table of contents
Text Link
Get started

Learn how Rokt can help make the most of the Transaction Moment™

Talk to an expert

Special Programs

Effective as of February 2nd, 2022

Archived as of May 19, 2022, click here for current mParticle Platform Terms of Service.

mParticle offers Customers the following four types of programs in addition to its full paid product:

a) Trial Program. mParticle offers a Trial Program (“Trial Program”), subject to the eligibility requirements and parameters communicated through email, document or a website when the Customer signed up (“Trial Terms”). As long as Customer is eligible for and fits within the parameters of the Trial Program, there shall be no fees hereunder for the services described in the Trial Terms.

b) Accelerator Program. mParticle offers an accelerator program (“Accelerator Program”), subject to the eligibility requirements and parameters set forth at https://www.mparticle.com/lpg/accelerator ( “Accelerator Terms”). As long as Customer is eligible for and fits within the parameters of the Accelerator Program, there shall be no fees hereunder for the services described in the Accelerator Terms.

c) Growth Program. In the event Customer no longer qualifies for the Accelerator Program, mParticle may contact Customer to see if Customer wishes to engage in mParticle’s growth program (“Growth Program”). If Customer wishes to participate in the Growth Program, the parties will enter into an Order for fixed fees payable by credit card as set forth and subject to the terms in Section 3.1(c) below.

d) Tech For Black Founders Program.mParticle offers a Tech For Black Founders program (“TBF Program”), subject to the eligibility requirements and parameters set forth at https://www.mparticle.com/resources/tech-for-black-founders ( “TBF Terms”). As long as Customer is eligible for and fits within the parameters of the TBF Program, there shall be no fees hereunder for the services described in the TBF Program.

Terms & Conditions

1. License Grant

1.1 mParticle Platform

mParticle will make its software platform available to Customer via the Internet (the “mParticle Platform”) pursuant to this Agreement and the applicable Order during the Term (as defined below). Once Customer identifies an administrative user name and password and such administrative account is provisioned, Customer shall have access to and can utilize the mParticle Platform. Subject to the terms and conditions of this Agreement, mParticle hereby grants Customer a limited, nonexclusive, nontransferable, non-sublicensable right and license to access and use the mParticle Platform during the Term solely for Customer’s use. mParticle will provide the mParticle Platform in accordance with Applicable Laws (as defined below) related to the provision of the mParticle Platform to mParticle’s customers generally (i.e. without regard for Customer’s particular use of the mParticle Platform), subject to Customer’s use in accordance with this Agreement. For purposes of this Agreement, “Applicable Laws” means all applicable, laws, rules, regulations related to Customer’s use and mParticle’s provision of the mParticle Platform.

1.2 mParticle SDK

mParticle will make its software development kit (in object code format only) available to Customer via the mParticle Platform (the “mParticle SDK”). Subject to the terms and conditions of this Agreement, mParticle hereby grants Customer a limited, nonexclusive, nontransferable, non-sublicensable right and license to (a) download and internally use the mParticle SDK; (b) incorporate the mParticle SDK into Customer’s web and/or mobile applications and connected devices set forth in the Order (collectively, the “Supported Customer Properties”); (c) distribute and otherwise make available the mParticle SDK as incorporated in the Supported Customer Properties; and (d) send data server-to-server via mParticle’s Application Programming Interfaces (“mParticle APIs”).

1.3 License Grant Restrictions and Requirements

The following restrictions and requirements shall apply to Customer’s use of the mParticle Platform:

(a) Restricted Access. The Customer will not provide access to the mParticle Platform to any person who is not an employee or contractor of Customer.

(b) Restrictions. Except as expressly permitted hereunder, Customer will not, and will not permit or authorize any third party to: (i) reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas or algorithms of any of the mParticle Platform or mParticle SDK; (ii) modify, translate or create derivative works based on any of the mParticle Platform or mParticle SDK; (iii) copy (except for archival purposes), rent, lease, distribute, pledge, assign or otherwise transfer or allow any lien, security interest or other encumbrance on any of the mParticle Platform or mParticle SDK; (iv) use any of the mParticle Platform or mParticle SDK for timesharing or service bureau purposes or (except as expressly permitted by the mParticle Platform) otherwise for the benefit of a third party; (v) hack, manipulate, interfere with or disrupt the integrity or performance of or otherwise attempt to gain unauthorized access to any of the mParticle Platform or mParticle SDK or their related systems, hardware or networks or any content or technology incorporated in any of the foregoing; or (vi) remove or obscure any proprietary notices or labels of mParticle or its suppliers on any of the mParticle Platform or mParticle SDK.

(c) Requirements. Customer shall use the mParticle Platform and mParticle SDK in accordance with (i) the documentation made available by mParticle to Customer available at https://docs.mparticle.com/; and (ii) all Applicable Laws.

1.4 Access Credentials and mParticle API Keys

Customer and Customer’s authorized users are solely responsible for the confidentiality and use of their username and password (“Access Credentials”) and mParticle API keys (“mParticle API Keys”) that Customer and Customer’s authorized users use to access and use the mParticle Platform and mParticle SDK. Customer shall immediately notify mParticle if any Access Credentials and/or mParticle API Keys have been stolen or compromised. Customer acknowledges and agrees that Customer shall be responsible for all activities and all loss, damage and expense incurred by mParticle that occur under Customer’s and Customer’s authorized users’ Access Credentials and mParticle API Keys, including but not limited to, any misuse, communications, or any data (including Customer Data) entered through such Access Credentials and mParticle API Keys by Customer or permitted by Customer’s failure to keep its Access Credential and mParticle API Keys confidential, unless such loss, damage or expense arising out of the unauthorized use of Access Credentials and/or mParticle API Keys is caused by mParticle’s breach of this Agreement, gross negligence or intentional misconduct.

1.5 Service Limitations

Customer’s use of the mParticle Platform is subject to the service level limitations located at http://docs.mparticle.com/guides/default-service-limits/ (the “Service Level Limitations”); provided, however, event batch long-term archival storage set forth in the Service Limitations shall be 12 months for purposes of this Agreement. The Service Level Limitations are provided as an upper bound designed to detect possible errors in data ingestion and damage to the mParticle Platform and is in no way intended to decrease the number of MTUs (as defined below) for which Customer has contracted. If the Service Level Limitations are exceeded, mParticle reserves the right, in its sole discretion, to throttle and/or cap Customer’s use of the mParticle Platform, mParticle SDK and/or mParticle APIs.

1.6 Privacy; Data Security

Each of the Parties shall comply with the privacy and security obligations set forth in the Privacy and Security Rider attached hereto as Exhibit A (the “Privacy Rider”).

2. Ownership; Reservation of Rights

2.1 Customer Data

Customer owns the data derived or collected by the mParticle SDK incorporated into the Supported Customer Properties and data input by Customer into the mParticle Platform (“Customer Data”). Customer hereby grants to mParticle a non-exclusive, worldwide, royalty-free, fully paid up, sublicensable, right and license to copy, distribute, display and create derivative works of and use the Customer Data to perform mParticle’s obligations under this Agreement. Customer reserves any and all right, title and interest in and to the Customer Data, other than the licenses therein expressly granted to mParticle under this Agreement. Except as expressly permitted hereunder or as authorized by Customer in connection with its use of the mParticle Platform, mParticle will not, and will not authorize any third party to:

  • (a) rent, sublicense, transfer, disclose, use, or grant any rights in, or share or provide access to any Customer Data, in any form, collected and created under this Agreement;
  • (b) collect, use, combine, aggregate, or commingle the Customer Data for the benefit of any third party where such collection, use, combination, aggregation or commingling of such Customer Data is for the purpose of or results in the segmenting, building or supplementing profiles of users, or is for use in online preference marketing to users, or to perform tracking, targeting, or re-targeting of users, in each case for the benefit of any third party;
  • (c) disclose the Customer Data to third party advertisers or publishers in any manner that would readily identify Customer’s methods, techniques, scope or scale of Customer Data collection, products or services; or
  • (d) combine the Customer Data with any third party data.

