DATA PROTECTION AGREEMENT
This Services Agreement is entered between Murf Inc., a Delaware corporation, with its principal place of business at 535 Mission Street, San Francisco, California 94105, United States of America (“Murf”), and a signatory party to duly executed Service Order Form referencing this Agreement. This Agreement contains the terms and conditions under which Customer shall make available to Murf and Customer authorizes Murf to process information including personal data for the provision of Services. The provision of Services is contingent on the Customer's acceptance of the terms and conditions stated in this Agreement.
Any contradicting terms contained in Service Order Form or other separately signed and executed agreements between Customer and Murf shall supersede provisions from this Agreement. No conduct by Murf shall be deemed to constitute an acceptance of any terms put forward by the Customer unless such terms are explicitly accepted by signing the document containing such terms. For the avoidance of doubt, Murf does not accept any terms or provisions included by reference in any of the documents provided by the Customer, even if signed by Murf, unless Murf also signs such referenced documents.
1. DEFINITIONS
Capitalized terms used and not defined in this DPA have the meanings given to such terms in the Agreement.
1.1. “Applicable Laws” means the laws, rules, regulations, court orders, and other binding requirements of a relevant government authority that apply to or govern a party.
1.2. “Applicable Data Protection Laws” means the Applicable Laws that govern how the Services may process or use an individual’s personal information, personal data, personally identifiable information, or other similar term.
1.3. “Controller” will have the meaning(s) given in the Applicable Data Protection Laws for the company that determines the purpose and extent of Processing Personal Data.
1.4. “Customer Personal Data” means Personal Data that Customer uploads or provides to Murf as part of the Services and that is governed by this DPA.
1.5. “DPA” means this data processing agreement and the policies and documents referenced in or attached to it.
1.6. “EEA SCCs” means the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the European Council.
1.7. “European Economic Area” or “EEA” means the member states of the European Union, Norway, Iceland, and Liechtenstein.
1.8. “GDPR” means European Union Regulation 2016/679 as implemented by local law in the relevant EEA member nation.“Service” means the offering described in the Service Order Form.
1.9. “Personal Data” will have the meaning(s) given in the Applicable Data Protection Laws for personal information, personal data, or other similar term.
1.10. “Processing” or “Process” will have the meaning(s) given in the Applicable Data Protection Laws for any use of, or performance of a computer operation on, Personal Data, including by automatic methods.
1.11. “Processor” will have the meaning(s) given in the Applicable Data Protection Laws for the company that Processes Personal Data on behalf of the Controller.
1.12. “Restricted Transfer” means (a) where the GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; and (b) where the UK GDPR applies, a transfer of personal data from the United Kingdom to any other country which is not subject to adequacy regulations adopted pursuant to Section 17A of the United Kingdom Data Protection Act 2018.
1.13. “Security Incident” means a Personal Data Breach as defined in Article 4 of the GDPR.
1.14. “Services” means the services obtained in accordance the Agreement.
1.15. “Special Category Data” will have the meaning given in Article 9 of the GDPR.
1.16. “Sub-processor” will have the meaning(s) given in the Applicable Data Protection Laws for a company that, with the approval and acceptance of Controller, assists the Processor in Processing Personal Data on behalf of the Controller.
1.17. “UK GDPR” means European Union Regulation 2016/679 as implemented by section 3 of the United Kingdom’s European Union (Withdrawal) Act of 2018 in the United Kingdom.
1.18. “UK Addendum” means the international data transfer addendum to the EEA SCCs issued by the Information Commissioner for Parties making Restricted Transfers under S119A(1) Data Protection Act 2018.
2. Processor and Sub-processor Relationships
2.1. Murf as Processor. In situations where Customer is a Controller of the Customer Personal Data, Murf will be deemed a Processor that is Processing Personal Data on behalf of Customer.
2.2. Murf as Sub-processor. In situations where Customer is a Processor of the Customer Personal Data, Murf will be deemed a Sub-processor of the Customer Personal Data.
3. Processing
3.1. Processing Details. Annex I(B) describes the subject matter, nature, purpose, and duration of this Processing, as well as the Categories of Personal Data collected and Categories of Data Subjects.
