Hebbia policy evolution

“Additional Provisions for Processor Data that is Subject to the CCPA Scope and Role of Parties. This Clause 6 shall only apply with respect to Processor Data that is subject to the CCPA. When processing Processor Data subject to the CCPA under this DPA, the parties acknowledge and agree that Customer is a Business and Hebbia is a Service Provider for the purposes of the CCPA. For the purpose of this Clause 6, "Business", "Business Purpose", "Commercial Purpose", "Consumer," "Personal Information", "Process," "Sell", "Service Provider", and "Share" have the meanings given to them in the CCPA. Responsibilities . Customer discloses or otherwise makes available Processor Data to Hebbia for the limited and specific purpose of Hebbia carrying out the Permitted Purposes. Hebbia shall: (i) comply with its applicable obligations under the CCPA; (ii) provide the same level of protection as required under the CCPA; (iii) notify Customer if it can no longer meet its obligations under the CCPA; (iv) not “sell” or “share” (as such terms are defined by the CCPA) Processor Data; (v) not retain, use, or disclose Processor Data for any purpose (including any commercial purpose) other than the Permitted Purpose or as otherwise permitted under the CCPA; (vi) not retain, use, or disclose Processor Data outside of the direct business relationship between Customer and Hebbia or as otherwise permitted under the CCPA; and (vii) unless otherwise permitted by the CCPA, not combine Processor Data with Personal Information that Hebbia: (a) receives from, or on behalf of, another person, or (b) collects from its own, independent consumer interaction.”

“Authorized Sub-Processors Customer acknowledges and agrees that Hebbia may (1) engage its Affiliates as well as the Authorized Sub-Processors on the List (defined below) to access and process Personal Data in connection with the Services and (2) from time to time engage additional third parties for the purpose of providing the Services, including without limitation the processing of Personal Data. By way of this DPA, Customer provides general written authorization to Hebbia to engage Sub-Processors as necessary to perform the Services. A list of Hebbia’s current Authorized Sub-Processors (the “List”) is available to Customer at https://trust.hebbia.ai/subprocessors . Such List may be updated by Hebbia from time to time. Hebbia will provide a mechanism to subscribe to notifications (which may include but are not limited to email notifications) of new Authorized Sub-Processors and Customer, if it wishes, will subscribe to such notifications where available. If Customer does not subscribe to such notifications, Customer waives any right it may have to receive prior notice of changes to Authorized Sub-Processors. At least ten (10) days before enabling any third party other than existing Authorized Sub-Processors to access or participate in the processing of Personal Data, Hebbia will add such third party to the List and notify subscribers, including Customer, via the aforementioned notifications. Customer may object to such an engagement by informing Hebbia in writing within ten (10) days of receipt of the aforementioned notice by Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”