This Data Processing Addendum (“DPA”) is entered into by and between Core365 ERP LLC (“Core365”) and the entity that has entered into an Agreement with Core365 for the Services (“Customer”). This DPA is incorporated into, and supplements, the agreement between Core365 and Customer governing Customer’s access to or use of the Services (the “Agreement”). This DPA is effective as of the date Customer electronically accepts this DPA or the date the Agreement incorporating this DPA becomes effective, as applicable (the “DPA Effective Date”). Core365 and Customer are each referred to herein as a “Party” and collectively as the “Parties.”
By clicking a button or checking a box indicating acceptance of this DPA, or by entering into an Agreement that incorporates this DPA by reference, Customer agrees to be bound by this DPA. The individual accepting this DPA on behalf of Customer represents and warrants that such individual has the authority to bind Customer to this DPA.
1. DEFINITIONS
For purposes of this DPA, the following capitalized terms shall have the meanings ascribed thereto. Other capitalized terms used in this DPA are defined in the context in which they are used and shall have the meanings indicated. Capitalized terms which are not defined herein shall have the meanings ascribed to them in the Agreement.
(a) “Controller” means the natural or legal person or entity who determines the purposes and means of the Processing of Personal Data.
(b) “Customer Instructions” means Customer’s instructions to Core365 to Process Customer Personal Data on Customer’s behalf: (1) as necessary to provide the Services to Customer; (2) as documented in the Agreement and this DPA; and (3) as otherwise instructed by Customer in writing and acknowledged and agreed by Core365.
(c) “Customer Personal Data” means any Personal Data Processed by Core365 on behalf of Customer through or in connection with Customer’s access to or use of the Services.
(d) “Data Protection Law” means all laws, rules, regulations and orders issued thereunder relating in any way to data protection, breach notification, privacy or electronic marketing of any country, state, principality or other territory that are applicable to the Processing of Customer Personal Data under the Agreement, which may include, where applicable and without limitation, the US Privacy Laws.
(e) “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
(f) “Data Subject Request” means a request from an individual seeking to exercise rights granted to individuals under the Data Protection Laws.
(g) “Personal Data” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable Data Subject.
(h) “Processing” (including corollary terms) means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, including, without limitation, collection, recording, organizing, structuring, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
(i) “Processor” means the entity which Processes Personal Data on behalf of the Controller.
(j) “Security Breach” means a breach of Core365’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data on systems managed or otherwise controlled by Core365.
(k) “Security Documentation” means the security documents applicable to the specific Services provided to Customer, as updated from time to time and as made reasonably available to Customer by Core365.
(l) “Services” means those services provided by Core365 to Customer pursuant to the Agreement where, in the performance of such services, Core365 Processes Customer Personal Data on behalf of Customer as a Processor.
(m) “Sub-Processor” means a third party engaged by Core365 to Process Customer Personal Data on Customer’s behalf under the Agreement and this DPA.
(n) “Supervisory Authority” means any applicable state, federal or local government or any departmental or political subdivision thereof, or any entity, body or authority having or asserting executive, legislative, judicial, regulatory, administrative or other governmental functions of any court, department, commission, board, bureau, agency or instrumentality of any of the foregoing, responsible for or involved in the enforcement and/or oversight of the Data Protection Laws.
(o) “US Privacy Laws” means all laws, rules, regulations and orders issued thereunder applicable in the United States of America, including any state or other jurisdiction within the United States of America, that are applicable to the Processing of Customer Personal Data under the Agreement, including, where applicable and without limitation, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations, each as amended from time to time, including as amended by the California Privacy Rights Act of 2020 (“CCPA”), and any other applicable state consumer privacy laws in effect during the term of the applicable Agreement.
2. SCOPE OF DPA
2.1. Role of the Parties. As between Core365 and Customer, Customer shall be the Controller and Core365 shall be the Processor with respect to the Customer Personal Data Processed by Core365 on Customer’s behalf in connection with Core365’s provision of the Services and the Customer Instructions.