3.2. Processing Instructions. Customer instructs Murf to Process Customer Personal Data: (a) to provide and maintain the Services; (b) as may be further specified through Customer’s use of the Services; (c) as documented in the Agreement; and (d) as documented in any other written instructions given by Customer and acknowledged by Murf about Processing Customer Personal Data under this DPA. Murf will abide by these instructions unless prohibited from doing so by Applicable Laws. Murf will immediately inform Customer if it is unable to follow the Processing instructions. Customer has given and will only give instructions that comply with Applicable Laws.
3.3. Processing by Murf. Murf will only Process Customer Personal Data in accordance with this DPA. If Murf updates the Services to update existing or include new products, features, or functionality, Murf may change the Categories of Data Subjects, Categories of Personal Data, Special Category Data, Special Category Data Restrictions or Safeguards, Frequency of Transfer, Nature and Purpose of Processing, and Duration of Processing as needed to reflect the updates by notifying Customer of the updates and changes.
3.4. Customer Processing. Where Customer is a Processor and Murf is a Sub-processor, Customer will comply with all Applicable Laws that apply to Customer’s Processing of Customer Personal Data. Customer’s agreement with its Controller will similarly require Customer to comply with all Applicable Laws that apply to Customer as a Processor. In addition, Customer will comply with the Sub-processor requirements in Customer’s agreement with its Controller.
3.5. Consent to Processing. Customer has complied with and will continue to comply with all Applicable Data Protection Laws concerning its provision of Customer Personal Data to Murf and/or the Services, including making all disclosures, obtaining all consents, providing adequate choice, and implementing relevant safeguards required under Applicable Data Protection Laws.
3.6. Sub-processors.
3.6.1. Current List of Sub-processors and Notification of New Sub-processors. The current list of Sub-processors engaged in Processing Personal Data for the performance of Services, including a description of their processing activities and countries of location, can be found on Murf’s list of Sub-processors webpage at https://murf.ai/legal/sub-processors. Customer hereby consents to these Sub-processors, their locations and processing activities as it pertains to their Personal Data. The webpage contains a mechanism to subscribe to notifications of new Sub-processors for the Services, and if Customer subscribes, Murf shall provide notification of a new Sub-processor(s) before authorizing any new Sub-processor(s) to Process Personal Data to provide the Services.
3.6.2. Objection Right for New Sub-processors. Customer may object to Murf’s use of a new Sub-processor by notifying Murf promptly in writing within thirty (30) days of receipt of Murf’s notice in accordance with the mechanism set out in section 3.6.1. If Customer objects to a new Sub-processor as permitted in the preceding sentence, Murf will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening Customer. If Murf is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, Customer may terminate the applicable Services which cannot be provided by Murf without the use of the objected-to new Sub-processor by providing written notice to Murf. Murf will refund Customer any prepaid fees covering the remainder of the term of such terminated Services following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.
3.6.3. Liability. Murf shall be liable for the acts and omissions of its Sub-processors to the same extent Murf would be liable if performing the services of each Sub-processor directly under the terms of this DPA, unless otherwise set forth in the Agreement.
4. Restricted Transfers
4.1. Authorization. Customer agrees that Murf may transfer Customer Personal Data outside the EEA, the United Kingdom, or other relevant geographic territory as necessary to provide the Services. If Murf transfers Customer Personal Data to a territory (i) for which the European Commission or other relevant supervisory authority has not issued an adequacy decision, or (ii) which is not covered by EU-US Data Privacy Framework and its extensions, Murf will implement appropriate safeguards for the transfer of Customer Personal Data to that territory consistent with Applicable Data Protection Laws.
4.2. Ex-EEA Transfers. Customer and Murf agree that if the GDPR protects the transfer of Customer Personal Data, the transfer is from Customer from within the EEA to Murf outside of the EEA, and the transfer is not governed by (i) an adequacy decision made by the European Commission, or (ii) EU-US Data Privacy Framework and its extensions, then by entering into this DPA, Customer and Murf are deemed to have signed the EEA SCCs and their Annexes, which are incorporated by reference. Any such transfer is made pursuant to the EEA SCCs, which are completed as follows:
4.2.1. Module Two (Controller to Processor) of the EEA SCCs apply when Customer is a Controller and Murf is Processing Customer Personal Data for Customer as a Processor.
4.2.2. Module Three (Processor to Sub-Processor) of the EEA SCCs apply when Customer is a Processor and Murf is Processing Customer Personal Data on behalf of Customer as a Sub-processor.
