1. Introduction

This document contains the ACD Direct information processing and security terms for Partners. The Partner agreeing to these terms (“PARTNER”), and ACD Direct, or any other entity that directly or indirectly controls, is controlled by, or is under common control with ACD Direct, have entered into an agreement under which ACD Direct is providing services.

These Data Processing and Security Terms (the “Terms”) will be effective and replace any previously applicable data processing and security terms as from the Terms Effective Date (as defined below).

These Terms supplement the Agreement. Where the Agreement was entered into offline with ACD Direct, these Terms supersede the “Privacy” Clause in that agreement (if applicable).

These Terms reflect the parties’ agreement with respect to the terms governing the processing and security of Partner Data under the Agreement.

2. Definitions

Confidential information: All information and data supplied by Partner or captured on the behalf of the Partner is confidential and proprietary, including, without limitation, the terms of this Agreement, Reports, caller/donor personally identifiable information and data, including without limitation caller/donor names, addresses, telephone number, email address, and credit card information, Partner’s financial information, including without limitation its campaigns, projects, scripts and Partner’s business. “Donor Information”, as defined below, is also considered confidential information.

Data Incident means a breach of ACD Direct’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Confidential Information on systems managed by or otherwise controlled by ACD Direct. “Data Incidents” will not include unsuccessful attempts or activities that do not compromise the security of confidential information, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

Donor Information specifically includes, but is not limited to, (a) the names of the Donor and Partner, (b) the address of the Donor, (c) the telephone number of the Donor, (d) the social security number or federal identification number of the Donor, (e) the amount pledged by the Donor, (f) the city or state of the Donor, and (g) the terms of the Donor's pledge. "Donor Information" constitutes any information which, if disclosed, could enable a person or entity to identify the identity of the Donor or any entity controlled by or under common control with the Donor.

Authorized User means Partner-provided names and emails that will access ACD Direct’s Systems, generally employees, contractors, third party processors, database vendors, or volunteers.

Third Party Auditor means an ACD Direct-appointed, qualified and independent thirdparty auditor, whose then-current identity ACD Direct will disclose to Partner.

ACD Direct’s Systems means all ACD’s Partner-accessed web and mobile applications including but not limited to: SimpleScript, PledgeCart, SimplePledge, Mobile Canvasser, and CallsWithoutWalls.

SOC 2 means a confidential Service Organization Control (SOC) 2 report (or a comparable report) on ACD Direct’s systems examining logical security controls, physical security controls, and system availability, as produced by ACD Direct’s Third Party Auditor in relation to the Audited Services.

PCI means a confidential Payment card industry (PCI) compliance report that refers to the technical and operational standards that businesses must follow to ensure that credit card data provided by cardholders is protected, as produced by ACD Direct’s Third Party Auditor in relation to the Audited Services.

Third Party Processors means third parties authorized, by PARTNERS, under these Terms to have logical access to and process Confidential Information in order to provide parts of the Services.

3. Security Statements & Responsibilities of Partner:

1. PARTNER agrees that all Confidential Information and Donor Information data supplied by PARTNER is supplied within PARTNER’s sole discretion and that Donor Information is highly confidential.
2. PARTNERS’ employees, third party processors, data vendors, contractors, and volunteers accessing ACD Direct’s systems will have full access to any of the Confidential Information and Donor Information and take full responsibility for the security and quality of data entered by their own employees, third party processors, data vendors, or volunteers.
3. PARTNERS’ will provide employees, contractors, and volunteers information for access to ACD’s systems. These Authorized Users that will have passwordprotected access to ACD Direct’s systems will not share, misuse, or otherwise make public specific usernames or passwords. PARTNER will notify ACD Direct when Authorized Users must have access removed.
4. PARTNER will ensure that all Authorized Users comply with the terms and conditions of these Terms with respect to the Services. PARTNER will promptly notify ACD Direct of any suspected or alleged violation of authorized access.
5. PARTNER acknowledges that ACD Direct will collect and process the personal data of consumers or donors, which is controlled and processed by PARTNER or PARTNER’s authorized third-party processor.
6. PARTNER is solely responsible for responding to Consumers’ and Donors’ requests for access to their Confidential Information and donor information.
7. PARTNER is in compliance and will comply with all applicable laws, regulations, ordinances and other requirements relating to the operation of its business and the provision of the services provided, especially as it relates to PCI Compliance and the PCI Compliance of the PARTNER’s third party processors and data vendors.

4. Security Compliance:

ACD Direct shall comply with applicable local, state and federal rules and regulation to maintain the confidentiality and safeguard Materials and Confidential Information. ACD Direct maintains Level 1 PCI Service Provider and SOC 2 Type 2 certification, audited yearly by a third-party auditor. Attestations of Compliance (AOC) available upon request.

5. Security Statements & Responsibilities of ACD:

1. ACD Direct agrees that all information and data supplied by PARTNER or captured on the behalf of PARTNER is confidential and proprietary.
2. ACD Direct agrees to keep, and to take reasonable steps to attempt to have each of its Vendors (collectively, "Acquiring Party") keep, secret all such Confidential Information of PARTNER and not to disclose or otherwise use such Confidential Information, except with PARTNER’s prior written consent, to anyone outside of Acquiring Party and only to those employees who have a need-to-know, either during or after the Term.
3. ACD Direct further agrees to deliver to PARTNER, at any time PARTNER may so request, all memoranda, notes, records, databases, computer files, reports and other documents (and all copies thereof) relating to PARTNER’s business which ACD Direct may then possess or have under its control.
4. Under no circumstances may Donor Information be used or disclosed by ACD Direct, any agent or employee of ACD Direct, or any independent contractor or vendor of ACD Direct without taking reasonable steps to obtain written authorization from PARTNER.
5. ACD Direct shall, at all times, keep the Donor Information and Confidential Information secure by encrypting it and/or by limiting access to Authorized Users with frequently updated password-protected access, and with passwords set through two-factor authentication (or better).
6. ACD Direct may suspend or terminate any Authorized User’s access for any reason at any time.
7. ACD Direct acknowledges and agrees that under no circumstances will ACD Direct ever disclose any of the Confidential Information and Donor Information. If any demand for any Confidential Information is made by any person other than PARTNER, ACD Direct shall immediately notify the appropriate and designated person(s) of the PARTNER of the request. In the event that ACD Direct is requested or required to disclose such Confidential Information (for example, but not by limitation, through the issuance of a subpoena, a subpoena duces tecum or verbal testimony), ACD Direct shall also immediately notify PARTNER so as to give PARTNER an opportunity to file or make appropriate objections.
8. As a condition to any employee, agent, independent contractor or vendor of ACD Direct having any access to the Confidential Information, it shall first agree to be bound by these terms. ACD Direct nor any of its employees, contractors, agents, or vendors will use, misuse or misappropriate any Confidential Information and will only use such Confidential Information in the manner set forth herein in connection with rendering the services provided.
9. In the event of a Data Incident, ACD Direct will employ its Incident Response Plan. The policy is available by request at any time.
10. ACD Direct is in compliance and will comply with all applicable laws, regulations, ordinances and other requirements relating to the operation of its business and the provision of the services provided.
11. ACD Direct will not materially harm, misuse or bring into disrepute the Partner name.
12. ACD Direct nor any of its employees and/or Vendors will use, misuse or misappropriate any Confidential Information and will only use such Confidential Information in the manner set forth herein in connection with rendering the Services hereunder.
13. ACD Direct may use any non-confidential materials, i.e, scripting and reporting templates, program synopses and gift premium descriptions for use with other public broadcast stations and other ACD Direct clients. This use shall be without compensation to Partner.