2.2. Purpose of Processing. The specific business purpose for which Core365 Processes Customer Personal Data on Customer’s behalf pursuant to the Agreement and this DPA is Core365’s performance of the Services during the term of the Agreement. Customer’s disclosure of Customer Personal Data to Core365 is only for the foregoing limited and specified business purpose(s) set forth in the Agreement and this DPA.
2.3. Limitation of Obligations. Notwithstanding anything to the contrary in this DPA, Customer acknowledges and agrees that Core365 has no obligation to assess Customer Personal Data in order to identify information subject to any legal requirements. Customer further acknowledges and agrees that this DPA and Core365’s actions under this DPA do not, and shall not be interpreted to, relieve Customer of its obligations under the Data Protection Laws and Customer shall be solely responsible for its compliance therewith.
2.4. Anonymized Data. Notwithstanding anything to the contrary in the Agreement or this DPA, Customer acknowledges and agrees that Core365 is permitted, subject to compliance with applicable Data Protection Laws, to aggregate, anonymize and/or de-identify the Customer Personal Data (“Anonymized Data”), and Customer further acknowledges and agrees that Customer shall not acquire any right, title or interest in or to any Anonymized Data.
2.5. AI-Enabled Features. To the extent the Services include artificial intelligence, machine learning, automated analysis or similar functionality, such functionality is part of the Services and does not change the Parties’ roles under this DPA or create any obligation of Core365 except as expressly set forth in the Agreement or this DPA.
3. CUSTOMER OBLIGATIONS
3.1. Compliance. Customer shall comply with the Agreement, this DPA and the Data Protection Laws in connection with the Processing of Personal Data applicable to Customer as a Controller, including, without limitation:
(a) providing legally-compliant privacy notices to, and obtaining all necessary consents and permissions from, Data Subjects with respect to the processing of such Data Subjects’ Personal Data included within the Customer Personal Data;
(b) responding to and fulfilling Data Subject Requests in accordance with applicable Data Protection Laws;
(c) ensuring Customer has the right to disclose to Core365, or provide Core365 with access to, Customer Personal Data for the purpose of Core365 Processing Customer Personal Data on Customer’s behalf as contemplated under the Agreement, this DPA and the Customer Instructions; and
(d) providing Core365 with only the Customer Personal Data reasonably necessary for Core365 to perform the Services.
3.2. Accuracy and Quality of Customer Personal Data. Customer shall have the sole responsibility for the accuracy and quality of the Customer Personal Data provided by Customer to Core365 for Processing through or in connection with the Services and complying with all applicable laws, including, without limitation, the Data Protection Laws, with respect to the means by which Customer acquired such Customer Personal Data.
3.3. Customer Instructions. Customer shall be solely responsible for ensuring that all Customer Instructions comply with all applicable laws, including, without limitation, the Data Protection Laws.
3.4. Data Localization Requirements. Without limiting anything set forth in the Agreement or this DPA, Customer shall notify Core365 of any data localization requirement or restriction on the transfer of Customer Personal Data to the extent that such requirement or restriction may affect Core365’s Processing of such Customer Personal Data in accordance with the Agreement, this DPA or the Customer Instructions.
4. CORE365 OBLIGATIONS
4.1. Compliance.
(a) Core365 shall comply with the Agreement, the DPA and applicable Data Protection Laws, including, with respect to any Customer Personal Data collected by Core365 pursuant to the Agreement or this DPA, providing the same level of privacy protection required of Customer as a Controller under applicable Data Protection Laws solely to the extent required for Core365 to act as a Processor, with respect to such Customer Personal Data.
(b) Core365 shall only Process Customer Personal Data as specified in the Agreement, this DPA and the Customer Instructions or as otherwise permitted under applicable Data Protection Laws. In the event applicable law to which Core365 is subject requires Core365 to undertake other Processing of Customer Personal Data, Core365 will notify Customer (unless otherwise prohibited by such applicable law) before undertaking such other Processing.
