Definitions. For the purposes of this Addendum, (a) “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civil Code § 1798.100 et seq. and its implementing regulations (as amended by the California Privacy Rights Act of 2020); (b) “Customer Personal Information” means Customer data processed by PeopleNet on Customer’s behalf that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, to the extent that such information is protected as personal information under CCPA or an analogous term under other applicable US Data Protection Laws; (c) “US Data Protection Laws” means CCPA and any other United States laws and regulations applicable to the processing of personal information which are also applicable to PeopleNet; and (d) “personal information”, “sell”, “service provider”, “verifiable consumer request”, “processing”, and “consumer” will have the meanings given to them in the CCPA (expressly including the CPRA amendments thereto effective January 1, 2023) and within the scope of the CCPA.

Processing of Customer Personal Information. To the extent that in connection with its performance of the Agreement PeopleNet processes Customer Personal Information on Customer’s behalf that is subject to applicable US Data Protection Laws, PeopleNet (i) acknowledges and agrees that it is, and will act as, a “service provider” with respect to Customer Personal Information provided to PeopleNet by Customer or on Customer’s behalf in accordance with the applicable terms of such US Data Protection Laws; (ii) will maintain reasonable security procedures and practices appropriate to the nature of the Customer Personal Information provided to PeopleNet by Customer or on Customer’s behalf to protect Customer Personal Information from unauthorized access, use or destruction, in accordance with the terms of the Agreement and the applicable requirements of US Data Protection Laws; (iii) will not retain, use, or disclose Customer Personal Information provided to PeopleNet by Customer or on Customer’s behalf for any purpose (including any commercial purpose) other than for the business purposes specified in the Agreement, the direct business relationship with Customer, as otherwise instructed by Customer, or as otherwise permitted under applicable US Data Protection Laws; (iv) will not combine Customer Personal Information it receives from Customer or on Customer’s behalf with personal information it receives from a third party, except to the extent otherwise permitted under applicable US Data Protection Laws; and (v) will not transfer or disclose Customer Personal Information provided to PeopleNet by Customer or on Customer’s behalf to a third party in a manner that constitutes “selling” or “sharing” such information under applicable US Data Protection Laws, except to the extent such transfer or disclosure is otherwise permitted under applicable US Data Protection Laws. To the extent required by applicable US Data Protection Laws, Customer may take reasonable and appropriate steps as mutually agreed upon with PeopleNet to verify that PeopleNet’s processing of Customer Personal Information is in a manner consistent with PeopleNet’s obligations under US Data Protection Laws and the terms of the Agreement and this Addendum. PeopleNet will promptly notify Customer if it determines that it can no longer meet its obligations under this Addendum and/or applicable US Data Protection Laws with respect to Customer Personal Information provided to PeopleNet by Customer or on Customer’s behalf. To the extent required by applicable US Data Protection Laws, if Customer reasonably determines that PeopleNet is using Customer Personal Information in a manner not authorized under the Agreement and this Addendum, Customer will have the right to direct PeopleNet to stop and remediate such unauthorized use. Customer acknowledges and agrees that PeopleNet may use its affiliates and other sub-processors to process personal information for the purposes of the Agreement in compliance with applicable subcontracting requirements set forth under US Data Protection Laws. If PeopleNet substantiates any unauthorized access to and exfiltration, theft, or disclosure of Customer Personal Information, PeopleNet will notify Customer as soon as is reasonably possible, provided that PeopleNet’s notification of or response to such event will not be construed as an acknowledgement by PeopleNet of any fault or liability with respect to such event. The Parties agree that Customer’s provision or other transfer of Customer Personal Information to PeopleNet does not constitute a sale of such information to, or sharing of such information with, PeopleNet.

Data Subject Requests. If PeopleNet receives a consumer request that identifies Customer in connection with Customer Personal Information under applicable US Data Protection Laws, PeopleNet will notify that consumer of its role as a service provider to Customer and will direct the consumer to resubmit such request to Customer, and PeopleNet will not otherwise respond to such request directly unless otherwise required by applicable law. Customer (and not PeopleNet) will be responsible for responding to such request using the tools and information provided or made generally available by PeopleNet, e.g., PeopleNet’s online portals or APIs, its Privacy Policy, standard documentation regarding PeopleNet’s products, software and services, etc. To the extent such tools and information do not enable Customer to respond to a verified consumer request, upon Customer’s request PeopleNet will provide Customer with reasonable assistance in responding to a verified consumer request with respect to Customer Personal Information in PeopleNet’s systems subject to such request.

Changes. US Data Protection Laws remain subject to amendment and regulations that have not yet been promulgated, and other states and the federal government are considering similar laws (all of the foregoing, “New Privacy Laws“). PeopleNet will have the right to modify this Addendum upon thirty (30) calendar days prior notice to Customer in writing or by email as reasonably determined by it to be necessary for continued compliance with US Data Protection Laws, including without limitation New Privacy Laws. If Company objects to such modifications in writing during such notice period, the Parties shall work together in good faith to discuss and resolve such concerns.

This Addendum is incorporated by reference into and is made a part of the Agreement. In the event of a conflict between a term or provision in this Addendum and a corresponding term or provision in the Agreement where US Data Protection Laws apply to such term or provision, this Addendum controls.