Effective date: August 1, 2025
This North Park Privacy Statement (“Statement”) describes how North Park and our affiliated entities (“North Park” or “we” or “us”) collect, use, process, and share the information of users of our Sites and Services (“you” or “your”), your rights and choices with respect to your information, and how you can contact us if you have any questions or concerns. By using our Sites or Services, you agree to the collection, use, disclosure, and processing of your personal information as described in this Statement.
In this Statement, the following definitions apply:
Our Sites are not directed at children under the age of 16, and our Services are not intended for use by children under the age of 16. We do not knowingly collect information from individuals under the age of 16. If you are under the age of 16, you may not use the Services or provide your information to us through the Site.
For certain individuals, one or more of the following addendums may apply:
We may collect a variety of personal information about you or your devices from various sources, as described below.
We use the information we collect for a variety of business purposes, including:
We may share information when one of the following circumstances applies:
Company | Description | More Information |
We use Google’s services to collect and process analytics data and to place ads that we think may interest our users and potential users. | ||
Meta | We use Meta’s services to place ads that we think may interest our users and potential users. | |
We may use LinkedIn’s services to place ads that we think may interest our users and potential users, as well as to advertise openings to potential employees. | ||
Microsoft | We use Microsoft’s services to place ads that we think may interest our users and potential users. | |
TikTok | We use TikTok’s services to place ads that we think may interest our users and potential users. |
You may have the right to object to or opt out of certain uses of your information. Where you have consented to the processing of your information for a specific purpose, you may withdraw that consent at any time by contacting us as described below. Even if you opt out, we may still collect and use your information for other purposes that were not based on your consent.
Depending upon your location and in accordance with applicable laws, you may have the right to:
If you would like to exercise any of these rights in connection with the Services, please send an email to privacy@violet-dove-566109.hostingersite.com.
If you would like to exercise any of these rights in connection with the Sites, please contact us as set forth below. We will process such requests in accordance with applicable laws, and in some circumstances may need to deny your request in whole or in part (e.g., if we have a legal obligation to maintain your information for a certain purpose). To protect your privacy, we will take steps to verify your identity before fulfilling your request, such as by requiring you to submit your request via your account. You have the right to submit a request through an authorized agent, but we will require the agent to provide us with your written permission, and we may need to confirm your identity before processing the agent’s request.
Depending on your location of residence, you may have the right to appeal our response to your request. In such circumstances, we will inform you of the right to appeal and the appeal process.
Our Sites and Services may contain links to other websites, products, applications, or services that we do not own or operate. We are not responsible for the content provided by, or the privacy practices of, these third parties. Please be aware that this Statement does not apply to your activities on these third-party websites, products, applications, or services, or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.
You may direct any questions or complaints about this Statement to us by contacting us through the channels indicated below. Any disputes arising out of or related to this Statement will be handled in accordance with the dispute resolution process indicated in your contract with North Park that refers to this Statement, if applicable. In the case of users of our Services, that means our Terms of Service.
The Services, the Sites, and our business may change from time to time. As a result, we may make changes to this Statement. We reserve the right to update or modify this Statement at any time and from time to time. If we make changes to this Statement, we will post the changes on this page and will indicate at the top of this page that a change has been made and the date the Statement was last revised. Your continued use of the Site or Services after the date any such notice constitutes your acceptance of the modifications. We encourage you to read this Statement periodically to stay up to date about our privacy practices.
If you have any questions or comments about this Statement, how we collect and use your information, your choices or rights regarding such use, or wish to exercise your rights, please do not hesitate to contact us at:
Email: privacy@violet-dove-566109.hostingersite.com
Postal Address:
North Park
Attn: Legal Department/Privacy
1000 N West Street #1200
Wilmington, DE 19801
Please read these North Park Terms of Service (the “Terms“) carefully. They govern your access to and use of North Park’s cloud-based automation technology services available at violet-dove-566109.hostingersite.com after logging into your North Park Account (as defined below), North Park APIs and any updates, upgrades, modified versions, extensions, improvements, and derivative works of the foregoing (collectively, the “Service“).