4.2. Restrictions. Without limiting anything set forth in the Agreement or this DPA, Core365 shall not:
(a) sell or share (as and to the extent such terms are defined in applicable Data Protection Laws) Customer Personal Data;
(b) retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement or this DPA, including retaining, using or disclosing Customer Personal Data for a commercial purpose other than the applicable business purposes or as otherwise permitted under applicable Data Protection Laws;
(c) retain, use or disclose Customer Personal Data outside of the direct relationship between Core365 and Customer except as necessary to perform the Services under the Agreement or otherwise pursuant to the Customer Instructions; and/or
(d) combine the Customer Personal Data Core365 receives from or on behalf of Customer with Personal Data Core365 receives from or on behalf of any third party or collects through Core365’s own interactions with Data Subjects, provided that Core365 may combine Customer Personal Data with other Personal Data to perform any business purpose as defined or permitted under applicable Data Protection Laws.
4.3. Certification. Core365 certifies to Customer that Core365:
(a) understands and will comply with the foregoing restrictions placed on Core365’s Processing of Customer Personal Data, including complying with its obligations under applicable Data Protection Laws; and
(b) will notify Customer without undue delay if Core365 is, or is likely to become, unable to substantially comply with any of Core365’s material obligations under this DPA or applicable Data Protection Laws.
5. RIGHTS OF DATA SUBJECTS
5.1. Notification of Requests. In the event Core365 receives a Data Subject Request in relation to Customer Personal Data and the request identifies Customer as the Controller, to the extent reasonably possible, Core365 will, subject to compliance with applicable Data Protection Laws, at its option and in its discretion, advise the Data Subject to submit their request to Customer or notify Customer of such Data Subject Request. Customer will be responsible for responding to and fulfilling any Data Subject Request.
5.2. Assistance. Taking into account the nature of the Processing of Customer Personal Data undertaken by Core365, Core365 will provide reasonable assistance to Customer through appropriate technical and organizational measures, insofar as this is possible, in the fulfillment of Customer’s obligations to respond to a Data Subject Request under applicable Data Protection Laws as a Controller.
5.3. Data Subject Requests Seeking Deletion. Except as otherwise provided in the Agreement or this DPA, Core365 will promptly delete, or subject to Core365’s compliance with applicable Data Protection Laws, aggregate, anonymize or de-identify applicable Customer Personal Data upon Customer’s request in connection with an applicable Data Subject Request, unless applicable law, including, without limitation, applicable Data Protection Laws, requires Core365 to retain such Customer Personal Data.
6. DISCLOSURES OF CUSTOMER PERSONAL DATA BY CORE365
6.1. Core365 Personnel. Core365 shall take reasonable steps to ensure the reliability of, and appropriate confidentiality obligations are imposed on, any employee, agent or contractor to whom Core365 provides access to Customer Personal Data, ensuring that access is strictly limited to those individuals who need to access the relevant Customer Personal Data for the purposes of providing the Services and as otherwise necessary to comply with Core365’s obligations under the Agreement, this DPA, the Customer Instructions and applicable laws.
6.2. Third Parties. Core365 may disclose Customer Personal Data to third parties: (1) as permitted under the Agreement or this DPA, in accordance with the Customer Instructions or as otherwise necessary to perform the Services; (2) to the extent required by applicable law (subject to compliance with applicable Data Protection Laws); (3) to a Supervisory Authority and/or as otherwise required by applicable Data Protection Laws; or (4) on a “need-to-know” basis under an obligation of confidentiality or professional secrecy to its legal counsel(s), data protection advisor(s) and accountant(s).
7. SUB-PROCESSORS
7.1. Engagement. Customer acknowledges and agrees that Core365 may engage Sub-Processors to Process Customer Personal Data for or on behalf of Customer for the purposes specified in the Agreement, this DPA and the Customer Instructions. Where Core365 engages any such Sub-Processor, Core365 will impose data protection terms on such Sub-processor that provide at least the same level of protection for Customer Personal Data as those specified in this DPA, to the extent applicable to the nature of the Processing of Customer Personal Data undertaken by such Sub-Processor. Core365 will remain responsible for all obligations assigned to, and all acts and omissions of, each such Sub-Processor with respect to each such Sub-Processor’s Processing of Customer Personal Data for or on behalf of Customer.
7.2. Notification of Sub-Processors. To the extent required under applicable Data Protection Laws, in the event Core365 engages any Sub-Processor to Process Customer Personal Data for or on behalf of Customer, Core365 will notify Customer of such engagement.