2.2 mParticle Platform and mParticle SDK Ownership; Reservation Of Rights

Customer acknowledges and agrees that, as between the Parties, mParticle retains all rights title, and interest in and to the mParticle Platform and mParticle SDK, all copies or parts thereof (by whomever produced) and all intellectual property rights therein. Customer shall acquire no, rights, title, or interest in and to the mParticle Platform or mParticle SDK or any copies thereof (by whoever produced), other than the limited licensed rights expressly granted by mParticle under this Agreement. Customer will not remove, obscure, or alter any intellectual property rights notices relating to the mParticle Platform or mParticle SDK.

2.3 mParticle Usage Data

Customer acknowledges that mParticle collects data about its customers’ usage of the mParticle products (“mParticle Usage Data”) and uses it for the sole purpose of generating insights about the use of mParticle’s products to support and improve mParticle’s products generally and to enable customers to better use mParticle’s products. For avoidance of doubt, mParticle Usage Data will not contain any Customer Data collected by Customer and ingested by the mParticle Platform. mParticle may use aggregated mParticle Usage Data that does not identify Customer or any of its users for the purpose of describing its products in marketing materials (e.g., total volume of data processed by the mParticle Platform).

2.4 Feedback

Customer may from time to time provide suggestions, comments for enhancements or functionality or other feedback (“Feedback”) to mParticle with respect to the mParticle Platform and/or mParticle SDK. mParticle may determine whether or not to proceed with the development of the requested enhancements, new features or functionality. Customer hereby grants mParticle a royalty-free, fully paid up, worldwide, transferable, sublicenseable, irrevocable, perpetual license to (a) copy, distribute, transmit, display, perform, and create derivative works of the Feedback; and (b) use the Feedback and/or any subject matter thereof, including without limitation, the right to develop, manufacture, have manufactured, market, promote, sell, have sold, offer for sale, have offered for sale, import, have imported, rent, provide and/or lease products or services which practice or embody, or are configured for use in practicing, the Feedback and/or any subject matter of the Feedback.

3 Fees, Payment Terms

3.1 Trial/Accelerator/Growth/TBF Programs.

  • (a) Trial Program. mParticle offers a trial program (“Trial Program”), subject to the eligibility requirements and parameters communicated by mParticle through email, document or a website when the Customer signed up (“Trial Terms”). As long as Customer is participating in the Trial Program and abides by the Trial Terms: (i) there shall be no fees hereunder for the services described in the Trial Terms, (ii) the general cap on liability in Section 7.2 shall be US$1,000.00, (iii) and the remainder of this Section 3 will not apply. In the event of a conflict between the terms set forth in this Section 3.1(a) and the Trial Terms, on the one hand, and the other terms of this Agreement, on the other hand, this Section 3.1(a) and the Trial Terms will control.
  • (b) Accelerator Program. mParticle offers an accelerator program (“Accelerator Program”), subject to the eligibility requirements and parameters set forth at https://www.mparticle.com/lpg/accelerator (“Accelerator Terms”). As long as Customer is eligible for and fits within the parameters of the Accelerator Program and abides by the Accelerator Terms: (i) there shall be no fees hereunder for the services described in the Accelerator Terms, (ii) the general cap on liability in Section 7.2 shall be US$1,000.00, (iii) and the remainder of this Section 3 will not apply. In the event of a conflict between the terms set forth in this Section 3.1(b) and the Accelerator Terms, on the one hand, and the other terms of this Agreement, on the other hand, Section 3.1(b) and the Accelerator Terms will control.
  • (c) Growth Program. In the event Customer no longer qualifies for the Accelerator Program, mParticle may contact Customer to see if Customer wishes to engage in mParticle’s growth program (“Growth Program”). If Customer wishes to participate in the Growth Program, the Parties will enter into an Order. At its discretion, mParticle may increase the pricing on the Order at any time by giving Customer at least thirty (30) days prior written notice (which may be sent by email or through the mParticle Platform user interface). To participate in the Growth Program, Customer shall supply mParticle with a credit card or another form of payment to pay the fees due hereunder. Customer hereby authorizes mParticle to keep such credit card or other form of payment on file and charge it for fees due from Customer hereunder as and when due. Customer represents and warrants that Customer has the right to allow mParticle to do all of the foregoing. In the event that mParticle is not able to process the fees owned hereunder when due by charging such credit card or form of payment, mParticle may suspend Customer’s access to the mParticle Platform until such payment is made by another method and a new credit card on file is provided. mParticle may terminate this Agreement upon thirty (30) days prior written notice if there has been more than one instance of late payment. For the avoidance of doubt, the remainder of this Section 3 shall apply. In the event of a conflict between the terms set forth in this Section 3.1(c) (“Growth Terms”) and the other terms of this Agreement, the Growth Terms will control.
  • (d) Tech For Black Founders Program. mParticle offers a Tech For Black Founders program (“TBF Program”), subject to the eligibility requirements and parameters set forth at https://www.mparticle.com/resources/tech-for-black-founders (“TBF Terms”). As long as Customer is eligible for and fits within the parameters of the TBF Program: (i) there shall be no fees hereunder for the services described in the TBF Terms, (ii) the general cap on liability in Section 7.2 shall be US$1,000.00, (iii) and the remainder of this Section 3 will not apply. In the event of a conflict between the terms set forth in this Section 3.1(d) and the TBF Terms, on the one hand, and the other terms of this Agreement, on the other hand, Section 3.1(d) and the TBF Terms will control. In the event Customer no longer qualifies for the TBF Program, mParticle may contact Customer to see if Customer wishes to engage in mParticle’s Growth Program, governed by the Growth Terms in Section 3.1(c) or purchase a mParticle full paid product.

3.2 Fees

Customer will pay mParticle all fees (“Fees”) at such times as indicated on the Order. The Fees for access and use of the mParticle Platform are based on a base number of MTUs and Events. mParticle calculates and bills overage fees (“Overage Fees”) monthly in arrears for MTU and Events usage in excess of this base number of MTUs and Events (“Monthly Overage”). The Order may specify a single rate for Overage Fees in which case all Monthly Overages will be charged at that rate. Alternatively, the Order may specify tiered pricing. In such event, if Customer’s usage increases and elevates Customer from a lower tier to a higher tier, the pricing for the higher tier shall become the pricing for the remainder of the Term (unless usage increases afterward to an even higher tier). There will be no reversion to lower tiers. For each month in which Customer moves from a lower tier to a higher tier, mParticle shall invoice the Customer for the difference between the platform service Fees for the new tier and the amount already paid for lower tiers, prorated for the remainder of the Term. As used herein, (a) “MTU” means an mParticle ID that has any activity in a calendar month, and (b) “mParticle ID” means a single user-profile record created for a specified workspace as governed by Customer’s desired identity strategy. Unless stated otherwise in the Order, payment for all Fees (including Overage Fees) is due within thirty (30) days after Customer’s receipt of invoice. Unless otherwise agreed to by the Parties in writing, all Fees shall automatically increase by five percent (5%) for each successive Renewal Term (as defined below). In connection with any Fee increase pursuant to the foregoing provision, at least 10 days prior to the end of the then-current Term, mParticle shall provide a confirmatory Order to Customer showing the Fees for the upcoming Renewal Term.

3.3 Late Payment

If payment of any Fees (including any reimbursement of expenses) is not made when due and payable, a late fee shall accrue at the rate of the lesser of one and one-half percent (1.5%) per month or the highest legal rate permitted by Applicable Law and Customer will pay all reasonable expenses of collection. In addition, if any past due payment of Fees has not been received by mParticle within thirty (30) days from the time such payment is due, mParticle may suspend access to the mParticle Platform until such payment is made.

