Legal

Security, Privacy and PCI Addendum

This Security, Privacy and PCI Addendum to TokenEx’s Terms of Service (“ToS”) may be modified from time to time. TokenEx shall place any such amendments on its website, at www.tokenex.com/legal, and provide immediate notice of any such amendments on TokenEx’s Customer Portal.

1. Security Assessments. Commencing on the Effective Date, TokenEx shall and shall cause those Agents who will be hosting the Services or will have access to Customer Data, at their sole cost and expense, engage an AICPA accounting firm to conduct an annual end-to-end SOC 2 Type 2 audit of the trust services principles, security, availability, confidentiality, and controls of the information processing and management systems (including procedures, people, software, data, and infrastructure) used by TokenEx and its Agents in the provision of the Services and the storing, accessing, and processing Customer Data received by TokenEx under the Agreement.  Upon request by Customer, TokenEx shall, provide a summary of the resulting annual report, including end-user considerations, within thirty (30) business days of Customer’s request. The SOC 2 Report(s) shall be prepared in accordance with attestation standards established by the American Institute of Certified Public Accountants.

2. Audits. Upon reasonable request and no more than once every twelve (12) months, Customer may notify TokenEx in writing of Customer’s intent to conduct either an assessment or an audit of TokenEx relevant to the services being provided to Customer by TokenEx, in order to assess the performance of TokenEx’s obligations hereunder. For purposes of this paragraph, an “assessment” includes responding to written questions and providing limited documentation in respect of the Services being provided Customer by TokenEx; and, an “audit” includes both an assessment and a site visit to TokenEx’s facilities.  Customer shall provide written notice to TokenEx of Customer’s intent to exercise these assessment or audit rights no less than thirty (30) days prior to initiation of any such assessment or audit. The notification shall contain the anticipated start date of the assessment or audit, questions to be answered, documents to be produced or reviewed, areas to be reviewed, and, in the event of an audit, the anticipated on-site arrival date of the auditors. All audits shall be conducted in a reasonable manner during normal business hours and shall not interfere with TokenEx’s business. TokenEx will bear internal costs incident to any such audit (salary of affected employees, etc.) of TokenEx, but only to the extent of One Thousand dollars ($1,000.00) per audit.  Any internal expenses due to salary, etc., in excess of One Thousand dollars ($1,000.00) per audit, shall be billed to Customer at TokenEx’s normal hourly rates.  Each party shall communicate in good faith to agree to terms for an audit visit and adhere to these terms and admit properly identified and authorized employees or representatives of Customer onto TokenEx’s premises. Such access shall be limited to summaries of TokenEx’s policies and reports that relate to the services provided to Customer or a designated representative of Customer.

3. Security Controls. TokenEx shall conduct regular self-testing and independent audits to ensure compliance by Supplier with this Agreement and all applicable Laws and Regulatory Requirements, including all confidentiality, non-disclosure, security, disaster recovery, contingency planning, and obligations applicable to TokenEx and its Agents.

TokenEx has implemented and maintains (a) administrative, technical, and physical safeguards and security controls, (b) data retention, and incident response policies and procedures, and (c) an architecture designed for high-availability that is tailored to and appropriate for the nature and complexity of the Services, and otherwise designed to (i) ensure the security and confidentiality of the Services, personal information, and Customer data, (ii) protect against any anticipated threats or hazards to the security or integrity of the Services, personal information, and the Customer data, and (iii) protect against unauthorized access to or use of the Services, personal information, or the Customer data that could result in substantial harm or inconvenience to Customer, Customer’s affiliates, or Customer’s Customers or employees.

Updating of Security Controls. TokenEx shall evaluate and adjust TokenEx’s security controls to (a) address any reasonable changes or additions to the services, TokenEx’s operations, or the relationship between the parties, (b) address any risks or vulnerabilities reported to or discovered by TokenEx, (c) meet evolving industry standards and best practices, (d) comply with and respond to any changes in privacy laws or other applicable laws, and (e) address any other circumstances that TokenEx believes may have a material impact on the services, or could adversely affect Customer, Customer’s affiliates or Customer’s employees or Customers. TokenEx shall promptly correct any deficiencies or vulnerabilities identified as part of any monitoring, testing, or auditing. Without limiting the foregoing, TokenEx shall develop and implement an action plan for prompt corrective action to eliminate the identified risk, make the action plan available to Customer, and provide all information reasonably requested by Customer and Customer’s regulators in connection with the implementation thereof.

TokenEx shall notify Customer in writing or via email in accordance with TokenEx’s Incident Response Policy in the event of any known or suspected breach of confidentiality or security affecting Customer, Authorized Users and employees, including any known or suspected unauthorized access to or misuse, loss, alteration or destruction of personal information or other Customer data. The initial communication shall describe the nature and impact of the security incident, the actions already taken, and an assessment of the immediate risk. TokenEx shall cooperate in taking all reasonable actions necessary to investigate, respond to, and limit the adverse effects of the security incident on a basis no less favorable than offered to any other affected Customer, and shall participate in Customer’s internal incident response plan where applicable. TokenEx shall coordinate with Customer regarding any notification to regulators, law enforcement, affected individuals, and the press, and shall not notify or otherwise contact any employees or Customers of Customer without Customer’s prior written approval.

4. PCI DSS Compliance. TokenEx has established security procedures and shall make reasonable efforts consistent with industry standards to protect cardholder data, meet all applicable audit requirements and comply with PCI DSS (hereinafter “Payment Card Industry Data Security Standards”) and such other applicable rules, regulations, codes of practice, guidance and industry standards related to the handling and processing of credit card data in force from time to time during the term hereof (“Payment Card Issuer Requirements”), as established by the PCI Security Standards Council.

TokenEx is responsible for the security of cardholder data TokenEx possesses or otherwise stores, processes, or transmits on Customer’s behalf, or to the extent TokenEx could impact the security of Customer’s cardholder data environment.

TokenEx agrees to comply with all applicable PCI DSS requirements to the extent that TokenEx handles, has access to, or otherwise stores, processes or transmits Customer’s cardholder data, or manages Customer’s cardholder data environment.

TokenEx acknowledges that TokenEx is solely responsible for compliance with all applicable PCI DSS requirements for TokenEx’s tokenization products and services, including but not limited to, TokenEx’s tokenization application programing interface (API), , and any vaulting services. Customer agrees to monitor TokenEx’s PCI DSS compliance at least annually.

TokenEx agrees that on request, TokenEx shall provide Customer proof of the current status of TokenEx’s PCI DSS compliance. If TokenEx or any of TokenEx’s subcontractors are no longer in compliance with the Payment Card Issuer Requirements, TokenEx shall (a) notify Customer of the same within twenty-four (24) hours of discovery by TokenEx, and (b) within 72 hours, develop and communicate a remediation plan and timeline for becoming compliant. If TokenEx fails to uphold the foregoing obligations Customer shall have the right to terminate this agreement or any part of the Services, and Customer shall only be obligated to pay for any Products and/or Services satisfactorily delivered.

