Organization Data Processing Agreement

For Supporter Data collected by Legwork through the Services and provided to Organizations, Legwork acts as the data controller and the Organization acts as the data processor. The Organization processes this data on Legwork’s behalf and subject to this DPA.

The subject matter, duration, nature, and purpose of this processing are as follows:

• Subject matter: Supporter Data as defined above.
• Duration: For as long as the Organization holds Supporter Data, including after the Organization’s relationship with Legwork ends.
• Nature and purpose: The Organization’s fulfillment of Membership Services to Supporters, including delivering membership benefits, communicating with members, and managing the membership program.
• Categories of data subjects: Individuals who sign up for memberships or otherwise engage with the Organization through the Legwork platform.

For Imported Data that an Organization uploads or imports into Legwork’s CRM tools, the Organization acts as the data controller and Legwork acts as the data processor. Legwork processes this data on the Organization’s behalf and in accordance with the Organization’s instructions as expressed through the Services.

The Organization represents and warrants that:

• It has all necessary rights, consents, and legal bases to import the Imported Data into Legwork and to use it for the purposes described;
• The Imported Data was collected in compliance with applicable Data Protection Legislation;
• It has obtained, where required by applicable law, prior express consent from each individual whose data is imported for the types of processing and communications the Organization intends to conduct through Legwork; and
• It will not import data that it does not have the lawful right to process.

Organizations will process Supporter Data only in accordance with Legwork’s Terms of Service, Privacy Policy, and this DPA, and only in compliance with applicable Data Protection Legislation. The nature and purpose of the processing shall be limited to that necessary to fulfill Membership Services, and not for the Organization’s own unrelated purposes. If an Organization is required by law to process the personal data for any other purpose, the Organization will inform the affected individual of such requirement prior to the processing, unless prohibited by law from doing so.

Organizations will process Supporter Data only to the extent, and in such manner, as is necessary for the provision of Membership Services. Organizations shall not use Supporter Data for purposes unrelated to their membership program, including but not limited to selling, renting, or licensing Supporter Data to third parties.

Organizations will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration, or disclosure. These measures shall be appropriate to the harm that might result from any unauthorized or unlawful processing, accidental loss, destruction, damage, or theft of the Personal Data, having regard to the nature of the Personal Data to be protected, and shall, at a minimum, be in accordance with applicable Data Protection Legislation and Good Industry Practice.

Organizations will not give access to or transfer any Supporter Data to any third party (including any affiliates, group companies, or subcontractors) without ensuring that such third party is bound by data protection obligations equivalent to those in this DPA. Organizations must ensure the reliability and competence of such third parties and any employees or agents who may have access to the Personal Data processed in the provision of Membership Services. Organizations must include in any contract with such third parties provisions protecting individuals that are equivalent to those in this DPA, the Terms of Service, and as required by applicable Data Protection Legislation.

Organizations will take reasonable steps to ensure the reliability and competence of any personnel who have access to Personal Data, including any individuals granted access to the Organization’s account on Legwork (such as administrators and team members). Organizations will ensure that all personnel required to access the Personal Data are informed of its confidential nature and comply with the obligations set out in this DPA.

When using Legwork’s communication tools to send emails or SMS text messages to Supporters or imported contacts, Organizations shall:

• Comply with all applicable communications laws, including the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, and any applicable state laws;
• Send communications only to individuals from whom they have obtained the necessary consents required by applicable law;
• Honor all opt-out, unsubscribe, and do-not-contact requests promptly; and
• Not send communications that are misleading, fraudulent, or otherwise in violation of Legwork’s Terms of Service or Community Guidelines.

Organizations will promptly honor requests from individuals to access, correct, or delete their Personal Data, in accordance with applicable Data Protection Legislation. When a Supporter requests removal of their contact information from an Organization’s records on Legwork, the Organization acknowledges that Legwork will remove such information from the Organization’s records on the platform, as described in the Terms of Service and Privacy Policy.

Organizations will take all reasonable steps to assist Legwork in complying with applicable Data Protection Legislation. Organizations will promptly inform Legwork in writing if they receive: (a) a request from an individual concerning any Personal Data obtained through the Services; or (b) a complaint, communication, or request relating to obligations under applicable Data Protection Legislation that involves data processed through Legwork.

Organizations will not retain Supporter Data for longer than is necessary to provide Membership Services. At the end of Membership Services, or upon an individual’s request, the Organization will securely destroy or return (at the individual’s election) the Personal Data, except to the extent retention is required by applicable law.

When an Organization’s account on Legwork is terminated or deleted, the Organization acknowledges that its access to Supporter Data and Imported Data stored on the Legwork platform will cease. Any Supporter Data or Imported Data that the Organization has previously exported or copied from the platform remains subject to the obligations of this DPA.

Organizations shall not collect, store, or process Sensitive Information through the Services unless they have: (a) obtained explicit consent from each data subject for the specific processing of their Sensitive Information; and (b) implemented appropriate technical and organizational safeguards in accordance with applicable Data Protection Legislation to protect such Sensitive Information.

“Sensitive Information” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

Legwork does not knowingly process Sensitive Information and accepts no liability for any Sensitive Information that an Organization collects or processes through the Services without appropriate consent and safeguards.

The party that becomes aware of the Security Breach shall notify the other party without undue delay, and with a targeted notification time of no greater than 72 business hours after becoming aware of the Security Breach, and provide:

• A detailed description of the Security Breach;
• The type of data that was the subject of the Security Breach;
• The identity of each affected individual, if known;
• The steps the party has taken or will take to mitigate and remediate the Security Breach; and
• Periodic updates to this information and any other information the other party may reasonably request.

The party responsible for the Security Breach shall promptly take action, at its own expense, to investigate the Security Breach and to identify, prevent, and mitigate its effects, and to carry out appropriate recovery actions to remedy the Security Breach.

Both parties shall cooperate with each other and with applicable regulatory authorities in the investigation and resolution of any Security Breach, and shall comply with any applicable breach notification requirements under Data Protection Legislation.