North Park is a Delaware corporation, and in these Terms, we will reference ourselves as “North Park” or “we“/”us“.
“You” means the entity that you represent in accepting these Terms. You represent and warrant that (i) you have full legal authority to bind your employer or such entity to these Terms; (ii) you have read and understand these Terms; and (iii) you agree to these Terms on behalf of such employer or entity.
(i) From time to time, North Park may include North Park AI Functions as part of the Service. “Input” means all information that you submit to North Park AI Functions. “Output” means information generated and returned by North Park Al Functions based on the Input, provided, Output specifically excludes the Service, Third-Party Services, Documentation, and Usage Information. As between the parties and to the extent permitted by applicable law, Inputs and Outputs are deemed to be Customer Content. Other users providing similar Input to North Park Al Functions may receive the same or similar Output.
(ii) YOU UNDERSTAND AND AGREE THAT ANY INFORMATION OBTAINED THROUGH USING NORTH PARK AI FUNCTIONS IS AT YOUR SOLE RISK. DO NOT RELY ON FACTUAL ASSERTIONS IN OUTPUT WITHOUT INDEPENDENT FACT-CHECKING. DO NOT RELY ON DESIGNS, WORKFLOWS/PROCESSES, OR CODE IN OUTPUT WITHOUT INDEPENDENT REVIEW OF FUNCTIONALITY AND SUITABILITY FOR YOUR NEEDS. NO SUCH INFORMATION, SUGGESTIONS, OR OUTPUT OBTAINED BY YOU FROM NORTH PARK OR THROUGH NORTH PARK AI FUNCTIONS SHALL CREATE ANY WARRANTY NOT EXPRESSLY MADE HEREIN.
(iii) You may not use North Park AI Functions or Output: (1) to develop foundation models or other large-scale models that compete with North Park or North Park AI Functions; (2) to mislead any person that Output from the Service was solely human-generated; (3) in a manner that violates any technical documentation, usage guidelines, or parameters; (4) to make automated decisions that may have a detrimental impact on individual rights without appropriate human supervision; or (5) in a manner that infringes, violates, or misappropriates any of our rights or the rights of any third party.
North Park
Attn: Legal
1000 N West Street #1200
Wilmington, DE 19801
USA
North Park may revise these Terms from time to time by posting a modified version of the Terms including their effective date. If we make material changes to the Terms, we will provide you with reasonable notice prior to the new Terms taking effect. By continuing to access or use the Service after the posting of any modified Terms, you agree to be bound by such modified Terms.
At North Park, our mission is to make automation work for everyone. Our customers and partners rely on North Park Services to automate critical parts of their business. To ensure continued reliability, everyone must access and use North Park Services in ways that don’t abuse our Services. This Acceptable Use Policy (the “AUP”) serves as a guide for what we consider abuse of our Services.
Don’t access or use North Park Services directly or indirectly to, or in ways that create any of the following:
Don’t access or use North Park Services directly or indirectly to, or in ways that:
Don’t access or use North Park Services directly or indirectly to, or in ways that exhibit:
You may not use North Park Services if you are an individual or organization that has publicly stated goals, purpose, principles, or actions that advocate, sponsor, or practice discrimination, harassment, or violence towards people based on race, ethnicity, national origin, sexual orientation, gender, gender identity, religious affiliation, age, disability, disease, or immigration status.
If you are using North Park in violation of our AUP, we may investigate and take action. As every situation is unique, we review violations of this policy on a case-by-case basis. In some cases, we may contact you and request that you fix/otherwise address the violation. In others, we may temporarily or permanently suspend or terminate your North Park account, with or without notice.
“North Park” means North Park, North Park Srl, and its affiliated entities.
“Services” means the North Park cloud-based products, including the North Park help center, North Park developer platform, North Park community portal, and related tools, APIs, applications and services.