8. SECURITY AND ADDITIONAL ASSISTANCE
8.1. Security Measures. Taking into account the nature of the Processing of Customer Personal Data undertaken by Core365 for or on behalf of Customer, Core365 shall, in relation to its Processing of Customer Personal Data, implement and maintain appropriate technical, physical and organizational measures as described in the Security Documentation, provided that such measures shall provide appropriate protections for Customer Personal Data and include appropriate and commercially reasonable technical and organizational security controls designed to prevent reasonably foreseeable accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access to Customer Personal Data in Core365’s possession or otherwise under its reasonable control and other security controls required under applicable Data Protection Laws (the “Security Measures”).
8.2. Review of Security Documentation. Upon Customer’s written request at reasonable intervals, but no more frequently than annually, and subject to the confidentiality obligations set forth in the Agreement and this DPA Core365 will make available to Customer a copy of applicable Security Documentation, which may include, based on the Services provided under the Agreement, Core365’s most recent third party audit reports or certifications. Notwithstanding the generality of the foregoing, Customer shall: (1) only use the Security Documentation to assess Core365’s compliance with this DPA and/or the Data Protection Laws; (2) not use such Security Documentation for any other purpose or disclose such Security Documentation to any third party without Core365’s prior written approval; and (3) upon Core365’s request, Customer shall return to Core365 all Security Documentation in Customer’s possession or under its control.
8.3. Audits.
(a) Solely to the extent required under the Data Protection Laws and subject to this Section 8.3, Core365 will allow Customer, no more frequently than annually, to conduct audits (including inspections) to verify Core365’s compliance with its obligations under this DPA and/or the Data Protection Laws (“Customer Audit”). Notwithstanding the generality of the foregoing: (1) any such Customer Audit, including, without limitation, any observations, conclusions or other results thereof and any documents reflecting the foregoing (collectively, “Customer Audit Results”) shall only be used by Customer to assess Core365’s compliance with this DPA and/or the Data Protection Laws; (2) Customer shall not use any Customer Audit Results for any other purpose or disclose such Customer Audit Results to any third party without Core365’s prior written approval; and (3) subject to express requirements under applicable Data Protection Laws to the contrary, upon Core365’s request, Customer shall return to Core365 all such Customer Audit Results in Customer’s possession or under its control.
(b) Customer must send any requests to conduct a Customer Audit to privacy@core365.io. Following Core365’s receipt of such request, Core365 and Customer will discuss and agree in advance of the reasonable start date and duration of such Customer Audit and the scope of Core365’s technical and organizational measures in scope for such Customer Audit. Notwithstanding the foregoing, unless otherwise agreed by Core365 in writing, any Customer Audit: (1) involving inspection of Core365’s business offices or data centers shall be limited to such business offices or data centers where Core365 Processes Customer Personal Data for or on behalf of Customer and shall expressly exclude inspection of or access to any premises or systems containing Personal Data Core365 Processes for or on behalf of itself or any third party that is logically but not physically separated from Customer Personal Data; (2) shall only occur during Core365’s normal business hours; (3) shall be conducted in a manner that minimizes any disruptions to Core365’s business operations; and (4) shall be subject to all confidentiality obligations set forth in the Agreement and this DPA and security measures in effect at the applicable business office or data center. For the avoidance of doubt, Customer shall not have access to any information, including, without limitation, any Personal Data, of or relating to any other Core365 customer or client.
(c) Except as otherwise expressly prohibited under the Data Protection Laws, Core365 may charge a fee (based on Core365’s reasonable costs) for any Customer Audit conducted pursuant to this Section 8.3. Upon Customer’s written request, Core365 will provide Customer with further details of any applicable fee and the basis of its calculation in advance of the applicable Customer Audit. Without limiting the foregoing, Customer will be responsible for any fees charged by any auditor appointed by Customer to conduct such Customer Audit.
(d) Core365 may object in writing to any auditor appointed by Customer to conduct any Customer Audit if the auditor is, in Core365’s reasonable opinion, not suitably qualified or independent, a competitor of Core365 or otherwise manifestly unsuitable. Any such objection by Core365 will require Customer to appoint another auditor or conduct the Customer Audit itself.