3.4 Net of Taxes

All amounts payable by Customer to mParticle hereunder are exclusive of any sales, use and other taxes or duties, however designated, including without limitation, withholding taxes, royalties, know-how payments, customs, privilege, excise, sales, use, value-added and property taxes (collectively "Taxes"). Customer shall be solely responsible for payment of any Taxes, except for those taxes based on the income of mParticle. Customer will not withhold any Taxes from any amounts due mParticle.

3.5 Reimbursable Expenses

Customer will reimburse mParticle for travel expenses associated with ongoing support, such as Quarterly Business Reviews (QBRs) and on-site visits, provided that Customer approves such activities via email in advance and mParticle complies with any applicable Customer travel and expense policy provided to mParticle from time to time.

4. Term, Termination

4.1 Term

The Initial Term of this Agreement shall be as set forth on the Order. Thereafter, unless the Agreement terminates earlier in accordance with the terms of this Agreement, this Agreement shall automatically renew for additional, successive one year terms (each, a “Renewal Term” and, together with the Initial Term, the “Term”) unless either Party delivers to the other Party written notice at least sixty (60) days prior to the end of the then-current Term of the Party’s intent not to renew the Term.

4.2 Termination; Effect of Termination

In addition to any other remedies it may have, either Party may terminate this Agreement (a) by written notice to the other Party if there are no Orders in effect; (b) if the other Party breaches any of the terms or conditions of this Agreement and fails to cure such breach within thirty (30) days’ notice (or ten (10) days in the case of nonpayment by Customer of Fees) after receiving notice thereof; and (c) unless otherwise prohibited by Applicable Law, by written notice to the other Party in the event of the other Party’s liquidation, commencement of dissolution proceedings, or any other proceeding relating to a receivership, failure to continue business, assignment for the benefit of creditors, or becoming the subject of bankruptcy. Upon any termination or expiration of this Agreement for any reason: (i) mParticle shall promptly delete or erase the Customer Data or the encryption key to the Customer Data; (ii) all rights granted hereunder and all obligations of mParticle to provide the mParticle Platform and mParticle SDK shall immediately terminate and Customer shall cease use of the mParticle Platform and mParticle SDK; and (iii) unless otherwise set forth in this Agreement, Customer will pay all Fees due and owing up to the date of such termination or expiration.

4.3 Survival

Upon expiration or termination of this Agreement, all obligations in this Agreement shall terminate, provided that Sections 2.2 (mParticle Platform and mParticle SDK Ownership), 2.3 (mParticle Usage Data), 2.4 (Feedback), 3 (Fees; Payment Terms), 4.2 (Termination; Effect of Termination), 5 (Confidentiality), 6.3 (Disclaimer), 7 (Limitations of Liability; Indemnification), 10 (General), and this 4.3 (Survival) shall survive.

5. Confidentiality

5.1 Definition of Confidential Information

As used herein, “Confidential Information” means any non-public information or data, regardless of whether it is in tangible form, disclosed by either Party (the “Disclosing Party”) that the Disclosing Party has either marked as confidential or proprietary, or has identified in writing as confidential or proprietary within thirty (30) days of disclosure to the other Party (the “Receiving Party”); provided, however, that a Disclosing Party’s business plans, strategies, technology, research and development, current and prospective customers, billing records, and products or services shall be deemed Confidential Information of the Disclosing Party even if not so marked or identified. For the avoidance of doubt, mParticle’s Confidential Information includes, without limitation, the mParticle Platform, mParticle SDK and the terms of this Agreement. Notwithstanding the foregoing, “Confidential Information” does not include information that: (a) is known to the Receiving Party prior to receipt from the Disclosing Party directly or indirectly from a source other than one having an obligation of confidentiality to the Disclosing Party; (b) becomes known (independently of disclosure by the Disclosing Party) to the Receiving Party directly or indirectly from a source other than one having an obligation of confidentiality to the Disclosing Party; (c) becomes publicly known or otherwise ceases to be secret or confidential, except through a breach of this Agreement by the Receiving Party; or (d) is independently developed by Receiving Party without use of the Confidential Information of the Disclosing Party.

5.2 Use and Non-disclosure of Confidential Information

Each Party acknowledges that the Confidential Information constitutes valuable trade secrets and proprietary information of a Party, and each Party agrees that it shall use the Confidential Information of the other Party solely in accordance with the provisions of this Agreement and it will not disclose, or permit to be disclosed, the same directly or indirectly, to any third party without the other Party’s prior written consent, except as otherwise permitted hereunder. The Receiving Party will protect the confidentiality the Disclosing Party’s Confidential Information using the same degree of care that it uses to protect the confidentiality of its own confidential information, but in no event less than reasonable care. Notwithstanding any provision of this Agreement, either Party may disclose the terms of this Agreement, in whole or in part (i) to its employees, officers, directors, professional advisers (e.g., attorneys, auditors, financial advisors, accountants and other professional representatives), existing and prospective investors or acquirers contemplating a potential investment in or acquisition of a Party, sources of debt financing, acquirers and/or subcontractors who have a need to know and are legally bound to keep such Confidential Information confidential by confidentiality obligations or, in the case of professional advisors, are bound by ethical duties to keep such Confidential Information confidential consistent with the terms of this Agreement; and (ii) as reasonably deemed by a Party to be required by Applicable Law (in which case each Party shall provide the other with prior written notification thereof, shall provide such Party with the opportunity to contest such disclosure, and shall use its reasonable efforts to minimize such disclosure to the extent permitted by Applicable Laws.). Each Party shall promptly notify the other in writing if it becomes aware of any violations of the confidentiality obligations set forth in this Agreement.

5.3 Equitable Relief; Return and Destruction of Confidential Information

In the event of actual or threatened breach of the provisions of this Section, the non-breaching Party will be entitled to seek immediate injunctive and other equitable relief, without waiving any other rights or remedies available to it. Upon the termination of this Agreement, the Receiving Party agrees to promptly return to the Disclosing Party or destroy all Confidential Information of the Disclosing Party that is in the possession of the Receiving Party and, if requested by the Disclosing Party, certify the return or destruction of all such Confidential Information and embodiments thereof.

6. Representations, Warranties, and Disclaimer

6.1 Mutual Representations and Warranties

Each Party represents and warrants to the other Party that (a) such Party has the required power and authority to enter into this Agreement and to perform its obligations hereunder; (b) the execution of this Agreement and performance of its obligations thereunder do not and will not violate any other agreement to which it is a party; and (c) this Agreement constitutes a legal, valid and binding obligation of such Party when signed by the other Party.

6.2 Uptime

mParticle shall use reasonable efforts consistent with prevailing industry standards to provide the mParticle Platform in a manner that minimizes errors and interruptions in accessing the mParticle Platform. mParticle Platform may be temporarily unavailable for scheduled maintenance or for unscheduled emergency maintenance, either by mParticle or by third-party providers, or because of other causes beyond mParticle’s reasonable control, but mParticle shall use reasonable efforts to provide advance notice in writing or by email of any scheduled service disruption within mParticle’s control.