“Third Party” means North Park customers, developers, experts, integration and application partners.
We modified the North Park Acceptable Use Policy to re-organize and simplify the content. By continuing to use North Park Services after the Effective Date noted above, you agree to this Acceptable Use Policy. If you don’t agree with these modifications, your sole remedy is to cease using North Park Services immediately.
This policy may change over time, so please check back regularly for updates and changes.
This Data Processing Addendum (“DPA”) forms part of the Terms of Service or Enterprise Agreement (in either case, the “Agreement”) entered into between North Park (“North Park”) and you that incorporates this DPA by reference. This DPA governs the processing of Personal Information by North Park in providing the Service (as defined in the Agreement). This DPA does not apply to Personal Information once transferred from the Service to a Third-Party Service (as defined in the Agreement), as your agreement with that Third-Party Service will instead govern.
1.1. “Applicable Data Protection Law” means applicable law governing the use of, access to, deletion of, or processing of Personal Information under this DPA, including, but not limited to, U.S. Data Protection Laws and European Data Protection Laws, together with any national or subordinate legislation and regulations implementing, in each case as amended, repealed, consolidated, or replaced from time to time.
1.2. “Brazilian Data” means Personal Information that is subject to the protection of the Lei Geral de Proteção de Dados (“LGPD”).
1.3. “commercial purpose”, “controller”, “processor”, “data subject”, “processing” (and “process”), “service provider”, and “supervisory authority” each have the meaning given to them in Applicable Data Protection Law, as appropriate.
1.4. “Controller to Processor SCCs” means the Module Two (transfer controller to processor) of the European Commission Implementing Decision (EU) 2021/914.
1.5. “Data Privacy Framework” means the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework, and the UK Extension to the EU-US Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce, as may be amended, superseded, or replaced from time to time.
1.6. “Data Privacy Framework Principles” means the Principles and Supplemental Principles contained in the relevant Data Privacy Framework, as may be amended, superseded, or replaced from time to time.
1.7. “Europe” means the European Union, the European Economic Area and/or their member states, Switzerland, and the United Kingdom.
1.8. “European Data” means Personal Information that is subject to the protection of European Data Protection Laws.
1.9. “European Data Protection Laws” mean (a) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Information and on the free movement of such data (General Data Protection Regulation) (“GDPR”); (b) in respect of the United Kingdom, the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK GDPR”); and (c) the Swiss Federal Data Protection Act and its implementing regulations (“Swiss FADP”); in each case as may be amended, superseded or replaced from time to time.
1.10. “Personal Information” means (a) personal data or personal information (as defined under the Applicable Data Protection Law) that is subject to the Applicable Data Protection Law and (b) that is contained within Customer Content, for which you authorize North Park to collect and process on your behalf in connection with North Park’s provision of the Service under the Agreement.
1.11. “Processor to Processor SCCs” means the Module Three (transfer processor to processor) of the European Commission Implementing Decision (EU) 2021/914, as updated and/or replaced from time to time.
1.12. “Security Incident” means a confirmed breach of security of the Service or North Park’s systems used to process Personal Information leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information processed by North Park. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Information, including unsuccessful login attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
1.13. “Sensitive Information” means any Personal Information (a) revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (b) that is genetic data, biometric data processed for the purposes of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation; (c) relating to criminal convictions and offenses; and (d) any other form of Personal Information that is afforded enhanced protection under the Applicable Data Protection Law.
1.14. “Subprocessor List” means North Park’s Subprocessors.
1.15. “Swiss Amendments” mean the Controller to Processor SCCs or the Processor to Processor SCCs (as applicable) with the following amendments: (a) “FDPIC” means the Swiss Federal Data Protection and Information Commissioner, (b) “Revised FADP” means the revised version of the FADP of 25 September 2020, which is scheduled to come into force on 1 January 2023, (c) the term “EU Member State” must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility for suing their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c), (d) the Controller to Processor SCCs also protect the data of legal entities until the entry into force of the Revised FADP, and (e) the FDPIC shall act as the “competent supervisory authority” insofar as the relevant data transfer is governed by the FADP.