4.2.3. For each module, the following applies (when applicable):
(a) The optional docking clause in Clause 7 does not apply;
(b) In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of Sub-processor changes is 10 business days;
(c) In Clause 11, the optional language does not apply;
(d) All square brackets in Clause 13 are removed;
(e) In Clause 17 (Option 1), the EEA SCCs will be governed by the laws of Governing Member State;
(f) In Clause 18(b), disputes will be resolved in the courts of the Governing Member State; and
(g) The annexes to this DPA contain the information required in Annex I, Annex II, and Annex III of the EEA SCCs.
4.3. Ex-UK Transfers. Customer and Murf agree that if the UK GDPR protects the transfer of Customer Personal Data, the transfer is from Customer from within the United Kingdom to Murf outside of the United Kingdom, and the transfer is not governed by (i) an adequacy decision made by the United Kingdom Secretary of State, or (ii) EU-US Data Privacy Framework and its extensions, then by entering into this DPA, Customer and Murf are deemed to have signed the UK Addendum and their Annexes, which are incorporated by reference. Any such transfer is made pursuant to the UK Addendum, which is completed as follows:
4.3.1. Section 4.2 of this DPA contains the information required in Table 2 of the UK Addendum.
4.3.2. Table 4 of the UK Addendum is modified as follows: Neither party may end the UK Addendum as set out in Section 19 of the UK Addendum; to the extent ICO issues a revised Approved Addendum under Section 18 of the UK Addendum, the parties will work in good faith to revise this DPA accordingly.
4.3.3. The annexes to this DPA contain the information required by Annex 1A, Annex 1B, Annex II, and Annex III of the UK Addendum.
4.4. Other International Transfers. For Personal Data transfers where Swiss law (and not the law in any EEA member state or the United Kingdom) applies to the international nature of the transfer, references to the GDPR in Clause 4 of the EEA SCCs are, to the extent legally required, amended to refer to the Swiss Federal Data Protection Act or its successor instead, and the concept of supervisory authority will include the Swiss Federal Data Protection and Information Commissioner.
5. Security Incident Response
5.1. Upon becoming aware of any Security Incident, Murf will: (a) notify Customer without undue delay when feasible, but no later than 72 hours after becoming aware of the Security Incident; (b) provide timely information about the Security Incident as it becomes known or as is reasonably requested by Customer; and (c) promptly take reasonable steps to contain and investigate the Security Incident. Murf’s notification of or response to a Security Incident as required by this DPA will not be construed as an acknowledgment by Murf of any fault or liability for the Security Incident.
6. Audit
6.1. Audit Rights. Murf will give Customer all information reasonably necessary to demonstrate its compliance with this DPA and Murf will allow for and contribute to audits, including inspections by Customer, to assess Murf’s compliance with this DPA. However, Murf may restrict access to data or information if Customer’s access to the information would negatively impact Murf’s intellectual property rights, confidentiality obligations, or other obligations under Applicable Laws. Customer acknowledges and agrees that it will only exercise its audit rights under this DPA and any audit rights granted by Applicable Data Protection Laws by instructing Murf to comply with the reporting and due diligence requirements below. Murf will maintain records of its compliance with this DPA for 3 years after the DPA ends.
6.2. Security Due Diligence. In addition to the Report, Murf will respond to reasonable requests for information made by Customer to confirm Murf’s compliance with this DPA, including responses to information security, due diligence, and audit questionnaires, or by giving additional information about its information security program. All such requests must be in writing and made to the Murf Security Contact and may only be made once a year.
7. Coordination & Cooperation
7.1. Response to Inquiries. If Murf receives any inquiry or request from anyone else about the Processing of Customer Personal Data, Murf will notify Customer about the request and Murf will not respond to the request without Customer’s prior consent. Examples of these kinds of inquiries and requests include a judicial or administrative or regulatory agency order about Customer Personal Data where notifying Customer is not prohibited by Applicable Law, or a request from a data subject. If allowed by Applicable Law, Murf will follow Customer’s reasonable instructions about these requests, including providing status updates and other information reasonably requested by Customer. If a data subject makes a valid request under Applicable Data Protection Laws to delete or opt out of Customer’s giving of Customer Personal Data to Murf, Murf will assist Customer in fulfilling the request according to the Applicable Data Protection Law. Murf will cooperate with and provide reasonable assistance to Customer, at Customer’s expense, in any legal response or other procedural action taken by Customer in response to a third-party request about Murf’s Processing of Customer Personal Data under this DPA.