TokenEx agrees to comply with all applicable laws that require notification of individuals or parties in the event of unauthorized disclosure of cardholder data.  Pursuant to the provisions hereof, in the event of a breach of any of TokenEx’s security obligations relating to PCI or other event requiring notification under applicable law, TokenEx agrees to assume responsibility for informing all such individuals in accordance with applicable laws, and, subject to the indemnity and limitations on liability provisions contained herein.

Security, Privacy and PCI Addendum Download

Service Level Addendum

This Service Level Agreement (“SLA”) outlines TokenEx’s commitments for the end-to-end uptime and critical security incident notifications for TokenEx’s Services. It also sets forth the respective remedies available if TokenEx fails to meet these commitments. This SLA and the credits provided below are TokenEx’s only obligation and Customer’s only remedy for TokenEx’s failure to meet these commitments. Capitalized terms not defined herein will have the same meaning as in the applicable Terms of Service between Customer and TokenEx.

1. Uptime Guarantee

A. TokenEx guarantees end-to-end uptime availability of 99.99% for our services.

B. The following are excluded from this guarantee:

• Routing anomalies, asymmetries, inconsistencies and failures of the Internet outside of TokenEx’s control;

• Maintenance events as defined in Section C below;

• Customer requested or instructed actions, whether performed by the Customer, TokenEx, or a third party, that impacts the availability of Services.

TokenEx proactively monitors infrastructure uptime. The results of these monitoring systems are the exclusive determination of the Services uptime. Not more than once a month and upon request via the Customer Portal, TokenEx will provide Customer with these results.

C. Maintenance Exceptions

• Availability. “Availability” means the time in which the Customer is able to connect to and transfer data with the System on a monthly basis, excluding Scheduled Maintenance.

• Scheduled Maintenance. “Scheduled Maintenance” means a period for which the Services are scheduled to be unavailable for use by Customer in order to perform preventive maintenance, install upgrades or perform similar work, and for which Customer has been given prior notice of such period. TokenEx shall notify Customer of any scheduled maintenance at least seven days prior to such period.

2. Service Availability and Discounts.

In the event that TokenEx does not meet the applicable Availability levels set forth below, upon Customer’s request through the Customer Portal, TokenEx shall provide the discount set out below to Customer’s next monthly invoice or obligation for the applicable System(s) as sole remedy for not meeting the Availability level. The discount levels do not aggregate. Customer shall not receive a discount if an interruption is (a) caused by Scheduled Maintenance (b) due to any cause beyond TokenEx’s reasonable control, or (c) caused by Customer’s inability to access the System as a result of the failure of Customer’s own systems or providers.

The payment of service credits will be based solely on the Fees for the Services for the month in which the claim arises and only for the impacted account(s) for the Services. TokenEx will only apply the Service Credits against future Services payments otherwise payable to the Customer. The payment for any single failure shall not exceed fifty percent (50.0%) of the monthly service Fees for the impacted components of the Services. The total cumulative Service Credits claimed by Customer in any given month shall not exceed the amount owed by the Customer for the Services that month.

All Service credit claims should be communicated via a ticket in the Customer Portal within seven (7) calendar days of the incident giving rise to the claim. The notification ticket must express the desire to claim a service credit and state that Customer was affected by the downtime. After notification, Customer has thirty (30) days to deliver any relevant information about the downtime that TokenEx requests. The ticket detailing the impact of the downtime may include any relevant information, including, but not limited to: the impacted server(s), the date, time, and full description of the incident and any logs (if applicable). Failure to provide notification via the portal will disqualify the Customer from receiving a Service credit.

No Service Credits will be given for service interruptions : (i) caused by the action or failure to act by Customer, Customer’s personnel, or any of Customer’s users, (ii) due to failure of any equipment or software provided by the Customer, (iii) which are the result of Scheduled Maintenance, (iv) due to a force majeure event, (v) for which Customer is entitled to a Service Credit for the same or contemporaneous service commitment failure, or (vi) for downtime or other problems that may result from the Customer’s use of the Beta Services or, (vii) to the extent TokenEx offers Customer a Self-Service option and that results from the Customer’s use of a Self-Service option.

3. Problem Response and Escalation.

TokenEx’s Customer support services are available twenty-four (24) hours a day, seven (7) days a week via the Customer Portal as well as via a toll-free telephone number which will be provided. Notification to TokenEx of support issues shall be by such portal ticket or telephone number, subject to the provisions hereof. TokenEx shall answer all calls directly within fifteen (15) minutes and engage resources for resolution within thirty (30) minutes for all Severity I and II issues. Additionally, TokenEx shall escalate the level of personnel necessary, up to and including TokenEx’s CTO, to address any such Severity I or II issue as necessary to remedy any such issue as quickly as possible. TokenEx shall return all calls within six (6) hours for Non-Critical and Minor items. The Customer Portal is also available 24x7 for use by the Customer to report any issues or ask any questions.

Service Level Addendum Download

TokenEx, Inc. Data Processing Addendum

This Data Processing Addendum shall serve as Addendum to TokenEx Inc.’s Terms of Service (“ToS”) or Master Services Agreement (“MSA”), and is subject to, and controlled by, the terms of those agreements, whichever is applicable.  Both shall be referred to herein as “ToS.”

WHEREAS, Customer and TokenEx are parties to a ToS pursuant to which TokenEx provides data security services as ordered by Customer from time to time under the ToS. 

WHEREAS, the parties have agreed to supplement and amend the ToS to the extent required by this Data Processing Addendum, but only to that extent.

In consideration of the mutual obligations in this Data Processing Addendum and payment to TokenEx, the receipt of which is duly acknowledged by TokenEx, the parties agree as follows:

1. EFFECTIVE DATE

1.1 The Effective Date will be the Effective Date of the ToS, unless otherwise specifically set forth in this Addendum.

2. DEFINITIONS AND INTERPRETATION

2.1 All terms defined in the ToS shall be deemed to have the same meaning in this Data Processing Addendum, other than as specifically amended by this Data Processing Addendum.

2.2 In this Data Processing Addendum, the following terms have the following meanings:

(a) “Personal Data” shall mean all information relating to an identified or identifiable natural person (“Data Subject”) that is Processed by the TokenEx as a Data Processor for Customer under this Agreement; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her identity.

(b) “Data Controller” shall mean the natural or legal person or entity which alone or jointly with others determines the purposes and means of the Processing for the purposes of this Agreement.

(c) “Data Processor” shall mean any natural or legal person or entity which processes Personal Data on behalf of and under the strict instructions of the Data Controller for the purposes of this Agreement.

(d) “Data Protection Legislation” means Regulation (EU) 2016/679 (the “GDPR”), in each case along with any national implementing laws, regulations and secondary or supplementary legislation, as amended or updated from time to time, in the EU or UK and any successor legislation to the GDPR, and all other applicable laws and regulations relating to the processing of personal data and privacy applicable to a Data Controller in the Member State in which the Data Controller is established, and amendments and re-enactments of the same, including where applicable the guidance and codes of practice issued by the Data Protection Regulator, and any applicable similar or analogous laws and regulations made outside the United Kingdom;

(e) “Data Protection Authority” means the Information Commissioner’s Office in the EU or UK; and

(f) “Process,” “Processed,” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction

(g) “Third Party” means any company, other than a TokenEx affiliate, which is engaged by TokenEx for the provision of the Services.