1.16. “UK Addendum” means the template Addendum B.1.0 issued by the UK’s Information Commissioner’s Office and laid before Parliament in accordance with s119A of the Data Protection Act 2018 of the UK on 2 February 2022, and in force from 21 March 2022, available here: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf as updated and/or replaced from time to time. For the purposes of the UK Addendum, (a) the information required for Table 1 of the UK Addendum is contained in Schedule 1 of this DPA, and the start date shall be the commencement of the Service; (b) in relation to Table 2 of the UK Addendum, the version of the EU Clauses to which the UK Approved Addendum applies is Module Two for Controller to Processor where North Park is acting as your Processor and Module Three for Processor to Processor where North Park is acting as your Subprocessor; (c) in relation to Table 3 of the UK Addendum, the list of parties and description of the transfer are as set out in Schedule 1 of this DPA, North Park’s technical and organizational measures are set out in Schedule 2 of this DPA, and the list of North Park’s Subprocessors is as provided in Section 9 of this DPA; and (d) in relation to Table 4 of the UK Addendum, neither party will be entitled to terminate the UK Addendum in accordance with clause 19 of Part 2 of the UK Addendum.
1.17. “U.S. Data Protection Laws” mean all state laws in effect in the United States of America that are applicable to the processing of Personal Information under this DPA, including, but not limited to, the California Consumer Privacy Act, as amended by the California Privacy Rights act (“CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act.
2.1. Categories of Data Subjects. As set out in Schedule 1.
2.2. Types of Personal Information. As set out in Schedule 1.
2.3. Subject-Matter and Nature of Processing. The subject-matter of processing of Personal Information by North Park is the provision of the Service to you that involves processing of Personal Information. Personal Information will be subject to those processing activities that North Park needs to perform in order to provide the Service pursuant to the Agreement.
2.4. Purpose of the Processing. Personal Information will be processed by North Park for purposes of providing the Service set out in the Agreement.
2.5. Duration of the Processing. Personal Information will be processed for the duration of the Agreement, subject to Section 12 of this DPA.
3.1. North Park will process Personal Information in its capacity as processor (a) for the purpose of providing and supporting the Service in accordance with the Agreement, this DPA, and any other documented lawful instructions from you (whether in written or electronic form); (b) to develop, enhance, and improve the Service as provided by the Agreement; and (c) as otherwise required by applicable law. North Park will at all times comply with the Applicable Data Protection Law in processing Personal Information under the Agreement.
3.2. Notwithstanding anything to the contrary in the Agreement, if required by Applicable Data Protection Law, North Park shall not: (a) retain, use, or disclose Personal Information other than as provided for in the Agreement or as needed to perform the Service; (b) “sell” (as such term is defined by CCPA) or “share,” (as such term is defined by CCPA); (c) process Personal Information except as necessary for the business purposes specified in the Agreement or this DPA; or (d) retain, use, disclose, or otherwise process Personal Information outside of the direct business relationship with Customer and not combine Personal Information with personal information that it receives from other sources, except as permitted under the CCPA.
3.3. In case North Park cannot process Personal Information in accordance with your instructions due to a legal requirement under any applicable law to which North Park is subject, North Park shall (a) promptly notify you in writing (including by e-mail) of such legal requirement before carrying out the relevant processing, to the extent permitted by the applicable law, and (b) cease all processing (other than merely storing and maintaining the security of the affected Personal Information) until you provide North Park with new instructions.
3.4. You are solely responsible for (a) the accuracy, quality, and legality of Personal Information and the means by which you acquired Personal Information; (b) complying with all necessary transparency and lawfulness requirements under Applicable Data Protection Law for the collection and use of Personal Information, including obtaining any necessary consents and authorizations; (c) ensuring you have the right to transfer, or provide access to, Personal Information to North Park for processing in accordance with the terms of the Agreement (including this DPA); and (d) ensuring that your instructions to North Park regarding the processing of Personal Information comply with applicable laws, including Applicable Data Protection Law.
