Copyright © 2021-2025 Scholars, Inc.
SCHOLARS INC DBA ABODE
SAAS TERMS AND CONDITIONS
Last revised on: July 7, 2025
These Scholars Inc dba Abode SaaS Terms and Conditions (“Terms and Conditions”) include and incorporate the SaaS Services Order Form (“Order Form”), (collectively, the “Agreement”). These Terms and Conditions set forth terms additional to, and not in lieu of the Order Form or Services Agreement. Capitalized terms used but not defined herein shall have the same meanings as set forth in the Order Form or Services Agreement.
Abode shall use best efforts consistent with prevailing industry standards to maintain the Services in a manner which minimizes errors and interruptions in the Services. Services may be temporarily unavailable for scheduled maintenance or for unscheduled emergency maintenance, either by Abode or by third-party providers, or because of other causes beyond Abode’s reasonable control, but Abode shall use best efforts to provide advance notice in writing or by e-mail of any scheduled service disruption. Abode further represents and warrants that the Services do not contain any virus or other malicious code. ABODE DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR FREE; NOR DOES IT MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF THE SERVICES. EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, THE SERVICES AND IMPLEMENTATION SERVICES ARE PROVIDED “AS IS” AND ABODE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED FROM ABODE OR ELSEWHERE SHALL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THIS AGREEMENT.
NOTWITHSTANDING ANYTHING TO THE CONTRARY, EXCEPT FOR BODILY INJURY OF A PERSON OR LIABILITY DUE TO ABODE’S WILFULL MISCONDUCT OR FRAUD, ABODE AND ITS OFFICERS, AFFILIATES, REPRESENTATIVES, AND EMPLOYEES SHALL NOT BE RESPONSIBLE OR LIABLE WITH RESPECT TO ANY SUBJECT MATTER OF THIS AGREEMENT OR TERMS AND CONDITIONS RELATED THERETO UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHER THEORY: (A) FOR ERROR OR INTERRUPTION OF USE OR FOR LOSS OR INACCURACY OR CORRUPTION OF DATA OR COST OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES OR TECHNOLOGY OR LOSS OF BUSINESS; (B) FOR ANY INDIRECT, EXEMPLARY, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES; (C) FOR ANY MATTER BEYOND ABODE’S REASONABLE CONTROL; OR (D) FOR ANY AMOUNTS THAT, TOGETHER WITH AMOUNTS ASSOCIATED WITH ALL OTHER CLAIMS, EXCEED THE FEES PAID BY CUSTOMER TO ABODE FOR THE SERVICES UNDER THIS AGREEMENT IN THE 12 MONTHS PRIOR TO THE ACT THAT GAVE RISE TO THE LIABILITY(OR IF THE AGREEMENT HAS BEEN ACTIVE FOR LESS THAN 12 MONTHS, THE AVERAGE MONTHLY FEES EXTRAPOLATED OVER A 12 MONTH PERIOD) (“LIABILITY CAP”), IN EACH CASE, WHETHER OR NOT ABODE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. HOWEVER, WITH RESPECT TO CLAIMS ARISING FROM ABODE’S BREACH OF CONFIDENTIALITY OR INDEMNITY CLAIMS, ABODE’S LIABILITY SHALL NOT EXCEED THREE TIMES THE LIABILITY CAP.
If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable. This Agreement is not assignable, transferable or sublicensable by either party without the other party’s prior written consent, except in connection with a corporate reorganization or merger, acquisition, or sale of all or substantially all of its business and/or assets. This Agreement is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement, and that all waivers and modifications must be in a writing signed by both parties, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement and Customer does not have any authority of any kind to bind Abode in any respect whatsoever. In any action or proceeding to enforce rights under this Agreement, the prevailing party will be entitled to recover costs and attorneys’ fees. All notices under this Agreement will be in writing and will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or e-mail; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested. This Agreement shall be governed by the laws of the State of Delaware without regard to its conflict of laws provisions. Customer hereby expressly consents to the exclusive personal jurisdiction and venue in the state and federal courts for the county in Delaware for any action arising from or related to this Agreement. The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement. Customer shall always comply with all international and domestic laws, ordinances, regulations, and statutes that are applicable to its purchase and use of the Services and Software.