7.2. DPIAs and DTIAs. If required by Applicable Data Protection Laws, Murf will reasonably assist Customer in conducting any mandated data protection impact assessments or data transfer impact assessments and consultations with relevant data protection authorities, taking into consideration the nature of the Processing and Customer Personal Data.
8. Deletion of Customer Personal Data
8.1. Deletion by Customer. Murf will enable Customer to delete Customer Personal Data in a manner consistent with the functionality of the Services. Murf will comply with this instruction as soon as reasonably practicable except where further storage of Customer Personal Data is required by Applicable Law.
8.2. Deletion at DPA Expiration.
8.2.1. After the DPA expires, Murf will return or delete Customer Personal Data at Customer’s instruction unless further storage of Customer Personal Data is required or authorized by Applicable Law. If return or destruction is impracticable or prohibited by Applicable Laws, Murf will make reasonable efforts to prevent additional Processing of Customer Personal Data and will continue to protect the Customer Personal Data remaining in its possession, custody, or control. For example, Applicable Laws may require Murf to continue hosting or Processing Customer Personal Data.
8.2.2. If Customer and Murf have entered the EEA SCCs or the UK Addendum as part of this DPA, Murf will only give Customer the certification of deletion of Personal Data described in Clause 8.1(d) and Clause 8.5 of the EEA SCCs if Customer asks for one.
9. Limitation of Liability
9.1. Liability Caps and Damages Waiver. To the maximum extent permitted under Applicable Data Protection Laws, each party’s total cumulative liability to the other party arising out of or related to this DPA will be subject to the waivers, exclusions, and limitations of liability stated in the Agreement. However, Murf’s total cumulative liability arising out of or related to DPA Covered Claims will not be more than the fees actually paid by Customer to Murf in the 12 month period immediately before the claim.
9.2. Related-Party Claims. Any claims made against Murf or its Affiliates arising out of or related to this DPA may only be brought by the Customer entity that is a party to the Agreement.
9.3. Exceptions. This DPA does not limit any liability to an individual about the individual’s data protection rights under Applicable Data Protection Laws. In addition, this DPA does not limit any liability between the parties for violations of the EEA SCCs or UK Addendum.
10. Conflicts Between Documents
This DPA forms part of and supplements the Agreement. If there is any inconsistency between this DPA, the Agreement, or any of their parts, the part listed earlier will control over the part listed later for that inconsistency: (1) the EEA SCCs or the UK Addendum, (2) this DPA, and then (3) the Agreement.
11. Term of the DPA
This DPA will start on the Effective Date and will continue until the Agreement expires or is terminated. However, Murf and Customer will each remain subject to the obligations in this DPA and Applicable Data Protection Laws until Customer stops transferring Customer Personal Data to Murf and Murf stops Processing Customer Personal Data.
12. Governing law, dispute resolution and jurisdiction
12.1. Governing Law. Except to the extent they are pre-empted by United States federal law, the laws of the state of Delaware, other than its conflict-of-laws principles, govern the DPA and any claims and disputes (whether contract, tort, or otherwise) arising out of or relating to this DPA or their subject matter. The United Nations Convention on Contracts for the International Sale of Goods shall not apply.
12.2. Dispute Resolution. Customer’s satisfaction is an important objective to Murf in performing its obligations under the DPA. Except with respect to Intellectual Property Rights, if a dispute arises between the parties relating to the interpretation or performance of the DPA or the grounds for the termination hereof, the parties agree to hold a meeting within 15 days of written request by either party, attended by individuals with decision-making authority, regarding the dispute, to attempt in good faith to negotiate a resolution of the dispute prior to pursuing other available remedies. If, within 15 days after such meeting, the parties have not succeeded in resolving the dispute, either party may protect its interests by lawful means available to it.
12.3. Jurisdiction. Customer and Murf agree that all claims and disputes (whether contract, tort, or otherwise), including statutory claims and disputes, arising out of or relating to the DPA or the use of the Services will be litigated exclusively in federal and state courts in the state of Delaware, United States of America. Customer and Murf consent to the personal jurisdiction of courts in the state of Delaware, United States of America.