3. PROVISIONS RELATING TO PERSONAL DATA

3.1 Customer’s role and obligations. The parties expressly agree that Customer is the Data Controller for the Personal Data Processed for the purpose of the provision of the Services under this Addendum.   Customer, as Data Controller, shall ensure that any Customer Personal Data processed by TokenEx on Customer’s behalf for the purposes of this Addendum is processed in accordance with the Data Protection Regulation and complies with the principles stated in the GDPR.  Accordingly, Customer expressly guarantees:

(a) any Personal Data is processed on the basis of an adequate legal ground as permitted under the Data Protection Legislation.

(b) any Personal Data is processed for a defined, explicit and legitimate purpose.

(c) any Personal Data processed is relevant and non-excessive in consideration of the purpose of the processing.

(d) any Personal Data is and will be maintained accurate and up to date for the entire term of the provision of the Services under this Agreement.

(e) a term of retention has been defined for Personal Data, which is legitimate in consideration of the purpose of the processing and the nature of Personal Data processed.

(f) Complete, clear and accurate information is provided to the Data Subjects whose Personal Data is processed under this Addendum, including, if relevant, information about the fact that Personal Data may be transferred outside the European Economic Area;

(g) Data Subjects whose Personal Data is processed under this Addendum are granted adequate and effective means to exercise their rights with regards to the processing of their Personal Data in accordance with applicable legislation (access, rectification, update, erasure, etc. as applicable). TokenEx shall not be liable in cases where Customer fails to respond to the Data Subject’s request in total, correctly or in a timely manner.

(h) all adequate and necessary formalities, if any, or internal documentation, as per applicable Data Protection Legislation, have been completed with all competent authorities, completed or otherwise retained internally by Customer.

(i) Customer has conducted all relevant verifications and obtained all relevant information which it deems necessary regarding TokenEx and is satisfied that TokenEx provides sufficient guarantees to process Personal Data in accordance with the requirements of Data Protection Legislation.

(j) Customer shall maintain a current and up to date a register of data processing activity, and shall provide that register to TokenEx at least annually during the term of this Agreement.

3.2 Nothing in this Addendum or TokenEx’s ToS shall relieve TokenEx of its own direct responsibilities and liabilities under the Data Protection Legislation.

3.3 Customer’s Processing Instructions.  Schedule 1 sets out Customer’s documented instructions related to the scope, nature and purpose of processing of Personal Data by TokenEx, the duration of the processing, the types of Contract Personal Data and categories of Data Subject.  TokenEx shall not process Personal Data other than on Customer’s documented instructions (including the ToS) unless processing is required by applicable law to which TokenEx is subject, in which case TokenEx shall, unless prohibited by applicable law, inform Customer of that legal requirement before the relevant processing of that Personal Data.   Should Customer wish to implement modifications to its instructions, Customer shall notify TokenEx at least thirty (30) days in advance in order for both parties to evaluate Customer’s proposed modification. 

The parties expressly agree that Customer’s modifications to its instructions may have a direct impact on the delivery of the Services which may require a review and modification of the terms of the ToS and this Data Processing Addendum, including the financial terms.  If TokenEx cannot provide such compliance with Customer’s written instructions for whatever reasons, TokenEx agrees to promptly advise Customer of its inability to comply, in which case the Customer is entitled to review and amend its instructions to allow TokenEx to remain in compliance with its obligation.

Customer hereby expressly acknowledges and accepts that TokenEx shall not be bound by any Customer Instructions breaching applicable law (including Data Protection Legislation).  As such, TokenEx shall be entitled to suspend performance on such Instructions until Customer conforms or modifies such Instructions.  In such cases, TokenEx shall provide a prior notice to the Customer of such intended suspension.

3.4 TokenEx’s roles and obligation.  The parties expressly agree that Customer is the Data Controller and TokenEx is the Data Processor in the event TokenEx collects or otherwise processes (including to store) Personal Data on behalf of Customer when performing the Services.  Accordingly, TokenEx will:

(a) ensure that all persons authorised by TokenEx to process the Personal Data are under an enforceable obligation to keep Personal Data strictly confidential;

(b) adopt and maintain appropriate technical and organisational measures specified in Schedule 2 to ensure the Personal Data is kept secure, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, including but not limited to any specific measures agreed between Customer and TokenEx elsewhere in the Contract;

(c) subject to Section 4.1 (Customer Processing Instructions), only transfer the Personal Data in accordance with any reasonable written instructions set forth in Schedule 1 from Customer and take all further steps necessary to ensure that the transfer is and remains in accordance with the Data Protection Legislation;

(d) without limitation and notwithstanding any other obligation under the Agreement, TokenEx shall, (and shall ensure that any sub-processor shall), on request, provide all information and assistance reasonably required by Customer to enable Customer to comply with the Data Protection Legislation in relation to Personal Data, including but not limited to the exercise of the rights of Data Subjects to the extent TokenEx can reasonably have access to Data Subject Personal Information with regard to the Processing of Personal Data performed by TokenEx. Notwithstanding the foregoing, TokenEx shall not respond to any such Data Subject request, inquiry, complaint, or claim relating to Processing of Personal Data without Customer’s prior written consent except to the extent required by the Data Protection Legislation or reasonably necessary to confirm that the request relates to Customer.  TokenEx shall not be liable in cases where Customer fails to respond to the Data Subject’s request in total, correctly or in a timely manner;

(e) ensure that TokenEx has adequate processes and systems in place to comply with its obligations under Clause 2(d) above;

(f) TokenEx shall not communicate any Personal Data or subcontract whole or part of the Processing for the purpose of the provision of the Services under this Agreement to any Third Party (excluding, however, affiliates or authorized subcontractors as stated in Schedule 3 of this Addendum), unless TokenEx has the specific prior written consent of Customer, which shall not be unreasonably withheld. Where Customer objects to TokenEx’s use of such a Third Party subcontractor, Customer shall notify TokenEx in writing within 5 business days after receipt of TokenEx’s written request to appoint a Third Party subcontractor.  In the event Customer objects to a Third Party subcontractor, Customer shall justify its material or legal reasons for such objection.