1. Introduction
This Data Protection Addendum (“Addendum”) is entered into and is supplemental to, and made pursuant to, the Abode Terms of Service or other agreement executed between Abode and Customer for Abode’s provision of the Service (the “Agreement”) as of the effective date of such Agreement (“Effective Date”) and is by and between Scholars, Inc. DBA Abode, a Delaware corporation (“Abode”), and the Customer (i.e., “You”) that executed the Agreement. This Addendum applies to Abode’s Processing of Personal Data under the Agreement. Any terms used in this Addendum and not defined will have the meanings given to them in the applicable Agreement.
Customer enters into this Addendum on behalf of itself and, to the extent required under applicable Data Protection Laws and Regulations, in the name and on behalf of its Affiliates to the extent such Affiliates are included and covered under the Agreement with Abode. For the purposes of this Addendum only, and except where indicated otherwise, the term “Customer” shall include Customer and its Affiliates.
This Addendum has been pre-signed on behalf of Abode. This Addendum shall become legally binding upon Customer entering into the Agreement.
2. Definitions
Capitalized terms that are used but not defined in this Addendum have the meanings given in the Agreement.
a. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interest of the subject entity.
b. “Applicable Data Protection Laws” means all applicable privacy and data protection laws and regulations and in each case, as amended, superseded, or replaced from time to time, including, without limitation, the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"); the United Kingdom Data Protection Act 2018; the California Consumer Privacy Act of 2018 and the California Privacy Rights Act ("CCPA"); the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”); and the Australian Privacy Principles and the Australian Privacy Act (1988).
c. “Contact Data” means the Personal Data that Abode Processes as a controller, such as account information and payment information.
d. “Customer Data” means the Personal Data that Abode Processes on behalf of Customer.
e. “Data Subject” means the identified or identifiable natural person who is the subject of Personal Data or the meaning as set forth in Applicable Data Protection Laws, including similar terms, such as “Consumer” as used in the CCPA.
f. “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction and including all "processing" as defined in any Applicable Data Protection Laws.
g. “Personal Data” means “personal data”, “personal information”, “personally identifiable information” or similar information defined in and governed by Applicable Data Protection Laws.
h. “Security Incident” means any confirmed unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Data Processed by Abode and/or its Subprocessors in connection with the provision of the Service. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems.
i. “Service-Generated Data” means usage data and metadata that is generated through the use of the Service, including data generated through the use of support. This Addendum applies to Service-Generated Data solely to the extent Service-Generated Data constitutes Personal Data.
j. “Service” means collectively the Website and Mobile Application (each as defined in the Agreement), including all associated content, functionality and services.
k. “Subprocessor” means any third-party authorized by Abode to Process Customer Data in assistance with fulfilling its obligations with respect to providing the Service under the Agreement or this Addendum.
3. General; Termination
a. This Addendum forms part of the Agreement and except as expressly set forth in this Addendum, the Agreement remains unchanged and in full force and effect. If there is any conflict between this Addendum and the Agreement, this Addendum will govern.
b. Any liabilities arising under this Addendum are subject to the limitations of liability in the Agreement.
c. This Addendum will be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Data Protection Laws.
d. This Addendum will remain in effect until, and automatically terminate upon, deletion of Customer Data as described in this Addendum.
4. Relationship of the Parties
a. Abode as Processor. The parties acknowledge and agree that with regard to the Processing of Customer Data, Customer acts as a controller and Abode is a processor. Abode will process Customer Data under and in accordance with Customer’s instructions as outlined in Section 6 (Role and Scope of Processing).
b. Abode as Controller. To the extent that any Service-Generated Data is considered Personal Data and as to any Contact Data, Abode is the controller with respect to such data and will Process such data in accordance with its Privacy Policy.
5. Compliance with Law. Each party will comply with its obligations under Applicable Data Protection Laws with respect to its Processing of Customer Data.
6. Role and Scope of the Processing
a. Customer Responsibilities. Customer is solely responsible for obtaining and maintaining all the necessary consents prior to accessing, storing, uploading, processing, or storing Customer Data in the Service. Customer has provided, and will continue to provide, all notices and has obtained, and will continue to obtain, all consents, permissions, and rights necessary under applicable laws, including Applicable Privacy Law, for Abode to lawfully process Customer Data for the purposes contemplated by the Agreement. Customer has complied with all applicable laws, rules, and regulations, including Applicable Privacy Laws, in the collection and provision to Abode and its Subprocessors of such Customer Data.