3.5. You are responsible for independently determining whether the data security provided for in the Service adequately meets your obligations under Applicable Data Protection Law. You acknowledge and agree that you are solely responsible for (a) certain configurations and design decisions for the Service and (b) for implementing those configurations and design decisions in a secure manner that complies with Applicable Data Protection Law. Without limiting the foregoing, you represent, warrant, and covenant that you shall only transfer Personal Information to North Park using secure, reasonable, and appropriate mechanisms.
3.6. You acknowledge that the Service is not intended or designed for the processing of Sensitive Information, and you agree not to provide any Sensitive Information through the Service. The parties agree that you provide Personal Information to North Park as a condition precedent to North Park’s performance of the Service and that Personal Information is not exchanged for monetary or other valuable consideration.
3.7. You acknowledge that North Park is an independent controller when carrying out any activities not related solely to North Park’s processing of Personal Information added by you to the Service (such as North Park’s management of its online forum, analytics, customer accounts, and marketing program).
8.1. To the extent necessary and required by Applicable Data Protection Law, you may, at your sole expense, conduct a reasonable audit pursuant to a mutually agreed-upon audit plan with North Park that is consistent with the requirements of this Section 8.
8.2. You may exercise such audit right: (a) to the extent North Park’s provision of third-party audit reports (e.g., Service Organization Control (SOC) 2 reports) do not provide sufficient information to verify North Park’s compliance with this DPA; and (b) where required by Applicable Data Protection Law or a relevant government authority.
8.3. Each such audit must: (a) be conducted by you or through a third-party auditor on your behalf that will enter into a confidentiality agreement with North Park; (b) be limited in scope to matters reasonably required to assess North Park’s compliance with this DPA and Applicable Data Protection Law; (c) occur no more than once annually (unless required under Applicable Data Protection Law); (d) cover only processing facilities directly controlled by North Park; (e) restrict findings to your Personal Information only; and (f) treat any results as confidential information to the fullest extent permitted by Applicable Data Protection Law.
9.1. North Park engages the organizations listed on the Subprocessor List (each a “Subprocessor”) to help process Personal Information on the Service.
9.2. North Park will enter into an agreement with each Subprocessor imposing data processing and protection obligations substantially the same as those set out in this DPA.
9.3. North Park will maintain a current list of its Subprocessors, including their functions and locations, as specified in the Subprocessor List.
9.4. North Park may update the Subprocessor List from time to time. In the event that North Park updates the Subprocessor List, North Park will provide fourteen (14) days’ advance written notice (which may be via email, a posting, notification on an online portal for our services, or other reasonable means).
9.5. In the event that you do not wish to consent to the use of such additional Subprocessor, you may notify North Park that you do not consent within fourteen (14) days of North Park’s advance written notice based on reasonable data protection concerns. In such case, the parties will discuss such concerns in good faith.
9.6. If the parties are unable to reach a mutually agreeable resolution to your objection to a new Subprocessor, you, as your sole and exclusive remedy, may terminate the order for the affected Service for convenience, and North Park will refund any prepaid, unused fees for the terminated portion of the applicable subscription term for the affected Service.
10.1. In connection with the performance of the Agreement, you authorize North Park to transfer Personal Information internationally, and in particular, that Personal Information may be transferred to and processed by North Park in the United States and other jurisdictions where North Park and its Subprocessors have operations. Whenever Personal Information is transferred outside its country of origin, each party will ensure such transfers are made in compliance with the requirements of Applicable Data Protection Laws.
10.2. To the extent applicable to you, you acknowledge that in connection with the performance of the Service, North Park is a recipient of European Data in Europe and Brazilian Data in the United States. To the extent that North Park receives data in the United States, North Park will comply with the following:
10.2.1. Data Privacy Framework. North Park will use the Data Privacy Framework to lawfully receive European Data in the United States, ensure that it provides at least the same level of protection to such European Data as is required by the Data Privacy Framework Principles, and let you know if North Park is unable to comply with this requirement.