(e) Without limiting anything set forth herein, prior to conducting any Customer Audit, Customer shall take reasonable efforts to conduct any such Customer Audit through a review of the Security Documentation in accordance with the procedures described in Section 8.2.
8.4. Additional Reviews Under CCPA.
(a) Solely to the extent required under the CCPA and solely with respect to Core365’s Processing of Customer Personal Data subject to the CCPA (“CCPA Data”):
(1) Core365 grants Customer the right, upon 14 days’ prior written notice, to: (1) take reasonable and appropriate steps to help ensure that Core365 uses CCPA Data Core365 receives from the Customer in a manner consistent with Customer’s obligations under the CCPA; and (2) take reasonable and appropriate steps to stop and remediate Core365’s unauthorized use of CCPA Data; and
(2) subject to Core365’s agreement, in Core365’s sole and absolute discretion, no more frequently than annually, Customer may monitor Core365’s compliance with the DPA with respect to Core365’s Processing of CCPA Data through additional measures which may include, without limitation, ongoing manual review, automated scans or other technical and operational testing.
(b) For clarity, except where prohibited under the CCPA:
(1) the rights set forth in Section 8.4(a) shall be subject to any applicable limitations or requirements set forth in the Agreement or this DPA, including, without limitation, all confidentiality obligations set forth in the Agreement and, if applicable, exceptions to Core365’s obligations to provide the Services in accordance with any service level agreement or other service level commitment; and
(2) under no circumstances shall Section 8.4(a)(2) prohibit or otherwise preclude Core365 from: (1) declining to agree to permit Customer to perform any particular additional measures; or (2) conditioning Core365’s agreement to permit Customer to perform any particular additional measure on Customer’s agreement to comply with any restrictions or requirements specified by Core365.
8.5. Security Breach. In the event of a Security Breach, Core365 will notify Customer promptly and without undue delay after Core365 discovers such Security Breach. Such notification of a Security Breach will be delivered to the notice address for Customer provided in the Agreement or, at Core365’s discretion, by telephone or other direct communication. Core365 will provide reasonable assistance to Customer to investigate, remediate and mitigate the effects of a Security Breach and to comply with any requirements to notify affected Data Subjects, applicable Supervisory Authorities or other third parties, all as and to the extent required under the Data Protection Laws.
9. RETENTION AND DESTRUCTION OF CUSTOMER PERSONAL DATA
9.1. Return or Destruction. Subject to the terms of the Agreement and this DPA, Core365 will, at the choice of Customer, delete or return the applicable Customer Personal Data upon Core365’s receipt of a Customer Instruction to do so, the cessation of Core365’s provision of the applicable portion of the Services under the Agreement or the expiration or termination of the Agreement. Without limiting the generality of the foregoing, in the event Customer uses functionalities available via the Services (if any) to delete any Customer Personal Data during the term of the Agreement and such Customer Personal Data cannot be recovered by Customer, this will constitute a Customer Instruction to Core365 to delete the relevant Customer Personal Data from the applicable Core365 systems. Core365 will, as applicable, return or delete, and procure for the deletion of, the applicable Customer Personal Data (including any and all copies thereof in Core365’s possession or under its reasonable control) as soon as reasonably practicable and, in any event, within ninety (90) days, unless, subject to Section 9.2 below, Core365 is required or permitted to retain such Customer Personal Data pursuant to the Agreement, this DPA or Core365’s obligations under applicable laws. Notwithstanding the foregoing or anything to the contrary in the Agreement or this DPA, Customer acknowledges and agrees that: (1) Core365 will securely erase or destroy any Customer Personal Data stored on Core365’s backup or archive systems upon the earlier of: (a) 12 months; or (b) the restoration of such backup or archive system to an active system; and (2) without limiting any rights provided to Core365 under the Agreement, this DPA or applicable Data Protection Laws, to the extent authorized, permitted or required under applicable law, Core365 may retain one copy of Customer Personal Data solely for evidentiary purposes and/or for the establishment, exercise or defense of legal claims and/or compliance with legal obligations.