b. Customer Instructions. Abode will Process Customer Data only in accordance with Customer’s documented, lawful instructions except to the extent required by Applicable Data Protection Laws to which Abode is subject or where Abode becomes aware or believes that Customer’s instructions violate Applicable Data Protection Laws, in which case Abode will notify Customer. By entering into the Agreement, Customer instructs Abode to Process Customer Data to provide the Service and pursuant to any other written instructions given by Customer and acknowledged in writing by Abode as constituting instructions for purposes of this Addendum. Customer acknowledges and agrees that such instruction authorizes Abode to Process Customer Data (a) to perform its obligations and exercise its rights under the Agreement; and (b) to perform its legal obligations and to establish, exercise or defend legal claims in respect of the Agreement.
7. Subprocessing
a. Customer specifically authorizes Abode to use its Affiliates as Subprocessors, and generally authorizes Abode to engage Subprocessors to Process Customer Data. In such instances, Abode:
(i) will enter into a written agreement with each Subprocessor, imposing data protection obligations substantially similar to those set out in this Addendum to the extent applicable to the nature of the services provided by such Sub-processor; and
(ii) remains liable for compliance with the obligations of this Addendum and for any acts or omissions of the Subprocessor that cause Abode to breach any of its obligations under this Addendum.
b. A list of Abode’s Subprocessors, including their functions and locations, is available at https://www.abodehr.com/subprocessors, and may be updated by Abode from time to time in accordance with this Addendum.
c. Customer must email info@abodehr.com to subscribe to notice of new Subprocessors that will be engaged. Abode will notify Customer by updating the list of Subprocessors and, if Customer has subscribed to notices as set forth in the preceding sentence, via email. If, within five (5) calendar days after such notice, Customer notifies Abode in writing that Customer objects to Abode’s appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved. If the parties are not able to mutually agree to a resolution of such concerns, Customer, as its sole and exclusive remedy, may terminate the Agreement for convenience with no refunds and Customer will remain liable to pay any committed fees in an order form, order, statement of work or other similar ordering document.
8. Security
a. Security Measures. Abode will implement and maintain technical and organizational security measures designed to protect Customer Data from Security Incidents and to preserve the security and confidentiality of the Customer Data, in accordance with Abode’s security standards referenced in the Agreement (“Security Measures”).
b. Customer Responsibility.
(i) Customer is responsible for reviewing the information made available by Abode relating to data security and making an independent determination as to whether the Service meet Customer’s requirements and legal obligations under Applicable Data Protection Laws. Customer acknowledges that the Security Measures provide a level of security appropriate to the risk in respect of the Customer Data and that they may be updated from time to time upon reasonable notice to Customer to reflect process improvements or changing practices (but the modifications will not materially decrease Abode’s obligations as compared to those reflected in such terms as of the Effective Date).
(ii) Customer agrees that, without limitation of Abode’s obligations under this Section 8, Customer is solely responsible for its use of the Service, including (a) making appropriate use of the Service to ensure a level of security appropriate to the risk in respect of the Customer Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Service; (c) securing Customer’s systems and devices that it uses with the Service; and (d) maintaining its own backups of Customer Data.
c. Security Incident. Upon becoming aware of a confirmed Security Incident, Abode will notify Customer without undue delay unless prohibited by applicable law. A delay in giving such notice requested by law enforcement and/or in light of Abode’s legitimate needs to investigate or remediate the matter before providing notice will not constitute an undue delay. Such notice to Customer will describe, to the extent possible, (a) the details of the Security Incident as known or as reasonable requested by Customer, and (b) the steps taken, deemed necessary and reasonable by Abode, to mitigate the potential risks, to the extent that the remediation is within Abode’s reasonable control. Without prejudice to Abode’s obligations under this Section 8.c., Customer is solely responsible for complying with Security Incident notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Security Incidents. Abode’s notification of or response to a Security Incident under this Section 8.c. will not be construed as an acknowledgement by Abode of any fault or liability with respect to the Security Incident. These obligations will not apply to Security Incidents to the extent they are caused by Customer.