(g) not modify, amend or alter the contents of the Personal Data or disclose or permit the disclosure of any of the Personal Data to any third party unless specifically approved in advance in writing by Customer;

(h) immediately notify Customer with full details if TokenEx:

(i) becomes aware of any breach of the Data Protection Legislation in relation to the Agreement;

(ii) except as prohibited by the Data Protection Legislation, believes that instructions provided by Customer in respect to the processing of Personal Data are contrary to or would require it to act in a way contrary to the Data Protection Legislation and/or applicable law. Customer shall adapt its instructions in order to comply with such legislation. Such modifications may have a direct impact on the delivery of Services which may require a review and modification of the terms of this Agreement, including, notably, the scope of the Services and the financial terms, to the terms of the Agreement as necessary, including notably, the term of implementation of requested modifications.  In any event, Customer hereby expressly acknowledges and accepts that TokenEx shall not be bound by any Customer instructions breaching applicable law (including applicable Data Protection Legislation).  As such, TokenEx shall be entitled to suspend performance on such instructions until Customer conforms or modifies such instructions.  In such a case, TokenEx shall provide a prior notice to Customer of such intended suspension; or

(iii) subject to Section 4.3(d), receives any request (including from a Data Subject or the Data Protection Regulator) to disclose any Personal Data; provided TokenEx shall not directly respond to such requests except as duly and expressly agreed between the parties as part of the Services under the Agreement;

(i) upon no less than thirty (30) days’ written notice by Customer:

(i) make available to Customer all such information as is reasonably necessary to demonstrate TokenEx’s compliance with Data Protection Legislation;

(ii) shall allow Customer to carry out or have an independent duly appointed third party for its auditing functions, any of whom shall be bound by a strict obligation of confidentiality, to perform an audit of TokenEx’s processing facilities in order to ensure the compliance with the obligations set forth in this Addendum.  TokenEx shall be entitled to reject third party auditors which are competitors of TokenEx.  Such audit operations shall not exceed a period of twelve (12) hours per year, shall occur not more than once per year, shall not hinder or otherwise disrupt in any way TokenEx’s operations or business activities and shall only relate to that part of the relevant infrastructure which processes Customer’s Personal Data.  TokenEx’s assistance in relation to such activity shall be invoiced at TokenEx’s then applicable rates; and

(iii) provide, at Customer’s cost and during normal business hours, all reasonable co-operation, access and assistance in the carrying out of such an audit, and allow Customer the right to take copies of the records or any information relevant to its audit;

(j) notwithstanding any agreed retention periods applicable to Personal Data in the Agreement, on termination of the Agreement, at Customer’s sole election, TokenEx will provide all Personal Data to Customer and/or permanently delete such Personal Data, save where applicable law requires TokenEx to retain Personal Data, in which case TokenEx shall provide Customer with written particulars of any Personal Data so retained. This sub-clause 2(j)shall survive termination of the Agreement.

3.5 Transfers of Customer Personal Data to Third Party Countries. By entering into the Agreement, Customer hereby expressly acknowledges and accepts that Customer Personal Data may be transferred and/or processed by TokenEx, which headquarters are located outside the European Economic Area. 

TokenEx is bound by Model Clauses as approved by the European data protection authorities and as attached as Schedule 4 of this Addendum. 

For purposes of this Agreement, TokenEx commits to comply with and be bound by the terms of the Model Clauses.  Accordingly, Customer hereby expressly consents that Customer Personal Data may be transferred to TokenEx. TokenEx commits to provide adequate information to Data Subjects regarding use of TokenEx as processor which is available at https://www.tokenex.com/privacy-policy/.

Upon written request from Customer, TokenEx shall provide Customer with a list of subcontractors used by TokenEx for the provision of the Services.

TokenEx shall ensure that Third Party subcontractors provide an adequate level of protection to Customer Personal Data.  For that purpose, TokenEx commits that any duly authorized subcontractor brought to process Personal Data outside the European Economic Area shall enter into and comply with the obligations set out in appropriate standard contractual clauses for the transfer of Personal Data as set out by the European Commission (or any competent authority) with Customer or with TokenEx, in accordance with the mandate granted above.

3.6 Parties’ compliance with Laws. The TokenEx warrants to Customer and Customer warrants to TokenEx that it will fully comply with the provisions of the Data Protection Legislation in carrying out its obligations under the Contract.

4. This Data Processing Addendum has been signed on behalf of each of the parties by a duly authorised signatory.

SCHEDULE 1
CUSTOMER’S WRITTEN INSTRUCTIONS FOR THE PROCESSING OF PERSONAL DATA

This Schedule 1 forms part of the Data Processing Addendum and is incorporated therein.

The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Schedule.

Data Controller

For the purposes of the Data Processing Addendum, the Data Controller is

________________________________.

Data Controller (please specify briefly your activities relevant to the transfer), intend to transfer Personal Data of their customers and customers of their Customers to TokenEx., whose servers are located in the United States and the European Union, for data hosting and storage purposes, as well as web portal hosting services.

Data Processor

The Data Processor is TokenEx, Inc.

The Data Processor, TokenEx, is a provider of data security services (the “Platform”) which processes Personal Data in accordance with the terms of the Agreement. The core purpose of the Platform is to provide data security services in order to allow Platform users authorized by the Data Controller to manage and administer its data.

Data Subjects

The personal data transferred concern the following categories of data subjects (please specify):

• Current and former customers and customers of clients and business partners and vendors of data controller (who are natural persons)

• Employees, agents, advisors, freelancers of Data Controller (who are natural persons)

• Data controller’s Users authorized by data controller to use the TokenEx Services

• _______________________________________

• _______________________________________

• _______________________________________

Categories of data

The personal data transferred concern the following categories of data (please specify):

The following data categories are associated with Account Data:

• First and last name

• Contact details (e.g., email, phone, physical address)

• Salutation

The following data categories are associated with Services Data: [please enumerate]

• _______________________________________

• _______________________________________

• _______________________________________

• _______________________________________

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data (please specify):

• _______________________________________

• _______________________________________

• _______________________________________

Processing operations

The personal data transferred will be subject to the following basic processing activities (please specify):

• The purpose of the data processing is to provide global data hosting and storage, as well web application hosting services.

• The Data Processor will, through authorized personnel perform the following processing services:

  • provide the Services pursuant to the terms of the Agreement;

  • maintain storage of the Data Controller’s personal data that is contained within TokenEx’s Services;

  • enable the Data Controller to access, modify, enhance and/or delete its personal data maintained on or within TokenEx’s Services;

  • prevent unauthorized access to or modification of the Data Controller’s personal data by Data Processor’s employees;

  • enable the Data Controller to generate standardized reports and analysis regarding its personal data.

• The Data Processor shall not make any copy of the personal data without informing the Data Controller, unless it is a security copy required to duly perform the data processing, or unless it is required to comply with applicable statutory retention periods.

• As soon as the parties agree that the Data Processor shall cease the provision of the data processing services, the Data Controller may extract the transferred personal data and the Data Processor shall delete such data, or otherwise comply with the instructions of Data Controller, as provided in the Agreement.

SCHEDULE 2

TOKENEX’S TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES FOR THE PROCESSING OF PERSONAL DATA

This Schedule 2 forms part of the Data Processing Addendum and is incorporated into the Data Processing Addendum.

Description of the technical and organizational security measures implemented by the Data Processor in accordance with Section 4.2(b) of the Data Processing Addendum:

Data Processor will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to the TokenEx secure customer portal and stored on other TokenEx controlled systems including the secure virtual servers provided by TokenEx for Customer to store Customer Services Data.