6.3 Disclaimer

WITHOUT LIMITING MARTICLE’S EXPRESS WARRANTIES AND OBLIGATIONS HEREUNDER, EACH OF THE MPARTICLE PLATFORM, MPARTICLE APIs AND MPARTICLE SDKs ARE PROVIDED ON AN “AS-IS” BASIS, AND MPARTICLE HEREBY DISCLAIMS ANY AND ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED (EITHER IN FACT OR BY OPERATION OF LAW), OR STATUTORY, AS TO ANY MATTER WHATSOEVER, INCLUDING, BUT NOT LIMITED TO, ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUALITY, ACCURACY, TITLE, AND NON-INFRINGEMENT. FOR PURPOSE OF CLARITY, MPARTICLE WILL HAVE NO LIABILITY WHATSOEVER IN CONNECTION WITH ANY SENSITIVE INFORMATION (AS DEFINED IN THE PRIVACY RIDER) INGESTED INTO THE MPARTICLE PLATFORM OR ANY OTHER TYPE OF SECURITY INCIDENT RELATED THERETO. MPARTICLE DOES NOT WARRANT THAT THE MPARTICLE PLATFORM, MPARTICLE SDKs OR MPARTICLE APIs ARE ERROR-FREE OR THAT OPERATION THEREOF WILL BE SECURE OR UNINTERRUPTED. NEITHER PARTY WILL HAVE THE RIGHT TO MAKE OR PASS ON ANY REPRESENTATION OR WARRANTY ON BEHALF OF THE OTHER PARTY TO ANY THIRD PARTY.

7. Limitations of Liability; Indemnification

7.1 Disclaimer of Consequential Damages

THE PARTIES HERETO AGREE THAT, NOTWITHSTANDING ANY OTHER PROVISION IN THIS AGREEMENT, EXCEPT FOR CUSTOMER’S BREACH OF SECTION 1 (LICENSE GRANT) ABOVE, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER FOR ANY SPECIAL, INDIRECT, RELIANCE, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND, LOST OR DAMAGED DATA, LOST PROFITS OR LOST REVENUE, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EVEN IF A PARTY HAS BEEN NOTIFIED OF THE POSSIBILITY THEREOF. THE FOREGOING DISCLAIMER WILL NOT APPLY TO THE EXTENT PROHIBITED BY APPLICABLE LAW. NOTWITHSTANDING THE FOREGOING, THE FOLLOWING WILL BE DEEMED DIRECT DAMAGES FOR PURPOSES OF THIS AGREEMENT: (I) ANY AMOUNTS PAYABLE BY AN INDEMNIFIED PARTY TO A THIRD PARTY PURSUANT TO A JUDGMENT OR TO A SETTLEMENT AGREEMENT APPROVED IN ACCORDANCE WITH SECTION 7.6 (INDEMNIFICATION PROCEDURE) BELOW, LIABILITY FOR WHICH FALLS WITHIN THE INDEMNIFYING PARTY’S INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT, AND (II) ALL FEES PAYABLE BY CUSTOMER UNDER THIS AGREEMENT.

7.2 General Cap on Liability

NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, EXCEPT FOR (A) CUSTOMER’S BREACH OF SECTION 1 (LICENSE GRANT) ABOVE, AND (B) LIABILITY ARISING FROM A PARTY’S INDEMNIFICATION OBLIGATIONS SET FORTH IN SECTION 7.4 AND SECTION 7.5 BELOW, AS APPLICABLE, UNDER NO CIRCUMSTANCES WILL EITHER PARTY’S AGGREGATE LIABILITY FOR DIRECT DAMAGES ARISING UNDER OR RELATING TO THIS AGREEMENT (INCLUDING BUT NOT LIMITED TO WARRANTY CLAIMS), REGARDLESS OF THE FORUM AND REGARDLESS OF WHETHER ANY ACTION OR CLAIM IS BASED ON CONTRACT, TORT, OR OTHERWISE, EXCEED THE TOTAL FEES PAID BY CUSTOMER TO MPARTICLE UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD PRECEDING THE EVENT OR CIRCUMSTANCES GIVING RISE TO SUCH LIABILITY.

7.3 Independent Allocations of Risk

EACH PROVISION OF THIS AGREEMENT THAT PROVIDES FOR A LIMITATION OF LIABILITY, DISCLAIMER OF WARRANTIES, OR EXCLUSION OF DAMAGES IS TO ALLOCATE THE RISKS OF THIS AGREEMENT BETWEEN THE PARTIES. EACH OF THESE PROVISIONS IS SEVERABLE AND INDEPENDENT OF ALL OTHER PROVISIONS OF THIS AGREEMENT, AND EACH OF THESE PROVISIONS WILL APPLY EVEN IF THEY HAVE FAILED OF THEIR ESSENTIAL PURPOSE.

7.4 Indemnification by mParticle

  • (a) Indemnity. mParticle shall indemnify, defend and hold harmless (“Indemnify”) Customer and its affiliates and its and their respective officers, directors and employees (“Customer Indemnified Parties”) from any and all losses, liabilities, penalties, costs and expenses, including reasonable attorneys’ fees (collectively, the “Liabilities”) incurred by the Customer Indemnified Parties in connection with any third-party action, demand, claim, or proceeding (each, a “Claim”) arising from the use of the mParticle Platform or mParticle SDK in accordance with this Agreement infringing or misappropriating any third-party intellectual property rights (an “Infringement Claim”).
  • (b) Limitations on Infringement Claims. Notwithstanding the foregoing, mParticle shall have no liability or obligation under this Section with respect to any Liability for an Infringement Claim if such Liability is caused in whole or in part by (i) modification of the mParticle Platform or mParticle SDK by any party other than mParticle without mParticle’s express consent; (ii) the combination, operation, or use of the mParticle Platform or mParticle SDK with other product(s), data or services where the mParticle Platform or mParticle SDK would not by itself be infringing; or (iii) unauthorized or improper use of the mParticle Platform or mParticle SDK. If the use of the mParticle Platform or mParticle SDK by Customer has become, or in mParticle’s opinion is likely to become, the subject of any Infringement Claim, mParticle may at its option and expense (A) procure for Customer the right to continue using the mParticle Platform or mParticle SDK as set forth hereunder; (B) replace or modify the mParticle Platform or mParticle SDK to make it non-infringing so long as the mParticle Platform or mParticle SDK has at least equivalent functionality; (C) substitute an equivalent for the mParticle Platform or mParticle SDK or (D) if options (A)-(C) are not reasonably practicable, terminate this Agreement.
  • (c) Exclusive Liability. This Section 7.4 states mParticle’s entire obligation and Customer’s sole remedies in connection with any Infringement Claim.

7.5 Indemnification by Customer

Customer shall Indemnify mParticle and its affiliates and its and their respective officers, directors and employees (“mParticle Indemnified Parties”) from Liabilities incurred by the mParticle Indemnified Parties in connection with any Claim arising from or related to: (a) a breach by Customer of Section 1 (License Grant); (b) any use by Customer of the mParticle Platform, mParticle SDK or mParticle API in violation of this Agreement; (c) a breach by Customer of Section 1 or Section 2 of the Privacy Rider; and or (c) the use by mParticle of Customer Data in accordance with this Agreement.

7.6 Indemnification Procedure

If a Customer Indemnified Party or a mParticle Indemnified Party (each, an “Indemnified Party”) becomes aware of any Claim it believes it should be indemnified under Section 7.4 or Section 7.5, as applicable, the Indemnified Party will give the other Party (the “Indemnifying Party”) prompt written notice of such Claim; provided, however, any failure to give such prompt notice will not relieve the Indemnifying Party of its obligations under this Section 7 except to the extent the Indemnifying Party was actually and materially prejudiced by such failure. The Indemnified Party will cooperate, at the expense of the Indemnifying Party, with the Indemnifying Party and its counsel in the defense and the Indemnified Party will have the right to participate fully, at its own expense, in the defense of such Claim with counsel of its own choosing. Notwithstanding anything to the contrary in this Section 7, the Indemnifying Party will not settle any Claims for which it has an obligation to indemnify pursuant to this Section 7 admitting liability or fault on behalf of the Indemnified Party, or create any obligation on behalf of the Indemnified Party, without the Indemnified Party’s prior written consent, which will not be unreasonably withheld or delayed.