9. Audits and Reviews of Compliance. The parties acknowledge that Customer must be able to assess Abode’s compliance with its obligations under Applicable Data Protection Laws and this Addendum, insofar as Abode is acting as a processor on behalf of Customer.
a. Abode’s Audit Program. Abode uses external auditors to verify the adequacy of its security measures with respect to its processing of Customer Data. Such audits (e.g., SOC 2 Type 2) are performed at least once annually at Abode’s expense by independent, third-party security professionals at Abode’s selection and result in the generation of a confidential audit report (“Audit Report”).
b. Customer Audit. Upon Customer’s written request at reasonable intervals, and subject to reasonable confidentiality controls, Abode will make available to Customer a copy of Abode’s most recent Audit Report. Customer agrees that any audit rights granted by Applicable Data Protection Laws will be satisfied by these Audit Reports.
10. Impact Assessments and Consultations. Abode will provide reasonable cooperation to Customer, to the extent Customer does not otherwise have access to the relevant information and such information is available to Abode, in connection with any data protection impact assessment (at Customer’s expense only if such reasonable cooperation will require Abode to assign significant resources to that effort) or consultations with regulatory authorities as required by Applicable Data Protection Laws.
11. Data Subject Requests. Abode will upon Customer’s request (and at Customer’s expense) provide Customer with such assistance as it may reasonably require to comply with its obligations under Applicable Data Protection Laws to respond to requests from individuals to exercise their rights under Applicable Data Protection Laws (e.g., rights of data access, rectification, erasure, restriction, portability and objection) in cases where Customer cannot reasonably fulfill such requests independently by using the self-service functionality of the Service. If Abode receives a request from a Data Subject in relation to the Processing of their Customer Data, Abode will advise the Data Subject to submit their request to Customer, and Customer will be responsible for responding to any such request.
12. Return or Deletion of Customer Data
a. Customers may delete or export Customer Data at any time while using the Service in a manner consistent with the functionality of the Service. Termination or expiration of the Agreement serves as instruction for Abode to delete all Customer Data within a commercially reasonable timeframe as determined by Abode.
b. Notwithstanding the foregoing, Customer understands that Abode may retain Customer Data if required by law, and such data will remain subject to the requirements of this Addendum.
13. International Provisions
a. Processing in the United States. Customer acknowledges that, as of the Effective Date, Abode’s primary processing facilities are in the United States. Notwithstanding the foregoing, Customer acknowledges that Abode may in connection with the provision of the Service, need to transfer and process Customer Data to and in the United States and anywhere else in the world where Abode or its Subprocessors maintain data processing operations. Abode will ensure such transfers are made in compliance with the requirements of Applicable Privacy Laws and this Addendum.
b. Jurisdiction Specific Terms. To the extent that Abode Processes Customer Data originating from and protected by Applicable Data Protection Laws in one of the Jurisdictions listed in Schedule 4 (Jurisdiction Specific Terms), then the terms specified therein with respect to the applicable jurisdiction(s) will apply in addition to the terms of this Addendum.
c. Cross Border Data Transfer Mechanism. To the extent that Customer’s use of the Services requires an onward transfer mechanism to lawfully transfer personal data from a jurisdiction (i.e., the European Economic Area (“EEA”), the United Kingdom (“UK”), Switzerland or any other jurisdiction listed in Schedule 3) to Abode located outside of that jurisdiction (a “Transfer Mechanism”), the terms and conditions of Schedule 3 (Cross Border Transfer Mechanisms) will apply.
SUBJECT MATTER & DETAILS OF PROCESSING
1. Nature and Purpose of the Processing. Abode will process Personal Data as necessary to provide the Service under the Agreement. Abode does not sell Customer Data (or end user information within such Customer Data) and does not share such end users’ information with third parties for compensation or for those third parties’ own business interests.
a. Customer Data. Abode will process Customer Data as a processor in accordance with Customer’s instructions as outlined in Section 6.a (Customer Instructions) of this Addendum.
b. Service-Generated Data and Contact Data. Abode will process Service-Generated Data and Contact Data as a controller for the purposes outlined in Section 4.b (Abode as Controller) of this Addendum.
2. Processing Activities.
a. Customer Data. Customer Data will be subject to the following basic processing activities: the provision of the Service and disclosures in accordance with the Agreement and/or as compelled by applicable laws.
b. Service-Generated Data and Contact Data. Personal Data contained in Service-Generated Data and/or Contact Data will be subject to the following processing activities by Abode: Abode may use Service-Generated Data and/or Contact Data to operate, improve and support the Service, to provide marketing and service-related messages and for other lawful business practices, such as analytics, benchmarking and reporting.
