1. California Privacy Rights Act (“CPRA”)

The following terms used in this Agreement shall have the same meanings as those terms in the California Privacy Rights Act of 2020 (the “CPRA”), respectively: Business, Business Purpose, Collects, Commercial Purpose, Consumer, Contractor, Cross-Context Behavioral Advertising, Person, Personal Information, Process, Sell, Sensitive Personal Information, Service Provider, and Share.

2. Pursuant to the terms of this Agreement:

Mitigately is a Person to that Processes Personal Information on behalf of Clarity Debt Resolution, Inc.  Clarity Debt Resolution, Inc. (“Clarity”) is a person to which Mitigately makes available Consumer’s Personal Information for a Business Purpose pursuant to the Agreement.  

The Personal Information is disclosed by Mitigately for the specified purposes under the Agreement.  

3. Mitigately is prohibited from: (a) Selling or Sharing Personal Information that it Collects pursuant to the Agreement, (b) retaining, using, or disclosing (i) such Personal Information that Mitigately Collected pursuant to the Agreement for any purpose other than for the Business Purposes specified in the Agreement as set forth on Schedule 1 attached hereto or as otherwise permitted by the CPRA or the CPRA regulations, (ii) the Personal Information that Mitigately and Clarity Collected pursuant to the Agreement outside the direct business relationship between Mitigately and Clarity, unless expressly permitted by the CPRA or the CPRA regulations, and (iii) the Personal Information that Mitigately Collected pursuant to the Agreement for any Commercial Purpose, other than the Business Purposes specified in the Agreement or as otherwise permitted by the CPRA and the CPRA regulations, (c) combining or updating Personal Information that Mitigately Collected pursuant to the Agreement with Personal Information that Mitigately received from another source or Collected from Clarity’s own interaction with the Consumer, unless expressly permitted by the CPRA or the CPRA regulations, and (d) providing Cross-Context Behavioral Advertising under the Agreement Mitigately hereby certifies that Mitigately understands the foregoing restrictions in this Section and will comply with them.

4. Clarity shall: (a) comply with all applicable sections of the CPRA and the CPRA regulations, including, with respect to the Personal Information that Clarity Collected pursuant to the Agreement, providing the same level of privacy protection as required of Businesses by the CPRA and the CPRA regulations, (b) notify Mitigately in writing if Clarity makes a determination that it can no longer meet Clarity’s obligations under the CPRA and the CPRA regulations, (c) cooperate with Mitigately in responding to and complying with Consumers’ requests made pursuant to the CPRA, and (d) enable Mitigately to comply with consumer requests made pursuant to the CPRA or require Mitigately to inform Clarity of any Consumer request made pursuant to the CPRA that Clarity must comply with and provide the information necessary for Clarity to comply with the request.

5. Mitigately is granted the right: (a) to take reasonable and appropriate steps to ensure that Clarity uses the Personal Information that Clarity Collected pursuant to the Agreement in a manner consistent with Mitigately’s obligations under the CPRA and the CPRA regulations, and (b) upon notice, to take reasonable and appropriate steps to stop and remediate Clarity’s unauthorized use of Personal Information.

6. Clarity is only required to limit its use of Sensitive Personal Information received pursuant to the Agreement in response to instructions from Mitigately and only with respect to Clarity’s relationship with Mitigately.  

7. Clarity, which Collects Personal Information pursuant to the Agreement, shall assist Mitigately through appropriate technical and organizational measures in complying with the requirements of Cal. Civ. Code § 1798.100(d), (e) and (f), taking into account the nature of the Processing.

8. If Clarity subcontracts with another Person in providing services to Mitigately for which it is a Service Provider or a Contractor, then Clarity shall have a written contract with such subcontractor that complies with all of the requirements set forth in Sections X.1 through X.8 and the CPRA and the CPRA regulations.

Sample Definition of Personal Information

Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular California resident or household:

• Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.
• Any categories of personal information described in Cal. Civ. Code § 1798.80(e).
• Characteristics of protected classifications under California or federal law.
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Biometric information.
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a California resident's interaction with an internet website, application, or advertisement.
• Geolocation data.
• Audio, electronic, visual, thermal, olfactory, or similar information.
• Professional or employment-related information.
• Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99).
• Inferences drawn from any of the information identified in this subdivision to create a profile about a California resident reflecting the California resident's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. Cal. Civ. Code § 1798.140(v)(1).
• Sensitive personal information, meaning: 

- Personal information that reveals:

□ a California resident's Social Security, driver's license, state identification card, or passport number.

□ a California resident's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.

□ a California resident's precise geolocation (as defined in Cal. Civ. Code § 1798.140(w)).

□ a California resident's racial or ethnic origin, religious or philosophical beliefs, or union membership.

□ the contents of a California resident's mail, email, and text messages unless the business is the intended recipient of the communication.

□ a California resident's genetic data. Cal. Civ. Code § 1798.140(ae)(1).

- The processing of biometric information for the purpose of uniquely identifying a California resident.

- Personal information collected and analyzed concerning a California resident's health.

- Personal information collected and analyzed concerning a California resident's sex life or sexual orientation. Cal. Civ. Code § 1798.140(ae)(2). Cal. Civ. Code § 1798.140(v)(1).

Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. Publicly available means information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the California resident or from widely distributed media, or information made available by a person to whom the California resident has disclosed the information if the California resident has not restricted the information to a specific audience, but does not mean biometric information (as defined in Cal. Civ. Code § 1798.140(c)) collected by a business about a California resident without the California resident's knowledge. Cal. Civ. Code § 1798.140(v)(2).

Sensitive personal information that is publicly available pursuant to the immediately preceding paragraph is not considered sensitive personal information or personal information. Cal. Civ. Code § 1798.140(ae)(3).

Personal information does not include California resident information that is deidentified (as defined in Cal. Civ. Code § 1798.140(m)) or aggregate consumer information (as defined in Cal. Civ. Code § 1798.140(b)). Cal. Civ. Code § 1798.140(v)(3).