10.2.2. Standard Contractual Clauses. If the Data Privacy Framework is invalidated and/or does not cover the transfer of European Data or Brazilian Data to North Park, the applicable standard contractual clauses will be incorporated by reference and form a part of this DPA as follows:
10.2.2.1. the Controller to Processor SCCs if the restricted transfer is subject to the GDPR and North Park is acting as your processor;
10.2.2.2. the Processor to Processor SCCs if the restricted transfer is subject to the GDPR and North Park is acting as your subprocessor;
10.2.2.3. the Swiss Amendments if the restricted transfer consists of Personal Information originating from Switzerland; and
10.2.2.4. the UK Addendum if the restricted transfer is subject to the UK GDPR.
10.2.2.5. the Standard Contractual Clauses set forth in Resolution CD/ANPD No. 19/2024 if the restricted transfer is subject to the LGPD.
11.1. North Park shall make available its privacy and security policies and other such information necessary to demonstrate compliance with the obligations set forth in this DPA.
11.2 Upon reasonable notice and appropriate confidentiality agreements, and taking into account the nature of the applicable processing, North Park will assist you in fulfilling your obligations under Applicable Data Protection Laws to carry out a data protection impact or similar risk assessment related to your use of the Service, including, if required by Applicable Data Protection Laws, by assisting you in consultations with relevant government authorities.
11.3 If a law enforcement agency sends North Park a demand for Personal Information (e.g., a subpoena or court order), North Park will attempt to redirect the law enforcement agency to request that data directly from you. As part of this effort, North Park may provide your contact information to the law enforcement agency. If compelled to disclose Personal Information to a law enforcement agency, then North Park will give you reasonable notice of the demand to allow you to seek a protective order or other appropriate remedy, to the extent North Park is legally permitted to do so.
This DORA Addendum (“Addendum”) supplements the Terms of Service or the Enterprise Agreement, as applicable, (the “Agreement”) between North Park, as your supplier (“North Park”), and you, as a European Union (“EU”)-based North Park customer (“Customer”). This Addendum applies exclusively to North Park customers subject to Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (“DORA”) and takes precedence over any conflicting terms in the Agreement.
Unless defined otherwise in this Addendum, capitalized terms shall have the meaning set forth in the Agreement.
1.1. “Agreement” refers to the North Park Terms of Service (“Terms of Service”) entered into between North Park and Customer.
1.2. “Competent Authority” refers to a competent authority as defined in Article 46 of DORA.
1.3. “ICT Incident” is defined in DORA and means a single event or series of linked events that compromise the security of network and information systems and adversely impact the availability, authenticity, integrity, or confidentiality of Customer’s data or services.
1.4. “Subcontractor” means a third party that provides any ICT service (as defined by DORA) to North Park within the same ICT service supply chain connected with (and effectively underpinning) the provision of the North Park Service, in accordance with the Implementing Technical Standards on the Register of Information under Article 28(9) of DORA. The term “Subcontracting” shall be construed accordingly.
2.1 To the extent that Customer does not qualify as an EU “financial entity” as defined in Article 2(a)-(t) of DORA, or is excluded under Article 2(3) or 2(4) of DORA, this Addendum shall not apply.
2.2. North Park acknowledges that Customer is subject to certain obligations under DORA in relation to Customer’s use of ICT services provided by ICT third-party service providers such as North Park. North Park agrees to cooperate with Customer to enable Customer to satisfy its applicable obligations under DORA.
2.3. Customer acknowledges and agrees that Customer is not, and during the Term is not expected to, use North Park’s services to support a critical or important function of Customer.