3. Duration of the Processing. The period for which Personal Data will be retained and the criteria used to determine that period is as follows:
a. Customer Data. Prior to the termination of the Agreement, Abode will Process Customer Data in accordance with sections 3 and 12 of this Addendum.
b. Service-Generated Data and Contact Data. Upon termination of the Agreement, Abode may retain, use, and disclose Service-Generated Data and/or Contact Data for the purposes set forth above in Section 2.b (Service-Generated Data and Contact Data) of this Schedule 1, subject to the confidentiality obligations set forth in the Agreement. Abode will anonymize or delete Personal Data contained within Service-Generated Data and/or Contact Data when Abode no longer requires it for the purpose set forth in Section 2.b (Service-Generated Data and/or Contact Data) of this Schedule 1.
4. Categories of Data Subjects.
a. Customer Data. Individuals whose Personal Data is included in Customer Data.
b. Service-Generated Data and Contact Data. Customer’s authorized users with access to an Abode account, customers, suppliers, and end users.
5. Categories of Personal Data.
a. Customer Data. The categories of Customer Data are: any Customer Data that Customer, or third parties acting on their behalf, may submit to Abode in connection with the performance of the Service, to the extent of which is exclusively determined and controlled by the Customer, such as first and last name, email address, phone number, gender, education, current location, links to third party social media platforms, mailing address, clothing size, IP address and system configuration information.
b. Service-Generated Data and Contact Data. Abode processes Personal Data within Service-Generated Data and/or Contact Data, such as name, email address, phone number, account preferences, and content of communications with support.
6. Sensitive Data or Special Categories of Data.
a. Customer Data. Customers are prohibited from including sensitive data or special categories of data in Customer Data.
b. Service-Generated Data and Contact Data. Sensitive data is not contained in Service-Generated Data and/or Contact Data.
TECHNICAL & ORGANIZATIONAL SECURITY MEASURES
Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The following provides more information regarding Abode’s technical and organizational security measures set forth below.
Technical and Organizational Security Measures:
1. Measures of pseudonymization and encryption of personal data.
2. Measures for ensuring ongoing confidentiality, integrity, and availability and resilience of processing systems and services.
3. Measures for ensuring the ability to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident.
4. Processes for regular testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of processing.
5. Measures for user identification and authorization.
6. Measures for the protection of data during transmission.
7. Measures for the protection of data during storage.
8. Measures for ensuring physical security of locations at which personal data are processed.
9. Measures for ensuring events logging.
10. Measures for ensuring systems configuration, including default configuration.
11. Measures for internal IT and IT security governance and management.
12. Measures for certifications/assurance of processes and products.
13. Measures for ensuring data minimization.
14. Measures for ensuring data quality.
15. Measures for ensuring limited data retention.
16. Measures for ensuring accountability.
17. Measures for allowing data portability and ensuring erasure.
18. For transfers to [sub]-processors, also describe the specific technical and organisational measures to be taken by the [sub]-processor to be able to provide assistance to the controller and, for transfers from a processor to a [sub]-processor, to the data exporter.
When Abode engages a Subprocessor under this Addendum, Abode and the Subprocessor enter into an agreement with data protection terms substantially similar to those contained herein. Each Subprocessor agreement must ensure that Abode is able to meet its obligations to Customer. In addition to implementing technical and organisational measures to protect personal data, Subprocessors must a) notify Abode in the event of a Security Incident so Abode may notify Customer; b) delete data when instructed by Abode in accordance with Customer’s instructions to Abode; c) not engage additional Subprocessors without authorization; d) not change the location where data is processed; or e) not process data in a manner which conflicts with Customer’s instructions to Abode.
CROSS BORDER DATA TRANSFER MECHANISM
1. Definitions
a. “Standard Contractual Clauses” means the 2021 Standard Contractual Clauses approved by the European Commission in decision 2021/914.
b. “UK IDTA” means the UK international data transfer addendum (Schedule 5).
2. UK IDTA. For data transfers from the United Kingdom, the UK IDTA will be deemed entered into (and incorporated into this Addendum by reference) together with the Standard Contractual Clauses as set forth in Section 3 of this Schedule below.