TokenEx maintains an information security program that has been certified against the ISO/IEC 27001:2013 standard.  The program includes an information security policy, and other corporate policies and procedures that are designed to give TokenEx the capability to protect non-public personal information consistent with applicable federal, state, and international regulations.  In addition to ISO 27001 certification, TokenEx also holds unqualified SSAE 16 SOC 2 Type II reports that further validate TokenEx’s information security program.

Users of confidential and private information within TokenEx aim to keep the volume of such material to a reasonable level in proportion to the business responsibilities and services being delivered to customers, employees, and other parties.

Personnel security measures include employees undergoing a multi-component background check as part of the hiring process in accordance with applicable law. Employees are required to sign confidentiality and non-disclosure agreements as a condition of employment.

Vendor management procedures are in place to review contractors, business partners, and vendors that will have access to confidential information.

TokenEx’s secure cloud hosting environments, including all of the Services TokenEx provides to customers, have been validated against the Payment Card Industry Data Security Standard v3.2 and the HITRUST CSF.  These validations require controls designed to help protect the confidentiality and integrity of Customer Services Data.  These controls include the following:

• IP Reputation Management

• DoS/DDoS mitigation

• Web Application Firewalls

• Network Intrusion Detection (NIDS)

• Hypervisor based network firewall resident on each Customer virtual server

• Managed anti-malware/anti-virus protection

• Operating system file integrity monitoring

• Operating system patching

• Operating system log management

TokenEx provides for only secure, encrypted remote access by Customer for administrative access to its servers and controls TokenEx support staff access to Customer servers for support purposes via secure, two factor authenticated jump servers and a privileged access management system that logs and fully records each TokenEx session. 

Data Processor will not materially decrease the overall security of the TokenEx Services during the Term.

SCHEDULE 3

SUBCONTRACTORS WHO PROCESS PERSONAL DATA ON BEHALF OF DATA PROCESSOR

This Schedule 3 forms part of the Data Processing Addendum and is incorporated therein.

Description of the subcontractors used by the Data Processor and the purposes for which the subcontractor’s services are utilized in accordance with Section 4.2(f) of the Data Processing Addendum:

TokenEx, Inc. Data Processing Addendum Download

Business Associate Agreement

TokenEx and the entity identified in the text box below, on behalf of itself and any of its affiliates and subsidiaries providing services to TokenEx (collectively “Subcontractor”), agree to the following terms (the “Agreement”). TokenEx and Subcontractor each are referred to as a “Party” and collectively as the “Parties”. Capitalized terms contained in the text box below (“Text Box”) shall have the meaning specified in the Text Box. This Agreement shall commence on the Effective Date, as set forth in the Text Box. If no Effective Date is set forth in the Text Box, the Effective Date shall occur when this Agreement has been signed by both Parties.

WHEREAS, pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), the U.S. Department of Health & Human Services (“HHS”) promulgated the Privacy Standards, the security standards at 45 C.F.R. Parts 160 and 164, Subparts A and C (the “Security Standards”), and the breach notification standards at 45 C.F.R. Part 164, Subpart D (the “Breach Notification Standards”) requiring certain individuals and entities subject to these standards to protect the privacy and security of certain individually identifiable health information including electronic individually identifiable health information;

WHEREAS, the Parties wish to comply with Privacy Standards, Security Standards, and Breach Notification Standards as may be revised or amended by HHS from time to time;

WHEREAS, in connection with Subcontractor’s performance under its agreement(s) and/or other documented arrangements between Subcontractor and TokenEx, whether in effect as of the Effective Date or which become effective at any time during the term of this Agreement (collectively “Business Arrangements”), Subcontractor may provide services for or on behalf of TokenEx that requires Subcontractor to use, disclose, receive, access, create, maintain and/or transmit health information that is protected by state and/or federal law; and

WHEREAS, Subcontractor and TokenEx desire that Subcontractor obtain access to PHI and EPHI in accordance with the terms specified herein;

NOW, THEREFORE, in consideration of the mutual promises set forth in this Agreement and the Business Arrangements, and other good and valuable consideration, the sufficiency and receipt of which are hereby severally acknowledged, the Parties agree as follows:

1. Business Associate Obligations.

In accordance with this Agreement and the Business Arrangements, Subcontractor may use, disclose, access, create, maintain, transmit and/or receive on behalf of  TokenEx health information that is protected under applicable state and/or federal law, including without limitation, PHI and EPHI.  Subcontractor acknowledges and agrees it meets the definition of a “business associate” at 45 C.F.R. §160.103.  All capitalized terms not otherwise defined in this Agreement or in the Text Box shall have the meanings set forth in the Privacy Standards, Security Standards, the Breach Notification Standards, HIPAA or the HITECH Act, as applicable and as may be amended from time to time (collectively referred to hereinafter as the “Confidentiality Requirements”).  PHI shall mean any and all Protected Health Information, including Electronic Protected Health Information that Subcontractor (or its Agents, as defined in Section 3.2) uses, discloses, accesses, creates, maintains, transmits and/or receives for or on behalf of TokenEx pursuant to the Business Arrangements. “EPHI” shall mean PHI transmitted or maintained in electronic media. The Parties hereby acknowledge that the definition of PHI includes “Genetic Information” as set forth at 45 C.F.R. §160.103.  To the extent the Subcontractor is to carry out an obligation of TokenEx under the Confidentiality Requirements, the Subcontractor shall comply with the provision(s) of the Confidentiality Requirements that would apply to TokenEx (as applicable) in the performance of such obligation(s).

2. Use of PHI.

Except as otherwise Required By Law, Subcontractor shall use PHI in compliance with this Agreement and 45 C.F.R. §164.504(e).  Subcontractor agrees not to use (or permit the use) of PHI in a manner that would violate the Confidentiality Requirements if the PHI were used by TokenEx in the same manner.  Furthermore, Subcontractor shall use PHI:  (i) solely for the benefit of TokenEx and only for the purpose of performing services for or on behalf of  TokenEx as such services are defined in the Business Arrangements; and (ii) as necessary for the proper management and administration of Subcontractor or to carry out its legal responsibilities; provided that such uses are permitted under federal and applicable state law.   TokenEx shall retain all rights in the PHI not granted herein.  Except as necessary to perform services  TokenEx under the Business Arrangements, Subcontractor may not de-identify PHI or other identifiable data without the express written authorization of  TokenEx.  All de-identification of PHI must be performed in accordance with the Confidentiality Requirements, specifically, 45 C.F.R. §164.514(b).

