California Privacy Addendum

Version 4.0.0

CDCK and Customer agree to add the following terms to their Agreement for Internet discussion forum hosting. If CDCK and Customer previously agreed to terms for compliance with the California Consumer Privacy Act, or CCPA, the terms of new addendum completely replace those terms.

CCPA Terminology

This addendum uses the terms personal information, process, processes, sell, share, third party, contractor, and service provider as defined by the CCPA, as amended by the California Privacy Rights Act and supplemented by California regulations.

Compliance

CDCK will process personal information on Customer’s behalf to provide services under the Agreement. Both sides agree to do their respective parts to comply with the CCPA, consistent with CDCK’s role as a service provider, rather than as a contractor or third party.

Cooperation

Whenever it is feasible and legal to do so, each side will give the other prompt notice of user rights requests, regulatory inquiries, and other communications under the CCPA according to the notice provisions of the Agreement. Both sides agree to cooperate in good faith to respond to and honor such communications, and to meet other obligations under the CCPA.

Definitional Requirements

CDCK and Customer intend the following terms to meet the definition of service provider in CCPA Section 1798.140(v) and the exception to the definition of third party in CCPA Section 1798.140(w)(2):

Prohibitions

CDCK may not:

  1. sell or share personal information collected from consumers covered by the California Consumer Privacy Act that CDCK processes on Customer’s behalf

  2. retain, use, or disclose such information for any purpose other than for the specific purpose of performing the services specified in the Agreement, including retaining, using, or disclosing such information for a commercial purpose other than providing the services specified in the Agreement

  3. retain, use, or disclose such information outside of the direct business relationship between CDCK and Customer

  4. combine such information with personal information received from, or on behalf of, anyone other than Customer, except as allowed for a service provider under California law and regulation

Certification

CDCK certifies that CDCK understands the restrictions in Prohibitions and will comply with them.

Subprocessing

On written notice to Customer, CDCK may engage subprocessors to process personal information on Customer’s behalf under written contracts requiring them to meet the requirements for a service provider under the CCPA. CDCK currently uses the subprocessors listed at https://discourse.org/subprocessors as of the date of this addendum.

General Duties

CDCK and Customer intend the following terms to meet the requirements of CCPA Section 1798.100(d):

  1. The personal information is disclosed by Customer only for the specific purpose of performing the services specified in the Agreement.

  2. CDCK agrees to comply with applicable obligations under the CCPA and provide the same level of privacy protection as is required by the CCPA.

  3. Customer may take reasonable and appropriate steps to help ensure that CDCK uses the personal information transferred in a manner consistent with CDCK’s obligations under the CCPA.

  4. CDCK agrees to notify Customer if CDCK makes a determination that it can no longer meet its obligations under the CCPA.

  5. Customer may, upon notice, take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

Minimization

Both sides agree to limit use of personal information covered by the CCPA to that reasonably necessary and proportionate to achieve the purpose of the Agreement, consistent with the definition of “business purpose” in CCPA Section 1798.140(c).

Conflicts

If the terms of this addendum conflict with terms of the Agreement, the terms of this addendum take precedence.