3. The 2021 Standard Contractual Clauses. For data transfers from the EEA, the UK, and Switzerland that are subject to the Standard Contractual Clauses, the Standard Contractual Clauses will apply in the following manner:
a. Module One (Controller to Controller) will apply where Customer is a controller of Service-Generated Data and/or Contact Data and Abode is a controller of Service-Generated Data and/or Contact Data.
b. Module Two (Controller to Processor) will apply where Customer is a controller of Customer Data and Abode is a processor of Customer Data;
c. For each Module, where applicable:
(i) in Clause 7, the option docking clause will not apply;
(ii) in Clause 9, Option 2 will apply, and the time period for prior notice of Subprocessor changes will be as set forth in Section 7 (Subprocessing) of this Addendum;
(iii) in Clause 11, the optional language will not apply;
(iv) in Clause 17 (Option 1), the 2021 Standard Contractual Clauses will be governed by Irish law.
(v) in Clause 18(b), disputes will be resolved before the courts of Ireland;
(vi) In Annex I, Part A:
Data Exporter: Customer and authorized Affiliates of Customer.
Contact Details: Customer’s account owner email address, or to the email address(es) for which Customer elects to receive privacy communications.
Data Exporter Role: The Data Exporter’s role is outlined in Section 4 of this Addendum.
Signature & Date: By entering into the Agreement, Data Exporter is deemed to have signed these Standard Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the Agreement.
Data Importer: Scholars, Inc.
Contact Details: Abode Privacy – info@abodehr.com
Data Importer Role: The Data Importer’s role is outlined in Section 4 of this Addendum.
Signature & Date: By entering into the Agreement, Data Importer is deemed to have signed these Standard Contractual Clauses, incorporated herein, including their Annexes, as of the Effective Date of the Agreement.
(vii) In Annex I, Part B:
The categories of data subjects are described in Schedule 1, Section 4.
The sensitive data transferred is described in Schedule 1, Section 6.
The frequency of the transfer is a continuous basis for the duration of the Agreement.
The nature of the processing is described in Schedule 1, Section 1.
The purpose of the processing is described in Schedule 1, Section 1.
The period of the processing is described in Schedule 1, Section 3.
For transfers to Subprocessors, the subject matter, nature, and duration of the processing is outlined at https://www.abodehr.com/subprocessors.
(viii) In Annex I, Part C: The Irish Data Protection Commission will be the competent supervisory authority.
(ix) Schedule 2 serves as Annex II of the Standard Contractual Clauses.
4. As to the specific modules, the parties agree that the following modules apply, as the circumstances of the transfer may apply:
Controller-Controller - Module One
Controller-Processor - Module Two
5. To the extent there is any conflict between the Standard Contractual Clauses or the UK IDTA and any other terms in this Addendum, including Schedule 4 (Jurisdiction Specific Terms), the provisions of the Standard Contractual Clauses or the UK IDTA, as applicable, will prevail.
JURISDICTION SPECIFIC TERMS
1. California
a. The definition of “Applicable Data Protection Law” includes the California Consumer Privacy Act and the California Privacy Rights Act (collectively, the “CCPA”).
b. The terms “business”, “commercial purpose”, “service provider”, “sell.””share” and “personal information” have the meanings given in the CCPA.
c. With respect to Customer Data, Abode is a service provider under the CCPA with the Customer as the business.
d. Abode will not (a) sell or share Customer Data; (b) retain, use or disclose any Customer Data for any purpose other than for the specific purpose of providing the Service, including retaining, using or disclosing the Customer Data for a commercial purpose other than providing the Service; or (c) retain, use or disclose the Customer Data outside of the direct business relationship between Abode and Customer.
e. The parties acknowledge and agree that the Processing of Customer Data authorized by Customer’s instructions described in Section 6 of this Addendum is integral to and encompassed by Abode’s provision of the Service and the direct business relationship between the parties.
f. Notwithstanding anything in the Agreement or any Order Form entered in connection therewith, the parties acknowledge and agree that Abode’s access to Customer Data does not constitute part of the consideration exchanged by the parties in respect of the Agreement.
g. To the extent that any Service-Generated Data is considered Personal Data and/or as to Contact Data, pursuant to the CCPA, Abode is the business under the CCPA with respect to such data and will Process such data in accordance with its Privacy Policy.
h. Abode implements and maintains reasonable security and privacy practices appropriate to the nature of the personal information that it processes as set forth in section 8 of this Addendum.