13. General provisions
13.1. Assignment. Neither party may assign the DPA or any right under the DPA, without the consent of the other party, which consent shall not be unreasonably withheld or delayed; provided however, that either party may assign the DPA to an acquirer of all or substantially all of the business of such party to which the DPA relates, whether by merger, asset sale or otherwise. The DPA shall be binding upon and inure to the benefit of the parties’ successors and permitted assigns. Either party may employ subcontractors in performing its duties under the DPA, provided, however, that such party shall not be relieved of any obligation under the DPA.
13.2. Notices. Notices under the DPA shall be in writing in English and shall be deemed to have been given when transmitted. Notices to Murf must be sent to legal@murf.ai and notices to Customer must be sent to [∙].
13.3. Waiver. No waiver shall be effective unless it is in writing and signed by the waiving party. The waiver by either party of any breach of the DPA shall not constitute a waiver of any other or subsequent breach.
13.4. Severability. If any term of the DPA is held to be invalid or unenforceable, that term shall be reformed to achieve as nearly as possible the same effect as the original term, and the remainder of the DPA shall remain in full force.
13.5. Entire Agreement. This DPA (including all annexes) along with the Agreement contains the entire agreement of the parties and supersedes all previous oral and written communications by the parties, concerning the subject matter of the DPA. The DPA may be amended solely in a writing signed by both parties. Standard or printed terms contained in any purchase order or sales confirmation are deemed rejected and shall be void unless specifically accepted in writing by the party against whom their enforcement is sought.
13.6. Survival. Sections 8 through 13 of the DPA shall survive the expiration or termination of the DPA for any reason.
13.7. No Third Party Beneficiaries. The DPA is an agreement between the parties, and confers no rights upon either party’s employees, agents, contractors, partners of customers or upon any other person or entity.
13.8. Signatures. The DPA may be executed in multiple counterparts, each of which when executed will be an original, and all of which, when taken together, will constitute one agreement. Delivery of an executed counterpart of a signature page of the DPA by electronic transmission (including via pdf) will be effective as delivery of a manually executed counterpart.
Annex I(A) List of Parties
Data Exporter
Name: As per the Service Order Form
Address: As per the Service Order Form
Contact Person:
Name: As per the Service Order Form
Activities relevant to transfer: See Annex 1(B)
Role: Controller
Data Importer
Name: Murf Inc.
Address: 535 Mission Street, San Francisco, California 94105, USA
Contact Person:
Name: Divyanshu Pandey
Position: Director
Address: 535 Mission Street, San Francisco, California 94105, USA
Activities relevant to transfer: See Annex 1(B)
Role: Processor
Annex I(B) Description of Transfer and Processing Activities
Service
To provide Services in accordance with the Agreement.
Categories of Data Subjects
[Drafting note: check all that apply, customize as needed, and delete the rest.]
[ ] Customer’s end users or customers
[ x ] Customer’s employees
[ ] [ custom option ]
Categories of Personal Data
[Drafting note: check all that apply, customize as needed, and delete the rest.]
[ x ] Name
[ x ] Contact information such as email, phone number, or address
[ ] Employment information such as employee ID or compensation
[ ] Financial information such as bank account numbers
[ ] Professional or biographic information such as resume or CV
[ ] Transactional information such as account information or purchases
[ x ] User activity and analysis such as device information or IP address
[ x ] Location information
[ x ] Any photos, videos, audio or text content provided by the data exporter when creating Voiceovers
Special Category Data
Is special category data Processed?
[Drafting note: select one or the other.]
( ) Yes ( x ) No
Special Category Data
Restrictions or Safeguards
[Drafting note: If “Yes” is selected above, identify the safeguards in place to protect special category data by checking the applicable box, customizing as needed, and deleting the rest. If “No” is selected above, delete this entire row. ]
[ ] See security measure listed in Annex 2 of this DPA[ ] [ custom option ]
Frequency of Transfer
[Drafting note: check all that apply, customize as needed, and delete the rest. ][ x ] Continuous
[ ] [ custom options ]
Nature and Purpose of Processing
Murf will Process Customer Personal Data as instructed in Section 4.2 of the DPA Standard Terms. The nature of processing includes:[Drafting note: check all that are applicable, customize as needed, and delete the rest. ][ x ] Receiving data, including collection, accessing, retrieval, recording, and data entry
[ x ] Holding data, including storage, organization, and structuring
[ x ] Using data, including analysis, consultation, testing, automated decision making, and profiling
[ x ] Updating data, including correcting, adaptation, alteration, alignment, and combination
[ x ] Protecting data, including restricting, encrypting, and security testing
[ x ] Sharing data, including disclosure, dissemination, allowing access, or otherwise making available
[ x ] Returning data to the data exporter or data subject
[ x ] Erasing data, including destruction and deletion
[ ] [ custom options ]
Duration of Processing
Murf will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 3.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.