9.2. Retained Customer Personal Data. In the event Core365 is required or permitted to retain any Customer Personal Data as contemplated under Section 9.1: (1) Core365 shall: (a) unless prohibited by applicable law, inform Customer, in writing, of the applicable requirement or permission; and (b) Process the retained Customer Personal Data solely to the extent necessary to comply with the applicable requirement or engage in the permitted activity; and (2) all such retained Customer Personal Data shall remain subject to the terms of this DPA.
10. ADDITIONAL TERMS
10.1. Liability and Indemnification. With respect to any claim, loss or liability based upon, arising out of, resulting from or in any way connected with a Party’s performance or breach of this DPA: (1) such Party shall only be obligated to indemnify, defend and hold the other Party harmless to the extent such obligation exists pursuant to such party’s indemnification, defense or hold harmless obligations set forth in the Agreement or this DPA (if any); and (2) each party’s total liability to the other Party is limited in accordance with the applicable limitations of liability set forth in the Agreement or this DPA.
10.2. Term. This DPA shall be effective as of the DPA Effective Date and continue in full force and effect until Core365 ceases providing all Services to Customer under or in accordance with the Agreement (the “DPA Term”). The provisions of this DPA which by their nature are intended to survive the expiration or earlier termination of this DPA shall continue as valid and enforceable obligations of the Parties notwithstanding any such termination or expiration. Without limitation, the provisions regarding confidentiality, compliance with applicable laws, indemnification obligations, limitations of liability and restrictions on the Processing of Customer Personal Data shall survive the expiration or earlier termination of this DPA.
10.3. Relationship to Agreement. This DPA shall be governed by and construed in accordance with the terms set forth in the Agreement as if fully set forth herein. Without limiting anything set forth herein, the Parties acknowledge and agree that they have taken all actions (if any) required under the Agreement to incorporate this DPA therein. Any dispute arising out of this DPA shall be resolved as set out in the Agreement. The requirements set forth in this DPA are in addition to, and not in lieu of, any similar requirements set forth in the Agreement. Notwithstanding anything to the contrary in the Agreement, to the extent any conflict or inconsistency between the terms of this DPA and the Agreement, this DPA shall control. Except as set forth in this DPA, the Agreement remains in full force and effect, as amended, and is hereby ratified and confirmed in all respects.
10.4. Invalidity. Should any provision of this DPA be invalid or unenforceable, the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either: (1) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as completely as possible; or (2) if (1) is not possible, construed in a manner as if the invalid or unenforceable part had never been contained in this DPA.
10.5. Changes to Data Protection Laws. The Parties acknowledge that the Data Protection Laws as of the DPA Effective Date may change during the DPA Term. The Parties shall comply with any and all such changes to the extent applicable to the Processing of Customer Personal Data under the Agreement or this DPA, including, without limitation, entering into any necessary amendments to this DPA and/or separate agreement to the extent necessary to comply with such changes.
10.6. Amendments. Core365 may amend this DPA from time to time by posting an amended version online or otherwise making the amended version available to Customer. Core365 will provide Customer with reasonable notice of any material amendment to this DPA. Unless a later effective date is specified by Core365, any amended version of this DPA will become effective upon posting; provided that any material amendment will become effective on the date specified in Core365’s notice or, if no date is specified, upon Customer’s continued access to or use of the Services after such notice. Notwithstanding the foregoing, no amendment will materially reduce the protections provided for Customer Personal Data during the then-current term of the Agreement unless required to comply with applicable law or agreed by the Parties. Customer’s continued access to or use of the Services after the effective date of an amended DPA constitutes Customer’s acceptance of the amended DPA.
10.7. Electronic Acceptance. The Parties agree that this DPA may be accepted electronically. Customer’s affirmative acceptance of this DPA through a checkbox, button or other electronic acceptance mechanism, or Customer’s acceptance of an Agreement that incorporates this DPA by reference, shall constitute Customer’s agreement to be bound by this DPA and shall have the same force and effect as an original handwritten signature. Core365’s offer or provision of the Services under the Agreement shall constitute Core365’s acceptance of this DPA. Each Party agrees that the electronic records maintained in connection with the acceptance of this DPA may be used to evidence such Party’s acceptance of and intent to be bound by this DPA.