3. Disclosure of PHI.

3.1 Subject to any limitations in this Agreement, Subcontractor may disclose PHI to any third party as necessary to perform its obligations under the Business Arrangements and as permitted or required by applicable law. Subcontractor agrees not to disclose (or permit the disclosure of) PHI in a manner that would violate the Confidentiality Requirements if the PHI was disclosed by TokenEx in the same manner. Further, Subcontractor may disclose PHI for the proper management and administration of Subcontractor; provided that: (i) such disclosures are required by law; or (ii) Subcontractor: (a) obtains reasonable assurances from any third party to whom the PHI is disclosed that the PHI will be held confidential and used and disclosed only as required by law or for the purpose for which it was disclosed to the third party; and (b) requires the third party to agree to immediately notify Subcontractor of any instances of which it is aware that PHI is being used or disclosed for a purpose that is not otherwise provided for in this Agreement or for a purpose not expressly permitted by the Confidentiality Requirements.  Subcontractor shall report to TokenEx any use or disclosure of PHI not permitted by this Agreement of which it becomes aware.  Such report shall be made within five (5) business days of Subcontractor becoming aware of such use or disclosure and, if known to Subcontractor, Subcontractor shall identify in writing for TokenEx the PHI impacted by and scope of impact of such use or disclosure. 

3.2 If Subcontractor uses or contracts with any agent, including a subcontractor (collectively, “Vendor Subcontractors”) that uses, discloses, creates, accesses, receives, maintains or transmits PHI on behalf of the Subcontractor, Subcontractor shall require its Vendor Subcontractors to agree in writing to the same restrictions and conditions that apply to Subcontractor under this Agreement, including but not limited to 45 C.F.R. §§164.314, 164.410, 164.502 and 164.504(e). In addition to Subcontractor’s obligations under Section 9, Subcontractor agrees to mitigate, to the extent practical and unless otherwise requested by TokenEx in writing, any harmful effect that is known to Subcontractor and is the result of a use or disclosure of PHI by Subcontractor or any of its Vendor Subcontractors in violation of this Agreement.  Additionally, Subcontractor shall ensure that all disclosures of PHI by Subcontractor and its Vendor Subcontractors comply with the principle of “minimum necessary use and disclosure,” (i.e., in accordance with 45 C.F.R. §164.502(b), only the minimum PHI that is necessary to accomplish the intended purpose may be disclosed).

4. Individual Rights Regarding Designated Record Sets.

If Subcontractor maintains a Designated Record Set on behalf of TokenEx, Subcontractor shall:  (i) provide access to and permit inspection and copying of PHI by TokenEx, as required under 45 C.F.R. §164.524, as it may be amended from time to time; and (ii) amend PHI maintained by Subcontractor as requested by TokenEx.  Subcontractor shall respond to any request from TokenEx for access by an Individual within five (5) business days of such request and shall make any amendment requested by TokenEx within ten (10) business days of such request.  Any information requested under this Section 4 shall be provided in the form or format requested, if it is readily producible in such form or format.  Subcontractor may charge a reasonable fee based upon Subcontractor’s labor costs in responding to a request for electronic information (or a cost-based fee for the production of non-electronic media copies).  Subcontractor shall notify TokenEx within five (5) business days of receipt of any request for access or amendment by an Individual.  TokenEx, not Subcontractor, shall determine whether to grant or deny any access to or amendment of PHI requested by an Individual, provided that nothing in this Agreement shall restrict Subcontractor’s ability to provide access or a copy of PHI as provided for by Section 13405(e) of HITECH, as amended, or any regulations promulgated pursuant to such provision in compliance with the Confidentiality Requirements.  Subcontractor shall have a process in place for receiving requests for amendments and for appending such requests to the Designated Record Set when requested by TokenEx.

5. Accounting of Disclosures.

Subcontractor shall make available, within twenty (20) business days of a request by TokenEx for information required for an accounting of disclosures of PHI in accordance with 45 C.F.R. §164.528 (or such shorter time as may be required by state or federal law).  Such accounting must be provided without cost if it is the first accounting requested within any twelve (12) month period.  For subsequent accountings within the same twelve (12) month period, Subcontractor may charge a reasonable fee based upon Subcontractor’s labor costs in responding to a request for electronic information (or a cost-based fee for the production of non-electronic media copies) only after Subcontractor informs TokenEx and TokenEx informs the Individual in advance of the fee, and the Individual is afforded an opportunity to withdraw or modify the request.  Such accounting obligations shall survive the expiration or termination of this Agreement and with respect to any disclosure, whether on or before the termination of this Agreement, shall continue for a minimum of seven (7) years following the date of such disclosure.

6. Withdrawal of Authorization.

If the use or disclosure of PHI under this Agreement is based upon an Individual’s specific authorization regarding the use of his or her PHI, and: (i) the Individual revokes such authorization in writing; (ii) the effective date of such authorization has expired; or (iii) the authorization is found to be defective in any manner that renders it invalid for whatever reason, then Subcontractor agrees, if it has received notice from TokenEx regarding such revocation or invalidity, to cease the use and disclosure of any such Individual’s PHI except to the extent Subcontractor has relied on such use or disclosure, or where an exception under the Confidentiality Requirements expressly applies.

7. Records and Audit.

Subcontractor shall make available to HHS or its agents its internal practices, books, and records reasonably relating to the compliance of Subcontractor and TokenEx with the Confidentiality Requirements, such internal practices, books and records to be provided in the time and manner designated by HHS or its agents.  Except to the extent prohibited by law, Subcontractor agrees to notify TokenEx immediately upon receipt by Subcontractor of any and all requests by or on behalf of any and all federal, state, and local government authorities served upon Subcontractor requesting PHI or investigating compliance with the Confidentiality Requirements.

8. Implementation of Security Standards; Notice of Security Incidents.

Subcontractor will comply with the Security Standards and, by way of example and not limitation, use appropriate safeguards to prevent the use or disclosure of PHI other than as expressly permitted under this Agreement.  In accordance with the Security Standards, Subcontractor will implement administrative, physical, and technical safeguards that protect the confidentiality, integrity and availability of the PHI that it uses, discloses, accesses, creates, receives, maintains or transmits.  To the extent feasible, Subcontractor will use commercially reasonable efforts to ensure that the technology safeguards used by Subcontractor to secure PHI will render such PHI unusable, unreadable and indecipherable to individuals unauthorized to acquire or otherwise have access to such PHI in accordance with HHS Guidance published at 74 Federal Register 19006 (April 17, 2009) or such later regulations or guidance promulgated by HHS or issued by the National Institute for Standards and Technology (“NIST”) concerning the protection of identifiable data such as PHI.  Subcontractor will promptly report to TokenEx any Security Incident of which it becomes aware; provided, however, that TokenEx acknowledges and shall be deemed to have received notice from Subcontractor that there are routine occurrences of: (i) unsuccessful attempts to penetrate computer networks or services maintained by Subcontractor; and (ii) immaterial incidents such as “pinging” or “denial of services” attacks.  At the request of TokenEx, Subcontractor shall identify:  the date of the Security Incident, the scope of the Security Incident, Subcontractor’s response to the Security Incident, and to the extent permitted by law, the identification of the party responsible for causing the Security Incident, if known.