Annex I(C )
Competent Supervisory Authority
The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Annex II - Murf Security Measures
- Implementation of and compliance with a written information security program consistent with established industry standards and including administrative, technical, and physical safeguards appropriate to the nature of the Customer Personal Data and designed to protect such information from: unauthorized access, destruction, use, modification, or disclosure; unauthorized access to or use that could result in substantial harm or inconvenience to the Customer, the Customer’s customers, or the Customer’s employees; and any anticipated threats or hazards to the security or integrity of such information.
- Adopting and implementing reasonable policies and standards related to security.
- Assigning responsibility for information security management.
- Devoting adequate personnel resources to information security.
- Carrying out verification checks on permanent staff who will have access to the Customer Personal Data.
- Conducting appropriate background checks and requiring employees, vendors, and others with access to the Customer Personal Data to enter into written confidentiality agreements.
- Conducting training to make employees and others with access to the Customer Personal Data aware of information security risks and to enhance compliance with Murf’s policies and standards related to data protection.
- Preventing unauthorized access to the Customer Personal Data through the use, as appropriate, of physical and logical (passwords) entry controls, secure areas for data processing, procedures for monitoring the use of data processing facilities, built-in system audit trails, use of secure passwords, network intrusion detection technology, encryption and authentication technology, secure log-on procedures, and virus protection, monitoring compliance with Murf’s policies and standards related to data protection on an ongoing basis. In particular, Murf has implemented and complies with, as appropriate and without limitation:
- Physical access control measures to prevent unauthorized access to data processing systems (e.g., access ID cards, video surveillance, and exterior security);
- Denial-of-use control measures to prevent unauthorized use of data protection systems (e.g., automatically enforced password complexity and change requirements and firewalls.);
- Requirements-driven authorization scheme and access rights, and monitoring and logging of system access to ensure that persons entitled to use a data processing system have access only to the data to which they have a right of access, and that the Customer Personal Data cannot be read, copied, modified, or removed without authorization;
- Data transmission control measures to ensure that the Customer Personal Data cannot be read, copied, modified, or removed without authorization during electronic transmission, transport, or storage on data media, and transfer and receipt of records. In particular, Murf’s information security program will be designed:
- To encrypt in storage any data sets in Murf’s possession, including sensitive personal data, using appropriate encryption levels based on industry-leading encryption standards, including AES -256, and storing user identities on the system using key value pair such as ghost_id to prevent storage of actual user ID; and
- To ensure that any sensitive personal data transmitted electronically (other than by facsimile) to a person outside Murf’s IT system or transmitted over a public network is encrypted using the newest supported versions of TLS 1.2 protocol to protect the security of the transmission;
- Data entry control measures to ensure Murf can check and establish whether and by whom the Customer Personal Data has been input into data processing systems, modified, or removed;
- Continuous security testing measures to ensure information security practices remain relevant, effective, and up to date, including use of system scanning tools, tabletop exercises, backup restoration tests, pre-production failovers, and conducting post-mortems on any actual incidents in order to update the relevant disaster recovery plans;
- Sub-processor supervision measures to ensure that, if Murf is permitted to use sub-processors, the Customer Personal Data is processed strictly in accordance with the Customer’s instructions including, as appropriate:
- Measures to ensure that the Customer Personal Data is protected from accidental destruction or loss including, as appropriate and without limitation, data backup, retention and secure destruction policies; secure offsite storage of data sufficient for disaster recovery; uninterrupted power supply, and disaster recovery programs; and
- Measures to ensure that data collected for different purposes can be processed separately including, as appropriate, physical or adequate logical separation of Customer Personal Data.
9. Taking such other steps as may be appropriate under the circumstances.
