Customer Data Privacy Policy
1. CUSTOMER DATA: Client is providing Salesfloor with information containing personal identifying information (“PII”) of customers of Client’s brand (“Customer Data”), the whole pursuant to a Master Services Agreement with an effective date of December 23, 2024 (the “MSA”), as well as statements of work, Subscription Agreements, Professional Service Agreement or other related agreements which may be entered into by the parties (collectively hereinafter, the “SOWs”). “PII” means any information which identifies an individual customer, including, but not limited to, name, address, telephone number, email address or other unique identifier. Customer Data is provided in order for Salesfloor to perform certain services requested by Client, which may include, without limitation, collecting, recording, organizing, analyzing, transferring, disclosing, storing, manipulating, combining and/or deleting such data (“Services”), and which Services have been set forth in a separate SOW or other related agreement.
2. RESTRICTIONS ON USE, DISCLOSURE AND TRANSFER: Customer Data is and shall remain the exclusive property of Client at all times. Under no circumstances shall Customer Data be: (a) used by Salesfloor other than in connection with the provision of Services; (b) disclosed, sold, assigned, leased or otherwise provided to third parties by Salesfloor; or (c) commercially exploited by or on behalf of Salesfloor, its employees or agents.
3. THIRD PARTY AGREEMENTS: Customer Data shall not be disclosed to or shared with a third party absent Client’s express written consent, which shall at all times be conditioned upon Salesfloor maintaining a written agreement with such third party requiring its adherence to the same obligations as Salesfloor’s hereunder. Salesfloor shall remain accountable and responsible for any breach of this CDSA by such third party.
4. RETURN OR DESTRUCTION OF CUSTOMER DATA: Upon the termination or expiration of this CDSA, or upon Client’s earlier request, Salesfloor shall (a) promptly return or destroy (as specified by Client, at its option) all physical forms, copies, or derivations of Customer Data including any backup copies on tapes, disks, or any other media, whether in the custody of Salesfloor or a third party contracted by Salesfloor to manage storage of Salesfloor’s backups; (b) if destruction is specified, take reasonable steps to render all paper or electronic records unreadable and incapable of reconstruction and provide reasonable certification and/or documentation of same; and (c) not make or retain any copies of Customer Data whatsoever.
5. REQUIRED SECURITY PROCEDURES AND PRACTICES: Salesfloor shall adopt, implement and maintain security procedures and practices to prevent the unauthorized and accidental access to, modification, use, disclosure, appropriation and destruction of Customer Data. At a minimum, such procedures and practices shall: (a) comply with all applicable laws, rules, regulations, or similar enactments, and any industry standards; (b) require storage of Customer Data in a physically and technologically secure environment that protects it from unauthorized access, modification, use, disclosure, appropriation and destruction; (c) restrict access to those persons who have a “need to know” for purposes of providing Services; and (d) take into account the nature of Customer Data and the commensurate risks associated with handling such Customer Data. In the event that Salesfloor plans to send Customer Data outside of the US, Salesfloor shall obtain Client’s prior written approval.
6. NOTIFICATION OF BREACH: Salesfloor shall notify Client: (a) within twelve (12) hours, if Salesfloor reasonably believes or suspects that there has been unauthorized or accidental access to, modification, use, disclosure, appropriation or destruction of Customer Data (“Suspected Breach”), or (b) within eight (8) hours, if there is unauthorized or accidental access to, modification, use, disclosure, appropriation or destruction of Customer Data (“Breach”). Salesfloor shall use diligent efforts to address and remedy such Suspected Breach or Breach in a timely manner and provide all reasonable assistance requested by Client and/or its designated representatives in correcting, remediating and/or investigating such event, including, but not limited to, notifying impacted or potentially impacted individuals. It shall be within Client’s sole discretion to determine whether such notification is required. Notwithstanding anything to the contrary set forth in any other agreement between the parties, Salesfloor acknowledges that if a Breach is determined to be caused by or resulting from Salesfloor’s negligence or material breach in its data security or Virus protection obligations hereunder, then such Breach shall constitute grounds upon which Client, in its sole discretion, may immediately terminate this Agreement and all SOWs without penalty and receive a pro-rata refund for any fees which were pre-paid for any time period after the effective date of termination.
7. REMEDIES FOR BREACH: In the event of a Suspected Breach or Breach, Client shall have the remedies set forth in the MSA and SOWs.
8. INDEMNIFICATION: The indemnification obligations and the limitation of liability set forth in the MSA shall apply to this CDSA.
9. LEGALLY MANDATED DISCLOSURE: If Salesfloor is required by law to disclose Customer Data, then to the extent not contrary to law, Salesfloor shall not disclose such data without providing Client notice of such request within forty-eight (48) hours of receiving it so that Client may, at its own expense, exercise such legal rights as it may have to prevent or limit such disclosure, including, but not limited to, seeking a protective order. Salesfloor shall exercise all reasonable efforts to prevent or limit any such disclosure including, without limitation, by cooperating with Client to obtain an appropriate protective order or other reliable assurance that confidential treatment will be accorded Customer Data.
10. LENGTH OF OBLIGATION: The obligations of Salesfloor under this CDSA shall continue for as long as Salesfloor continues to have access to or be in possession of Customer Data, even if all other agreements between Salesfloor and Client are terminated.
11. NOTICES: Required notices shall be in writing, sent via express courier, and shall be effective upon delivery to the physical address set forth below, to the attention of the title of the person executing this CDSA, provided however, that a party may notify the other of a change of its notice address in accordance with this paragraph. In addition and notwithstanding the foregoing, any notice under Paragraph 7 or Paragraph 10 shall be made initially by telephone and/or email, confirmed with a writing sent pursuant to this paragraph.
12. ENTIRE AGREEMENT, AMENDMENT AND PRECEDENCE: Save and except for the MSA and SOWs, this is the entire agreement between the parties concerning the security of Customer Data, supersedes any prior written or oral agreements, and may be modified only by a writing executed by both parties. For the avoidance of doubt, other than with respect to the MSA and SOWs, this CDSA shall supplement (and not supplant or supersede) any other nondisclosure or other agreement between the parties. In the event of any conflict between this CDSA and any other agreement between the parties (or its Affiliates), the terms of this CDSA shall prevail, save and except for the MSA and SOWs.
13. WAIVER: Client’s failure to enforce this CDSA on any occasion will not be construed as a waiver of its right to enforce and compel compliance with this CDSA on any other occasion.
14. SEVERABILITY: If any provision of this CDSA is held invalid or unenforceable, it shall be replaced by an enforceable provision which most closely reflects the parties’ original intent and all other provisions shall remain in full force and effect.
15. COUNTERPARTS: This CDSA may be executed in counterparts, all of which taken together shall constitute one instrument. Signatures may be delivered via electronic scan (PDF).
16. ACKNOWLEDGMENT: By executing below, Salesfloor expressly acknowledges that this Customer Data Security Agreement is a prerequisite for Client’s release of Customer Data and that such data would not be released to Salesfloor but for Salesfloor’s promises and undertakings set forth herein.