8. Professional Services

mParticle offers its customers use of its customer solutions group for assistance in implementation, training, customization, and other services applicable to Customer’s use of the mParticle Platform, mParticle SDK and/or mParticle API (the “Professional Services”). Any Professional Services to be provided by mParticle to Customer will be set forth in a statement of work, a copy of which may be attached hereto as an exhibit or separately that references this Agreement and is signed by authorized representatives of the Parties (each, a “Professional Services SOW”). Each Professional Services SOW will describe the Professional Services to be provided by mParticle, the fees to be paid by Customer for such Professional Services, and any other terms and conditions that may be agreed to by the Parties with respect to such Professional Services. Each Professional Services SOW is deemed incorporated into, and made a part of, this Agreement and will be governed by the terms and conditions of this Agreement. To the extent any provision set forth in a Professional Services SOW conflicts with any provision set forth in this Agreement, the provision set forth in this Agreement will control. Unless otherwise expressly provided in a Professional Services SOW, all rights, title, and interest to and in any work product developed pursuant to the Professional Services (including, but not limited to, all copyrights, patents, trademarks, and other intellectual property rights relating thereto) will be owned by mParticle and will be deemed to be included in the definition of mParticle Platform and mParticle SDK (as applicable) and licensed to Customer on the terms set forth herein.

9. Proof of Engagement

If the Order with Customer indicates the mParticle Platform will be provided to Customer in connection with a proof of concept engagement (the “POC”), this Section 9 shall apply to such POC. mParticle will make an account available to Customer for the purposes of use case testing in connection with the POC. Any POC to be provided by mParticle to Customer will be set forth in a statement of work, a copy of which may be attached hereto as an exhibit or separately that references this Agreement and is signed by authorized representatives of the Parties (each, a “POC SOW”). Each POC SOW will describe the POC to be provided by mParticle to Customer (including testing parameters and clearly defined, mutually agreed-upon measures of success) and any other terms and conditions that may be agreed to by the Parties with respect to such POC. Each POC SOW is deemed incorporated into, and made a part of, this Agreement and will be governed by the terms and conditions of this Agreement, except for the following provisions hereof: (a) Section 4.1 with respect to the Renewal Term will not apply to the POC; and (b) the general cap on liability in Section 7.2 shall be US$1,000.00. To the extent any provision set forth in a POC SOW conflicts with any provision set forth in this Agreement, the provision set forth in this Agreement will control. Unless otherwise expressly provided in a POC SOW, all rights, title, and interest to and in any work product developed pursuant to the POC (including, but not limited to, all copyrights, patents, trademarks, and other intellectual property rights relating thereto) will be owned by mParticle and will be deemed to be included in the definition of mParticle Platform and mParticle SDK (as applicable) and licensed to Customer on the terms set forth herein. The Initial Term for the POC may be extended by mutual written agreement of the Parties. If Customer desires to subscribe to the mParticle Platform following the completion of the POC, the Parties shall execute and deliver an Order referencing this Agreement, as this Agreement may be further amended upon mutual written agreement of the Parties.

10. General

Customer may not remove or export from the United States or allow the export or re-export of the mParticle Platform, mParticle SDK or anything related thereto, or any direct product thereof in violation of any restrictions, laws or regulations of the United States Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, or any other United States or foreign agency or authority. If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable. Neither Party may assign this Agreement or assign or delegate its rights or obligations under the Agreement without the other Party’s prior written consent; provided however, that either Party may assign this Agreement to an acquirer of or successor to all or substantially all of its business or assets to which this Agreement relates, whether by merger, sale of assets, sale of stock, reorganization or otherwise. Any assignment or attempted assignment by either Party other than in accordance with this Section 10 shall be null and void. This Agreement does not confer any benefits on any third party unless it expressly states that it does. Both Parties agree that this Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement, and that all waivers and modifications must be in a writing signed by both Parties, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement and a Party does not have any authority of any kind to bind the other Party in any respect whatsoever. In any action or proceeding to enforce rights under this Agreement, the prevailing Party will be entitled to recover costs and attorneys’ fees. Customer acknowledges that any unauthorized use of the mParticle Platform or mParticle SDK will cause irreparable harm and injury to mParticle for which there is no adequate remedy at law. In addition to all other remedies available under this Agreement, at law or in equity, Customer further agrees that mParticle shall be entitled to injunctive relief in the event Customer uses the mParticle Platform or mParticle SDK in violation of the limited license granted herein or uses the mParticle Platform or mParticle SDK in any way not expressly permitted by this Agreement. mParticle will provide all notices to Customer under this Agreement by pre-paid first class mail, air courier or e-mail to the mailing or e-mail address Customer provided to mParticle on the applicable Order, or during Customer’s registration for the mParticle Platform, or to a substitute, updated mailing or e-mail address that Customer has provided to mParticle for these purposes. Customer is responsible for keeping its mailing and e-mail address current with mParticle. Except as otherwise specified in this Agreement, all notices to be given to mParticle under this Agreement must be in writing and sent by email to legal@mparticle.com, or by prepaid first class mail or air courier at the address specified on the first page of this Agreement, or to a substitute, updated address notified by mParticle, marked “Attention: Legal Department.” Notices will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or email; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested. Each Party agrees that it will not, without prior written consent of the other, issue a press release regarding their business relationship. mParticle may (a) create demonstration and marketing materials and information which includes Customer Data solely in anonymized or aggregated format and disclose and otherwise make such materials and information available solely in connection with marketing and demonstrating the mParticle Platform; and (b) mention Customer and the relationship between mParticle and Customer in mParticle’s marketing collateral, website, and other promotional and marketing materials. Each Party shall be excused from performance for any period during which, and to the extent that, it is prevented from performing any obligation or service, in whole or in part, as a result of a cause beyond its reasonable control and without its fault or negligence, including, but not limited to, acts of God, acts of war, epidemics, fire, communication line failures, power failures, earthquakes, floods, blizzard, or other natural disasters (but excluding failure caused by a Party's financial condition or any internal labor problems (including strikes, lockouts, work stoppages or slowdowns, or the threat thereof)) (a “Force Majeure Event”). Upon the occurrence of any Force Majeure Event, the affected Party shall give the other Party written notice thereof as soon as reasonably practicable of its failure of performance, describing the cause and effect of such failure, and the anticipated duration of its inability to perform. Delays in performing obligations due to a Force Majeure Event shall automatically extend the deadline for performing such obligations for a period equal to the duration of such Force Majeure Event; provided, however, the Party affected by a Force Majeure Event will take all reasonable actions to minimize the consequences and cause the cessation of any such event. Except as otherwise agreed upon by the Parties in writing, in the event such non-performance due to a Force Majeure Event continues for a period of thirty (30) days or more, either Party may terminate this Agreement by giving written notice thereof to the other Party. This Agreement shall be governed by the laws of the State of New York without regard to its conflict of laws provisions. For all disputes relating to this Agreement, each Party submits to the exclusive jurisdiction of the state and federal courts located in the Borough of Manhattan in the City of New York, New York and waives any jurisdictional, venue, or inconvenient forum objections to such courts.

10. Modifications to Agreement

mParticle may change this Agreement from time to time. If mParticle makes any changes to this Agreement, it will change the effective date above. All historical versions of this Agreement can be found at the end of this page. Customer agrees that its continued use of the mParticle Platform after such changes have been published will constitute Customer’s acceptance of such revised Agreement. Please visit this section of our website periodically in order to keep up to date with changes in this Agreement.

Exhibit A - Privacy and Security Rider

This Privacy and Security Rider (this “Rider”) is incorporated into and made a part of the mParticle Platform Services Agreement to which this Rider is attached (the “Agreement”). Any capitalized term used but not defined in this Rider will have the meaning ascribed to it in the Agreement.