9. Data Breach Notification and Mitigation.

9.1 HIPAA Data Breach Notification and Mitigation. Subcontractor agrees to implement reasonable systems for the discovery and prompt reporting of any “breach” of “unsecured PHI” as those terms are defined by 45 C.F.R. §164.402 (“HIPAA Breach”).  The Parties acknowledge that 45 C.F.R. §§164.404 and 164.410, as described below in this Section 9.1, govern the determination of the date of a HIPAA Breach.  In the event of any conflict between this Section 9.1 and the Confidentiality Requirements, the more stringent requirements shall govern.  Following the discovery of a HIPAA Breach, Subcontractor will notify TokenEx immediately and in no event later than five (5) business days after Subcontractor discovers such HIPAA Breach unless Subcontractor is prevented from doing so by 45 C.F.R. §164.412 concerning law enforcement investigations.  If known to Subcontractor, Subcontractor shall identify in writing for TokenEx the data impacted by and scope of impact of a HIPAA Breach (e.g., Individuals from which the PHI that was subject to the HIPAA Breach originated and/or databases, instances, etc. impacted by the HIPAA Breach) no later than five (5) business days following a HIPAA Breach.  For purposes of reporting a HIPAA Breach to TokenEx, the discovery of a HIPAA Breach shall occur as of the first day on which such HIPAA Breach is known to Subcontractor, or, by exercising reasonable diligence would have been known to Subcontractor.  Subcontractor will be considered to have had knowledge of a HIPAA Breach if the HIPAA Breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the HIPAA Breach) who is an employee, officer or other agent of Subcontractor.  No later than seven (7) business days following a HIPAA Breach, Subcontractor shall provide TokenEx with sufficient information to permit TokenEx to comply with the HIPAA Breach notification requirements set forth at 45 C.F.R. §164.400 et seq.  Additionally, if the following information is known to (or can be reasonably obtained by) Subcontractor, Subcontractor will provide TokenEx with:  (i) contact information for Individuals who were or who may have been impacted by the HIPAA Breach (e.g., first and last name, mailing address, street address, phone number, email address); (ii) a brief description of the circumstances of the HIPAA Breach, including the date of the HIPAA Breach and date of discovery; (iii) a description of the types of unsecured PHI involved in the HIPAA Breach (e.g., names, social security number, date of birth, address(es), account numbers of any type, disability codes, diagnostic and/or billing codes and similar information); (iv) a brief description of what Subcontractor has done or is doing to investigate the HIPAA Breach, mitigate harm to the Individual impacted by the HIPAA Breach, and protect against future HIPAA Breaches; and (v) appoint a liaison and provide contact information for same so that TokenEx may ask questions or learn additional information concerning the HIPAA Breach.  Following a HIPAA Breach, Subcontractor will have a continuing duty to inform TokenEx of new information learned by Subcontractor regarding the HIPAA Breach, including but not limited to the information described in items (i) through (v) above.  This Section 9.1 shall survive the expiration or termination of this Agreement and shall remain in effect for so long as Subcontractor maintains PHI.

9.2 Data Breach Notification and Mitigation Under Other Laws. In addition to the requirements of Section 9.1, Subcontractor agrees to implement reasonable systems for the discovery and prompt reporting of any breach of individually identifiable information (including but not limited to PHI and referred to hereinafter as “Individually Identifiable Information”) that, if misused, disclosed, lost or stolen, would trigger an obligation under one or more State data breach notification laws (each a “State Breach”) to notify the individuals who are the subject of the information.  Subcontractor agrees that in the event any Individually Identifiable Information is lost, stolen, used or disclosed in violation of one or more State data breach notification laws, Subcontractor shall promptly:  (i) notify TokenEx within five (5) business days of such State Breach; (ii) if known to Subcontractor, identify in writing for TokenEx the individuals impacted by and scope of impact of any State Breach (e.g., individuals from which the Individually Identifiable Information that was subject to a State Breach originated and/or databases, instances, etc. impacted by the State Breach) no later than five (5) business days following such State Breach; (iii) cooperate and assist TokenEx with any investigation into any State Breach or alleged State Breach; (iv) cooperate and assist TokenEx with any investigation into any State Breach or alleged State Breach conducted by any State Attorney General or State Consumer Affairs Department (or their respective agents); (v) cooperate with TokenEx regarding the respective obligations of TokenEx and Subcontractor to mitigate to the extent practicable any potential harm to the individuals impacted by the State Breach; and (vi) assist with the implementation of any decision by any State agency, including any State Attorney General or State Consumer Affairs Department (or their respective agents), to notify individuals impacted or potentially impacted by a State Breach.  This Section 9.2 shall survive the expiration or termination of this Agreement and shall remain in effect for so long as Subcontractor maintains PHI or Individually Identifiable Information.

9.3 Breach Indemnification. Subcontractor shall indemnify, defend and hold TokenEx and their respective officers, directors, employees, agents, successors and assigns harmless from and against any and all losses, claims, actions, demands, liabilities, damages, costs and expenses (including costs of judgments, settlements, court costs and reasonable attorneys’ fees actually incurred) (collectively “Information Disclosure Claims”) arising from or related to: (i) the use or disclosure of Individually Identifiable Information (including PHI) in violation of the terms of this Agreement or applicable law; and (ii) whether in oral, paper or electronic media, any HIPAA Breach of unsecured PHI and/or State Breach of Individually Identifiable Information.  If Subcontractor assumes the defense of an Information Disclosure Claim,  TokenEx shall  have the right, at its expense, to participate in the defense of such Information Disclosure Claim.  Subcontractor shall not take any final action with respect to any Information Disclosure Claim without the prior written consent of TokenEx.  To the extent permitted by law, Subcontractor shall be fully liable to TokenEx for any acts, failures or omissions of its Vendor Subcontractors and agents in furnishing the services as if they were Subcontractor’s own acts, failures or omissions.  For purposes of this Section 9.3, PHI and Individually Identifiable Information shall refer to PHI and Individually Identifiable Information used, disclosed, accessed, created, maintained, received or transmitted by, and/or under the direction or control of, Subcontractor and/or its Vendor Subcontractors at the time of any HIPAA Breach and/or State Breach.  This Section 9.3 shall survive the expiration or termination of this Agreement and shall remain in effect for so long as Subcontractor maintains PHI or Individually Identifiable Information.

10. Term and Termination.

10.1 Termination. This Agreement shall remain in effect until terminated in accordance with the terms of this Section 10; provided, however, that termination shall not affect the respective obligations or rights of the Parties arising under this Agreement prior to the effective date of termination, all of which shall continue in accordance with their terms.

10.2 Termination without Cause. TokenEx shall have the right to terminate this Agreement for any reason upon thirty (30) days written notice to Subcontractor.

10.3 Termination with Cause. Either Party may immediately terminate this Agreement as set forth in this Section 10.3 (the “Terminating Party”) and shall have no further obligations to the other Party (the “Terminated Party”) hereunder if either of the following events shall have occurred and are continuing:

a. The Terminated Party fails to observe or perform any material covenant or obligation contained in this Agreement for ten (10) days after written notice thereof has been given to the Terminated Party;

b. A material violation by the Terminated Party of any provision of the Confidentiality Requirements or applicable federal or state privacy law relating to the obligations of the Terminated Party under this Agreement.