3.1. Service Description: The description of the Service is provided as part of the Service Documentation.
3.2. Location of Data: North Park provides the Service from Digital Ocean servers in Europe, and certain data may be processed by our Subprocessors (defined below), unless otherwise agreed by the parties from time to time. North Park processes Customer Content in accordance with the Data Processing Addendum (“DPA”). Each North Park subprocessor (the “Subprocessors”), and the locations where North Park and each such subprocessor processes data, can be inquired at any time via email to legal@violet-dove-566109.hostingersite.com. North Park shall not change the country or region for provision of the Services or processing of Customer Content without providing reasonable prior notice to Customer.
3.3. Data Protection and Security: North Park will implement and maintain appropriate technical and organizational measures to ensure the availability, authenticity, integrity, and confidentiality of Customer Content as described in, including recovery and secure deletion of data upon termination, all in accordance with the DPA.
3.4. Data Access, Recovery, and Return: In the event of North Park’s insolvency or discontinuation of business operations, North Park provides Customer with access and technology to download, transfer, or delete its Customer Content during the term of the Agreement, as described in North Parks’s data retention policies.
3.5. Service Level Agreement: The provisions of Section 8 of the Agreement shall apply to the Service provided by North Park to Customer and shall constitute the service level agreements as required under DORA (the “Service Levels”).
3.6. ICT Incidents: North Park will cooperate with Customer relating to an ICT Incident resulting in unauthorized access or disclosure of Customer Content stored on the Service. North Park reserves the right to charge reasonable fees (including personnel cost as determined by North Park in accordance with its then-current rates) for support provided.
3.7. Cooperation with Competent Authorities: If requested by a Competent Authority under DORA, North Park will cooperate with Competent Authorities in relation to Customer’s compliance as required under DORA.
3.8. Termination Rights: The Customer may terminate the Agreement in accordance with the termination provisions of the Agreement. To the extent that DORA requires that Customer have any termination rights under the Terms of Service that are not already included in the Agreement, Customer shall have those additional termination rights as required by DORA. Termination, however effected, shall not relieve Customer of any payment obligations for Services rendered prior to termination.
3.9. Security Awareness Training: North Park will provide its personnel with security awareness program and digital operational resilience training program. To the extent required by DORA and subject to mutual agreement between the parties (including as to reasonable costs), Customer can engage North Park support personnel to participate in Customer’s ICT risk management training, provided that such training is reasonable and directly relevant to the North Park Services, can be attended virtually, and provides for input from North Park to adapt the training for relevance and reasonableness.
3.10. Subcontracting: Customer agrees that North Park may engage Subcontractors in respect of the Service and the provisions of this clause shall apply to any such Subcontracting. North Park will remain fully responsible under the Agreement for the provision of the Service to Customer.
4.1. Audit Right: To the extent necessary and required under DORA, you may, at your sole expense, conduct a reasonable audit pursuant to a mutually agreed-upon audit plan with North Park that is consistent with the requirements of this Section 4.
4.2. Exercise of Audit Right: You may exercise such audit right: (a) to the extent North Park’s provision of third- party audit reports (e.g., Service Organization Control (SOC) 2 reports) do not provide sufficient information to verify North Park’s compliance with this Addendum and/or the DPA; and (b) where required by DORA or a relevant government authority.
4.3. Conditions: Each such audit must: (a) be conducted by you or through a third-party auditor on your behalf that will enter into a confidentiality agreement with North Park; (b) be limited in scope to matters reasonably required to assess North Park’s compliance with this Addendum, the DPA and/or your regulatory obligations under DORA; (c) occur no more than once annually (unless required by a Competent Authority or DORA); (d) cover only processing facilities directly controlled by North Park; (e) restrict findings to your Personal Information (as defined in the DPA) only; and (f) treat any results as confidential information to the fullest extent permitted by applicable law.
5.1. Confidentiality: Confidential Information shared in connection with this Addendum shall be treated as “Confidential Information” as defined in, and in accordance with, the Agreement.
5.2. Conflict: In the event of any conflict between this Addendum and the Agreement, the terms of this Addendum shall prevail.
5.3. Termination of Addendum: This Addendum shall terminate automatically upon the expiration or termination of the Agreement.