1. Consumer Privacy

Each Party shall comply with all Applicable Laws with respect to the collection, storage and use of Customer Data. Each Party agrees: (a) to maintain a privacy policy that (i) is in compliance with Applicable Laws and (ii) discloses its respective privacy and data practices as contemplated by this Agreement; (b) Customer will post such a privacy policy conspicuously on each of its Supported Customer Properties; and (c) mParticle will post its privacy policy conspicuously on its website at www.mparticle.com. Except for mParticle’s express obligations for processing the Customer Data, mParticle shall have no liability or responsibility for (A) Customer’s compliance with Applicable Laws related to privacy in connection with Customer’s use of the mParticle Platform or mParticle SDK, or (B) Customer’s collection, use, storage, distribution or other exploitation of any Customer Data using the mParticle Platform or mParticle SDK. Customer is responsible for providing legally sufficient notices to users and (where required by Applicable Laws) must obtain appropriate consent from users for Customer’s information collection and use practices relating to the mParticle Platform including, but not limited to, the use of cookies and similar technologies for tracking purposes in connection with the mParticle Platform.

2. No Sensitive Information

Customer will not use the mParticle Platform or the mParticle SDK to collect, transmit, provide, or otherwise make available to the mParticle Platform “sensitive information”, which is defined as the following personally identifiable information about an individual: his or her financial account numbers, insurance plan numbers, precise information about health or medical conditions, and government-issued identifiers (such as a Social Security number), as well as data that may reasonably be used for the purposes of employment, health care, credit or insurance eligibility elements and/or those elements described as sensitive information under Applicable Laws. mParticle reserves the right to periodically update the definition of “sensitive information” (as used herein) in its reasonable judgment exercised in good faith.

3. CCPA

Effective January 1, 2020 or as otherwise proscribed under the CCPA, the parties agree to comply with the California Consumer Privacy Act as well as any CCPA regulations promulgated by the California Attorney General’s office (“CCPA”) to the extent that either Party processes personal information covered under the CCPA. Each of the Parties represents and warrants that it understands the rules, restrictions, requirements and definitions of the CCPA and agrees to adhere to the requirements of the CCPA that applies to each Party’s processing of personal information provided by Customer pursuant to the Agreement (“Customer Personal Information”), including, but not limited to: (a) providing a privacy policy notice as required by CCPA; (b) providing data subjects with a notice and opt-out choice where required by CCPA; and (c) providing each other reasonable cooperation with respect to verifiable consumer requests and other applicable CCPA requirements. To the extent required under the CCPA, mParticle shall comply with the provisions of Section 7 of this Rider.

4. Data Localization and Transferred Personal Data

4.1 Data Localization

If the Order Form with Customer indicates that Customer Data will be localized in the EU or Australia, Customer Data will be stored and processed in the EU or Australia (as applicable); provided, however, that if mParticle customer service or technical personnel needs to access Customer Data to perform its obligations to Customer, such personnel may be physically located outside the EU or Australia (as applicable) and therefore technically a small amount of data may be processed outside the EU or Australia, as applicable, and, as such, the Parties hereby enter into Standard Contractual Clauses (as defined below) to account for such transfers.

4.2 Cross-Border Data Transfers from the EEA, United Kingdom and other Restricted Transfer Countries


mParticle may, subject to this Section 4, store and Process the relevant Personal Data in the European Economic Area, Switzerland, the United Kingdom and the United States. If mParticle’s provision of the mParticle Platform to Customer pursuant to the Agreement involves the storage and/or Processing of Customer’s Personal Data which transfers such Personal Data out of the European Economic Area or Switzerland to a jurisdiction that does not have adequate Applicable Laws, and the Applicable Laws apply to the transfers of such data (“Transferred Personal Data”), the Parties agree that the EU Commission Implementing Decision (EU) 2021/914 and available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj (as amended or updated from time to time) ("Standard Contractual Clauses") will apply and such Standard Contractual Clauses shall be incorporated by reference and form an integral part of this Rider. Purely for the purposes of the descriptions in the Standard Contractual Clauses and only as between Customer and mParticle, the Parties agree that:

  • (a) Roles of the Parties. Customer is a Data Controller and "data exporter" and mParticle is the Data Processor and "data importer" under the Standard Contractual Clauses.
  • (b) Governing Law and Supervisory Authority. The Standard Contractual Clauses shall be governed by the law of the EU Member State in which the data exporter is established and enforced by the Supervisory Authority of such EU Member State.
  • (c) Sub-Processors. The parties select general written authorization for Sub-processors.
  • (d) Redress. The parties elect to omit the optional text.
  • (e) Annexes. Annexes I, II and III are provided at the end of this Rider as Appendix A, and to the extent that there’s a conflict between the Rider and Appendix A, Appendix A shall govern.

The Parties further agree that if Transferred Personal Data includes Personal Data from Data Subjects located in the United Kingdom, the Parties will safeguard such data using mechanisms which are equivalent to those of the Standard Contractual Clauses until such time as the United Kingdom formally approves a set of UK Standard Contractual Clauses at which point the Parties shall execute the UK standard Contractual Clauses. At Customer’s written request, or if mParticle’s provision of the mParticle Platform to Customer pursuant to the Agreement involves the storage and/or processing of Customer’s Personal Data collected from persons located in Argentina, Brazil or another jurisdiction not described above but which restricts the transfer of such Personal Data (each a “Restricted Transfer Country”) outside of each Restricted Transfer Country to a place that does not have adequate data protection laws, the Parties agree to execute each applicable Restricted Transfer Country’s model clause agreement to ensure that such transfers are conducted in accordance with Applicable Laws. To the extent Customer is the recipient of Personal Data from mParticle pursuant to this Rider, Customer agrees that Customer will provide at least the same level of protection for the information as mParticle has agreed to provide herein. If the Standard Contractual Clauses or any other model clause transfer agreement are deemed invalid by a governmental entity with jurisdiction over Transferred Personal Data (e.g., the EU Court of Justice) or if such governmental entity imposes additional rules and/or restrictions regarding such Transferred Personal Data, the Parties agree to work in good faith to find an alternative and/or modified transfer mechanism.

5. GDPR

To the extent either Party processes EU Personal Data hereunder, the following terms shall apply.

(a) Confidentiality. Each Party shall take reasonable steps to ensure the reliability of any individual who may have access to EU Personal Data, shall strictly limit access to those individuals with a need to know or access such data, and shall ensure that such individuals are subject to confidentiality agreements or professional or statutory obligations of confidentiality.

(b) Security. mParticle shall implement reasonable technical and administrative security measures to protect such EU Personal Data and which comply with Applicable Laws.

(c) Subprocessors. (i) Customer hereby grants its consent to the subprocessors listed at http://docs.mparticle.com/guides/approved-subcontractors as of the day this Rider is executed (the “Approved Sub-processors”, (ii) if permitted to engage a subprocessor in accordance with the preceding clause, mParticle will be fully responsible and liable for the subprocessor’s activities, and (iii) before engaging a subprocessor, mParticle must enter a written contract with the same or similar terms as in this Agreement with respect to protections for EU Personal Data, including sufficient guarantees that the subprocessor will provide sufficient security to meet the requirements of the GDPR.

(d) Obligations and Rights of Controller; Types of Data; Categories of Data Subjects; Nature and Purpose of Processing; Subject Matter and Duration of Processing. The obligations and rights of the controller, the types of personal data to be processed, the categories of data subjects, the nature and purpose of the processing, and the subject matter and duration of the processing are as described in the Agreement.

(e) Retention. The Parties shall retain EU Personal Data for no longer than is necessary for the purposes for which it was obtained.

(f) Recordkeeping. Each Party shall maintain a record of all processing activities, in writing and in electronic form, as required by Applicable Laws.

(g) Personal Data Breach. Each Party agrees to cooperate and assist the other in the event of a personal data breach and to provide notice as required by Applicable Laws.