2. EEA
a. The definition of “Applicable Data Protection Laws” includes the General Data Protection Regulation (EU 2016/679) (“GDPR”).
b. When Abode engages a Subprocessor under Section 7 (Subprocessing), it will:
(i) require any appointed Subprocessor to protect Customer Data to the standard required by Applicable Data Protection Laws, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR; and
(ii) require any appointed Subprocessor to agree in writing to only process data in a country that the European Union has declared to have an “adequate” level of protection; or to only process data on terms equivalent to the Standard Contractual Clauses.
c. GDPR Penalties. Notwithstanding anything to the contrary in this Addendum or in the Agreement (including, without limitation, either party’s indemnification obligations), neither party will be responsible for any GDPR fines issued or levied under Article 83 of the GDPR against the other party by a regulatory authority or governmental body in connection with such other party’s violation of the GDPR.
3. Switzerland
a. The definition of “Applicable Data Protection Laws” includes the Swiss Federal Act on Data Protection.
b. When Abode engages a Subprocessor under Section 7 (Subprocessing), it will
(i) require any appointed Subprocessor to protect Customer Data to the standard required by Applicable Data Protection Laws, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR; and
(ii) require any appointed Subprocessor to agree in writing to only process data in a country that the European Union has declared to have an “adequate” level of protection; or to only process data on terms equivalent to the Standard Contractual Clauses.
4. United Kingdom
a. References in this Addendum to GDPR will to that extent be deemed to be references to the corresponding laws of the United Kingdom (including the UK GDPR and Data Protection Act 2018).
b. When Abode engages a Subprocessor under Section 7 (Subprocessing), it will:
(i) require any appointed Subprocessor to protect Customer Data to the standard required by Applicable Data Protection Laws, such as including the same data protection obligations referred to in Article 28(3) of the GDPR, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR; and
(ii) require any appointed Subprocessor to agree in writing to only process data in a country that the European Union has declared to have an “adequate” level of protection; or to only process data on terms equivalent to the Standard Contractual Clauses and the UK IDTA.
5. Australia
a. As the definition of “Applicable Data Protection Laws” includes the Australian Privacy Principles and the Australian Privacy Act (1988), the following applies:
(i) The definition of “Personal Data” includes “Personal Information” as defined under the Australian Privacy Principles and the Australian Privacy Act (1988).
(ii) The definition of “sensitive data” includes “Sensitive Information” as defined under the Australian Privacy Principles and the Australian Privacy Act (1988).
6. Canada
a. As the definition of “Applicable Data Protection Laws” includes the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”), the following applies:
(i) Abode’s Subprocessors, as described in this Addendum, are third parties under the PIPEDA, with whom Abode has entered into a written contract that includes terms substantially similar to this Addendum. Abode has conducted appropriate due diligence on its Subprocessors.
(ii) Abode will implement technical and organizational measures as set forth in Schedule 2.
SCHEDULE 5
UK IDTA
This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.
Start date
the Effective Date of the Agreement
The Parties
Exporter (who sends the Restricted Transfer)
Importer (who receives the Restricted Transfer)
Parties’ details
See the Agreement
Full legal name: Scholars, Inc.
Trading name (if different): Abode
Main address (if a company registered address): 1644 Platte St Suite 303, Denver, CO 80202
Official registration number (if any) (company number or similar identifier): Delaware, 6720504
Key Contact
See the Agreement
Contact details including email: info@abodehr.com
Signature (if required for the purposes of Section 2)
By entering into the Agreement, Exporter is deemed to have signed this Addendum.
By entering into the Agreement, Importer is deemed to have signed this Addendum.
Addendum EU SCCs
The Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum:
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
Annex 1A: List of Parties: See Table 1
Annex 1B: Description of Transfer: See Schedule 1
Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: See Schedule 2
Annex III: List of Sub processors (Modules 2 and 3 only): See https://www.abodehr.com/subprocessors
Ending this Addendum when the Approved Addendum changes
Which Parties may end this Addendum as set out in Section 19: Importer
Addendum
This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs.
Addendum EU SCCs
The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information.
Appendix Information
As set out in Table 3.
Appropriate Safeguards
The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR.
Approved Addendum
The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18.
Approved EU SCCs
The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
ICO
The Information Commissioner.
Restricted Transfer
A transfer which is covered by Chapter V of the UK GDPR.
UK
The United Kingdom of Great Britain and Northern Ireland.
UK Data Protection Laws
All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
UK GDPR
As defined in section 3 of the Data Protection Act 2018.
“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;
“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;
“it is to a country benefiting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;
“the onward transfer is to a country benefiting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”
“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;
“These Clauses are governed by the laws of England and Wales.”;
“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and
The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.
and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.
Mandatory Clauses
Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.