10.4 TokenEx May Terminate Business Arrangements if Subcontractor is Terminated for Cause. Termination of this Agreement for either of the two reasons set forth in Section 10.3 above shall be cause for TokenEx to immediately terminate for cause any Business Arrangement pursuant to which Subcontractor uses, discloses, accesses, receives, creates, maintains or transmits PHI for or on behalf of TokenEx.

10.5 Termination Upon Conclusion of Business Arrangements. Upon the expiration or termination of all Business Arrangements, either TokenEx or Subcontractor may terminate this Agreement by providing written notice to the other Party.

10.6 Return of PHI Upon Termination. Upon termination of this Agreement for any reason, Subcontractor agrees either to return all PHI or to destroy all PHI received from  TokenEx or otherwise through the performance of services under the Business Arrangements that is in the possession or control of Subcontractor or its Subcontractors.  In the case of PHI for which it is not feasible to return or destroy, Subcontractor shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Subcontractor maintains such PHI.  Subcontractor shall comply with other applicable state or federal law, which may require a specific period of retention, redaction, or other treatment of such PHI.  This Section 10.6 shall survive the expiration or termination of this Agreement and shall remain in effect for so long as Subcontractor maintains PHI.

11. No Warranty.

PHI IS PROVIDED TO SUBCONTRACTOR SOLELY ON AN “AS IS” BASIS.   TOKENEX DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

12. Ineligible Persons.

Subcontractor represents and warrants that Subcontractor and its directors, officers, and key employees:  (i) are not currently excluded, debarred, or otherwise ineligible to participate in the federal health care programs as defined in 42 U.S.C. §1320a-7b(f) or any state healthcare program (collectively, the “Healthcare Programs”); (ii) have not been convicted of a criminal offense related to the provision of healthcare items or services but have not yet been excluded, debarred, or otherwise declared ineligible to participate in the Healthcare Programs; and (iii) are not under investigation or otherwise aware of any circumstances which may result in Subcontractor being excluded from participation in the Healthcare Programs (collectively, the “Warranty of Non-exclusion”). Subcontractor’s representations and warranties underlying the Warranty of Non-exclusion shall be ongoing during the Term, and Subcontractor shall immediately notify TokenEx of any change in the status of the representations and warranties set forth in this Section 12.  Any breach of this Section 12 shall give TokenEx the right to terminate this Agreement immediately.

13. Waiver.

No provision of this Agreement or any breach thereof shall be deemed waived unless such waiver is in writing and signed by the Party claimed to have waived such provision or breach. No waiver of a breach shall constitute a waiver for excuse any different or subsequent breach.

14. Assignment.

Neither Party may assign (whether by operation or law or otherwise) any of its rights or delegate or subcontract any of its obligations under this Agreement without the prior written consent of the other Party.  Notwithstanding the foregoing, TokenEx shall have the right to assign its rights and obligations hereunder to any entity that is an affiliate or successor of TokenEx, whether by merger, acquisition, change in control, or other transaction involving the sale of all or substantially all of TokenEx’s’ assets, without the prior approval of Subcontractor.

15. Severability.

Any provision of this Agreement that is determined to be invalid or unenforceable will be ineffective to the extent of such determination without invalidating the remaining provisions of this Agreement or affecting the validity or enforceability of such remaining provisions.

16. Governing Law.

This Agreement shall be governed by and interpreted in accordance with the laws of the state of Delaware, excluding its conflicts of laws provisions. Any disputes arising out of this Agreement shall be subject to binding and final arbitration, pursuant to the Federal Arbitration Act (as amended from time to time).

17. Equitable Relief.

Subcontractor understands and acknowledges that any disclosure or misappropriation of any PHI in violation of this Agreement will cause TokenEx irreparable harm, the amount of which may be difficult to ascertain, and therefore agrees that TokenEx shall have the right to apply to a court of competent jurisdiction for specific performance and/or an order restraining and enjoining any such further disclosure or breach and for such other relief as TokenEx shall deem appropriate.  Such right of TokenEx is to be in addition to the remedies otherwise available to TokenEx at law or in equity.  Subcontractor expressly waives the defense that a remedy in damages will be adequate and further waives any requirement in an action for specific performance or injunction for the posting of a bond by TokenEx.

18. Nature of Agreement; Independent Contractor.

Nothing in this Agreement shall be construed to create: (i) a partnership, joint venture or other joint business relationship between the Parties or any of their affiliates or TokenEx’s; or (ii) a relationship of employer and employee between the Parties.  Subcontractor is an independent contractor and not an agent of TokenEx.  This Agreement does not express or imply any commitment to purchase or sell goods or services.

19. Counterparts; Execution.

This Agreement and any amendments hereto may be executed by the Parties hereto individually or in any combination, in one or more counterparts, each of which shall be an original and all of which shall together constitute one and the same agreement.  Execution and delivery of this Agreement and any amendments by the Parties shall be legally valid and effective through (i) executing and delivering the paper copy of the document, (ii) transmitting the executed paper copy of the document by facsimile transmission, or electronic mail in “portable document format” (“.pdf”) or other electronically scanned format, or (iii) creating, generating, sending, receiving or storing by electronic means this Agreement and any amendments, the execution of which is accomplished through use of an electronic process and executed or adopted by a Party with the intent to execute this Agreement (i.e., “electronic signature” through a process such as DocuSign®).

20. Entire Agreement.

This Agreement constitutes the complete agreement between Subcontractor and TokenEx relating to the matters specified in this Agreement and supersedes all prior representations or agreements, whether oral or written, with respect to such matters.  In the event of any conflict between the terms of this Agreement and the terms of the Business Arrangements or any such later agreement(s), the terms of this Agreement shall control unless the terms of such Business Arrangements are stricter with respect to PHI and comply with the Confidentiality Requirements, or the Parties specifically otherwise agree in writing.  No oral modification or waiver of any of the provisions of this Agreement shall be binding on either Party to this Agreement or on TokenEx; provided, however, that upon the enactment of any law, regulation, court decision or relevant government publication and/or interpretive guidance or policy that TokenEx believes in good faith will adversely impact the use or disclosure of PHI under this Agreement, TokenEx may amend the Agreement to comply with such law, regulation, court decision or government publication, guidance or policy by delivering a written amendment to Subcontractor which shall be effective thirty (30) calendar days after receipt and written acceptance by TokenEx, not to be unreasonably withheld.  No obligation on either Party to enter into any transaction is to be implied from the execution or delivery of this Agreement. This Agreement is for the benefit of, and shall be binding upon the Parties, their affiliates and respective successors and assigns.

21. Notice.

All notices, requests, demands and other communications required or permitted to be given or made under this Agreement shall be in writing, shall be effective upon receipt or attempted delivery, and shall be sent by:  (i) personal delivery; (ii) certified or registered United States mail, return receipt requested; (iii) overnight delivery service with proof of delivery; or (iv) facsimile with return facsimile acknowledging receipt.  Notices shall be sent to the addresses below.  No Party to this Agreement shall refuse delivery of any notice hereunder.

Business Associate Agreement Download