(h) Data Protection Impact Assessments; Responding to Data Protection Authorities. Each Party agrees to assist the other with data protection impact assessments, and to respond to data protection authorities, according to Applicable Laws.

(i) Audits and Inspections. Audits and inspections shall be governed by Section 7(d) of this Rider.

(j) GDPR Responsibilities and Liabilities. Notwithstanding anything to the contrary in the Agreement, or any other agreement between the Parties, Customer will not be relieved of its own direct responsibilities and liabilities under the GDPR and other Applicable Laws. For EU Personal Data, the terms "commission", "controller", "data subject", “EEA”, "personal data", "personal data breach", “processor”, "processing", “subprocessor,” as used herein shall have the same meaning as in the GDPR. For data that is not EU Personal Data, all terms shall have the meanings given them under other Applicable Laws. To the extent required under GDPR, (i) mParticle shall comply with the provisions of Section 7 of this Rider, and (ii) the Parties agree that: (A) the data importer is mParticle, Inc., a corporation organized under the laws of the State of Delaware, USA, (B) the data exporter is the Customer, (C) data subjects are the users of the data exporter's websites, mobile applications and other digital mediums and any data received from Customer’s Third Party Partners, as described in the Agreement, (D) Personal Data concern the following categories of data: data on user behavior collected through a SDK and/or pixels placed on the data exporter's websites, mobile applications and/or digital mediums, including email addresses, telephone numbers mobile advertising identifiers and pseudonymous identifiers of the users of the data exporter's websites, mobile applications and/or digital mediums as outlined in the Agreement, (E) there are not special categories of data unless indicated in a separate attachment to this Rider, and (F) the personal data transferred will be subject to the following basic processing activities: the data importer will access, reproduce, display and store the relevant personal data in order to provide the mParticle Platform as set out in the Agreement and for no other purposes whatsoever.

6. Privacy Roles

The Parties acknowledge and agree that (a) mParticle is solely a “service provider” under the CCPA and solely a “processor” under the GDPR, and (b) mParticle is not responsible for the privacy or security practices of any of Customer Third Party Partners. As used in this Rider, “Customer Third Party Partner” means a third-party entity engaged by Customer for the processing of Customer Data.

7. Privacy and Security Measures

(a) mParticle Warranties. mParticle agrees that: (i) it shall collect, store, transfer, dispose, disclose and use all Customer Personal Information, Customer EU Personal Data and other Customer personal information or data protected by Applicable Laws (collectively, “Subject Data”) using the highest standard of care to ensure the protection of such data and in compliance with all Applicable Laws; (ii) it shall not collect, retain, process, share or otherwise use Subject Data except for providing the mParticle Platform as described in the Agreement unless as required by Applicable Law or a government authority (in which case mParticle shall use its best efforts to notify Customer before such disclosure or as soon thereafter as reasonably possible); (iii) it shall not sell Subject Data as a service provider under CCPA or otherwise; (iv) it shall take reasonable steps to ensure that the transfer of Subject Data is not a sale of Subject Data; and (v) except for Approved Sub-Processors, it shall only transfer Subject Data to a third-party, including a Customer Third-Party Partner, as specifically directed by Customer. Any Approved Sub-Processors will be permitted to obtain Subject Data only to deliver the services mParticle has retained them to provide and are prohibited from using such Subject Data for any other purpose. mParticle shall remain fully liable for all acts or omissions of its subcontractors. A list of Approved Sub-Processors is available at https://docs.mparticle.com/guides/approved-subcontractors/. mParticle shall post any new subprocessors to the list of Approved Sub-Processors at least thirty (30) days in advance and Customer will be deemed to have granted its consent after the expiration of the thirty (30) day notice period. If Customer objects to mParticle’s change in such subprocessors prior to the thirty (30) day notice period, such objection must be reasonable and mParticle may, as its sole and exclusive remedy, terminate the portion of the Agreement relating to the provision of the mParticle Platform that cannot be reasonably provided without the objected-to new subprocessor by providing 30 days’ prior written notice to Customer.

(b) Data Retention. mParticle shall retain Subject Data only for as long as necessary to provide the mParticle Platform to Customer. Upon Customer request, or upon termination of the Agreement for any reason, mParticle shall promptly delete or erase the Subject Data or the encryption key to such Subject Data.

(c) Security Standard and Reportable Incident Process.

(i) Information Security Standards. Both Parties agree that they will use their commercially reasonable efforts to maintain administrative, technical, and physical safeguards that are no less rigorous than industry standard practices to ensure the security and confidentiality of Subject Data, protect against any anticipated threats or hazards to the confidentiality, availability or integrity of Subject Data, and protect against unauthorized access, use, or alteration of Subject Data. Both Parties agree not to process under the Agreement Subject Data in non-encrypted or nonredacted form on as defined Section 1798.81.5(d)(1) of the California Civil Code or under other Applicable Laws except with the written permission of the other party, whereby such permission will not be unreasonably withheld.

(ii) Written Information Security Program. Both Parties shall maintain, in writing, reasonable security procedures and practices (“Written Information Security Program” or “WISP”) as necessary to protect Subject Data within its control from unauthorized access, destruction, use, modification, or disclosure. Without limiting the generality of the foregoing statement, the WISP shall at a minimum encompass each of the elements set forth below.

(iii) Incident Procedures. Any known or suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to transmitted, stored, or otherwise processed by mParticle or a Sub-processor of mParticle involving Subject Data in nonencrypted or nonredacted form as defined under section 1798.81.5(d)(1) of the California Civil Code or other Applicable Laws (each a “Reportable Incident”) shall be subject to the following procedures:

(A) mParticle shall notify Customer promptly (but in any event within 72 hours) of any Reportable Incident by sending an email with all available and relevant details to the Data Security Contact Email on the Order.

(B) mParticle shall investigate the Reportable Incident, and provide reasonable and necessary cooperation with Customer, including facilitating interviews with relevant personnel, making available all relevant records, logs, files, data reporting and other materials, and providing Customer with reasonable physical access to the facilities affected where owned and operated by mParticle.

(C) Unless required by Applicable Law, mParticle shall not inform any third party of any Reportable Incident without first obtaining Customer’s prior written consent, other than to inform a complainant that the matter has been forwarded to Customer’s legal counsel or to incident response and forensics specialists under confidentiality restriction no less strict than those set forth in the Agreement.

(D) Following a Reportable Incident, mParticle shall document responsive actions taken in connection with the Incident and shall conduct a post-breach review of events and actions taken, if any, to make changes in security practices and procedures to prevent such Reportable Incident from occurring again in the future.

(iv) Incident Remediation. mParticle shall use its commercially reasonable efforts to mitigate and remedy any Reportable Incident and prevent any further Reportable Incident at its sole expense.

(v) Third Party notification. mParticle agrees that, unless Applicable Law states otherwise, Customer shall have the sole right to determine (A) whether notice of the Reportable Incident is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by Applicable Law or otherwise, in Customer’s discretion, (B) the contents of such notice, and (C) whether any type of remediation may be offered to affected persons, as well as the nature and extent of any such remediation. mParticle agrees to reimburse Customer for reasonable costs described in this section for Reportable Incidents and/or as required by Applicable Law.

(d) Audit. No more than once per year, Customer may engage a mutually agreed upon third party to audit mParticle solely for the purposes of meeting its audit requirements pursuant to Article 28, Section 3(h) of the GDPR or as otherwise required by Applicable Laws. To request an audit, Customer must submit a detailed audit plan at least four (4) weeks in advance of the proposed audit date describing the proposed scope, duration, and start date of the audit. Audit requests must be sent to security@mParticle.com. The auditor must execute a written confidentiality agreement acceptable to mParticle before conducting the audit. The audit must be conducted during regular business hours, subject to mParticle’s policies, and may not unreasonably interfere with mParticle’s business activities. Any audits are at Customer’s expense. Any request for mParticle to provide assistance with an audit is considered a separate service if such audit assistance requires the use of resources different from or in addition to those required by Applicable Laws. Customer shall reimburse mParticle for any time spent for any such audit at the rates agreed to by the Parties. Before the commencement of any such audit, Customer and mParticle shall mutually agree upon the scope, timing, and duration of the audit, in addition to the reimbursement rate for which Customer shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by mParticle.

