic means, and “transferred,” or “transferring” shall be construed accordingly.