8. mParticle Security Measures

As a cloud-native company, mParticle makes extensive use of the Amazon AWS platform and the wide range of security features that it provides. AWS uses a ‘Shared Responsibility Model’, where Amazon is responsible for securing the underlying infrastructure and networks and mParticle secures the data that is hosted and code that runs in the AWS environment. All mParticle systems use TLS, where supported, to protect data in transit between end user devices and the mParticle Platform and between the mParticle Platform and mParticle’s third party partner services (i.e., Integration Partners and Approved Sub-Processors). Data is also encrypted at rest within the AWS environment using AES256 to encrypt mParticle’s EBS volumes. mParticle’s production secrets are protected using a combination of Hashicorp Vault, Amazon KMS and CloudHSM with role based access configured to prevent plaintext secrets from being stored on disk. mParticle makes use of AWS Inspector to identify and report on known vulnerabilities in mParticle’s production hosts.

All mParticle staff undergo background checks and annual security training and must adhere to published internal security policies. Policy areas include:

  • Password strength and complexity
  • Encryption and key management
  • Device tooling and Monitoring
  • Secure development practices
  • Secrets Management
  • Disciplinary actions

mParticle enforces strict role-based access control with periodic audits to all systems (Corp and Prod) and operate using the principle of least privilege. mParticle’s staff are only given the access that they require to do their jobs. By default, no mParticle staff are able to access Customer Data as it is both physically and logically separated from mParticle’s corporate network. mParticle developers are not granted access to the production infrastructure and all deploys are performed by the mParticle operations team. mParticle engages a number of third party penetration testing companies to provide at least annual assessments of mParticle’s security stance. These tests include web application, infrastructure and social engineering engagements.

mParticle’s dedicated security team makes use of monitoring and logging capabilities from all areas of mParticle’s stack to identify malicious behavior with automated alerting in place to flag anomalies.

Only authorized devices are able to connect to mParticle’s corporate networks and all devices are forced to include the following protections:

  • Antivirus with automatic daily updates
  • DNS protection using Cisco Umbrella to protect against malicious sites
  • Full disk encryption. Every device is configured to use strong encryption to protect local data
  • Endpoint protection/management tools - mParticle has tooling on every corporate system to ensure compliance and detect malicious behavior
  • Automatic password protected screensaver locks
  • Automatic account lockouts on number of authentication attempts

mParticle utilizes Active Directory and ADFS for centralized authentication and supplement with multi factor authentication for access to sensitive systems, including mParticle’s VPNs, AWS and mParticle’s production environments. For 2FA, mParticle makes use of Duo, physical yubikeys and smart cards to limit access to individual hosts within production environments in combination with SSH keys via locked down bastion hosts. mParticle conducts security audits of any third party vendors and sub-contractors that mParticle engages and requires at least a comparable level of security from such vendors and sub-contractors.

9. mParticle liability for Security Incidents

The liability of each Party and its respective affiliates’, taken together in the aggregate, arising out of or relating to this Rider shall be subject to the sections of the Agreement governing indemnification and limitations of liability, and any reference in such sections to the liability of a Party means the aggregate liability of that Party and all of its affiliates under the Agreement and this Rider together.

APPENDIX A

ANNEX I

A. LIST OF PARTIES

Data exporter: The data exporter is the Customer

Data importer: The data importer is mParticle, Inc.

B. DESCRIPTION OF TRANSFER

The personal data transferred concern the following categories of data subjects (please specify):

Past, present, or future employees, agents, or representatives of the data exporter, its customers, the past, present, or future employees, agents, or representatives of its customers, and other data subjects whose data may be provided pursuant to the Agreement.

Categories of data

The personal data transferred concern the following categories of data (please specify):

Personal data may include names, email addresses and pseudonymous personal data such as IP Addresses and mobile advertising ID collected from the mobile applications and other digital property owned or controlled by data exporter.

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data (please specify):

None

Processing operations

The data importer will access, reproduce, display and store the relevant personal data in order to provide the services pursuant to the Agreement and for no other purposes.

C. COMPETENT SUPERVISORY AUTHORITY

The Standard Contractual Clauses shall be governed by the law of the EU Member State in which the data exporter is established and enforced by the Supervisory Authority of such EU Member State.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c):

As a cloud-native company, mParticle makes extensive use of the Amazon AWS platform and the wide range of security features that it provides.

AWS uses a ‘Shared Responsibility Model’, where Amazon is responsible for securing the underlying infrastructure and networks and mParticle secures the data that is hosted and code that runs in the environment.

All mParticle systems use TLS, where supported, to protect data in transit between end user devices, the mParticle application and our partner services. Data is also encrypted at rest within the AWS environment using AES256 to encrypt mParticle’s EBS Volumes.

mParticle’s production secrets are protected using a combination of Hashicorp Vault, Amazon KMS and CloudHSM with role based access configured to prevent plaintext secrets ever being stored on disk.

mParticle’s makes use of AWS Inspector to identify and report on known vulnerabilities in mParticle’s production hosts.

All mParticle’s staff undergo background checks and annual sec training and must adhere to published internal security policies. Policy areas include:

  • Password strength and complexity
  • Encryption and key management
  • Device tooling and Monitoring
  • Secure development practices
  • Secrets Management
  • Disciplinary actions

mParticle enforces strict role-based access control with periodic audits to all systems (Corp and Prod) and operate using the principle of least privilege. mParticle’s staff are only given the access that they require to do their job. By default, no mParticle staff are able to access customer data as it is both physically and logically separated from mParticle’s corporate network. Developers are not granted access to the production infrastructure and all deploys are performed by the Operations team.

mParticle engages a number of third party penetration testing companies to provide at least annual assessments of mParticle’s security stance. These tests include web application, infrastructure and social engineering engagements.

mParticle’s dedicated security team makes use of monitoring and logging capabilities from all areas of mParticle’s stack to identify malicious behavior with automated alerting in place to flag anomalies.

Only authorised devices are able to connect to mParticle’s corporate networks and all devices are forced to include the following protections:

  • Antivirus with automatic daily updates
  • DNS protection using Cisco Umbrella to protect against malicious sites
  • Full disk encryption. Every device is configured to use strong encryption to protect local data.
  • Endpoint protection/management tools - mParticle has tooling on every corporate system to ensure compliance and detect malicious behaviour.
  • Automatic password protected screensaver locks
  • Automatic account lockouts on number of authentication attempts

mParticle utilises Active Directory and ADFS for centralised authentication and supplement with multi factor authentication for access to sensitive systems including mParticle’s VPNs, AWS and Production environments. For 2FA, mParticle makes use of Duo, physical yubikeys and smart cards to limit access to individual hosts within production in combination with SSH keys via locked down bastion hosts.

mParticle conducts security audits of any third party vendors and sub-contractors engaged by mParticle with and expect at least a comparable level of security from such vendors and sub-contractors.

Supplemental Measures implemented pursuant to The European Data Protection Board (EDPB) Recommendations 01/2020 on measures which supplement mParticle’s transfer tools to ensure compliance with the EU level of protection of personal data Version 2.0 and adopted on 18 June 2021 are available upon request.

ANNEX III

LIST OF SUB-PROCESSORS

The controller has authorised the use of the following sub-processors listed at as of the date of execution of this Privacy and Security Rider: https://docs.mparticle.com/guides/approved-subcontractors/