These Favor Data Protection & PII Terms (these “PII Terms”) apply when the Order Form indicates that the Provider will access, receive, store, or process Favor Personal Information. These PII Terms are incorporated by reference into, and form part of, the agreement between NeighborFavor Inc. (“Favor”) and the Service Provider (“Provider”) consisting of the Order Form and the Service Provider Terms (collectively, the “Agreement”). Favor may update these PII Terms from time to time. Capitalized terms used but not defined herein have the meanings given in the Agreement.

1. Definition of Personal Information

“Favor Personal Information” or “Favor PII” means any information that, alone or in combination, identifies or can be used to identify an individual relating to Favor personnel (including former, current or prospective employees, independent contractors, officers or directors); Favor customers (including past, current or prospective customers); and third parties partnering with or providing goods or services to Favor, however provided to, accessed or collected by Provider, including but not limited to: name, phone number, email address, physical address, location, social security number, birthday, or similar information.

2. Disclosure Limitations

Favor PII shall be considered the Confidential Information of Favor under, and subject to the confidentiality provisions of, the Agreement. Provider may not use Favor PII or transfer Favor PII to any third party for any purpose other than providing services to Favor or otherwise fulfilling its obligations to Favor, as set forth in the Agreement. Any other use or transfer of Favor PII shall require the prior written consent of Favor in each instance. Favor PII may only be stored in or transferred to servers located within the United States and may not be accessed by any individuals located outside of the United States. In no event may Provider: (i) use Favor PII to market its goods or services or those of a third party, (ii) sell or rent Favor PII to third parties (including affiliates of Provider), or (iii) handle Favor PII in any way which violates any applicable laws.

3. Written Information Security Program

Provider represents that it has adopted, implemented and shall maintain a written information security program (or set of information security policies and procedures) consistent with prevailing industry standards (“Security Program”) that includes administrative, technical and physical safeguards designed to prevent the unauthorized or accidental access to, destruction, modification, use or disclosure of Favor PII and shall act in accordance with the Security Program. Such Security Program shall be compliant, at a minimum, with all applicable laws, rules, regulations, directives, ordinances, codes or similar enactments and any obligations imposed by self-regulatory bodies promulgating standards that apply to Provider in the conduct of its business. The Security Program shall take into account the nature of the Favor PII and the commensurate risks associated with handling such information. Provider shall reasonably monitor, evaluate and adjust its Security Program in response to relevant changes in technology, changes in the sensitivity of Favor PII and internal and external threats to information security and shall adopt such changes to its Security Program as necessary to meet prevailing industry standards or as reasonably requested by Favor.

4. Encryption

Provider shall encrypt, using industry standard encryption tools in accordance with the requirements, all records and files containing Personal Information that Provider: (a) transmits or sends wirelessly or across public networks; (b) stores on laptops or storage media; (c) where technically feasible, stores on portable handheld devices (e.g., smartphones, tablets or similar devices); and (d) stores on any device that is transported outside of the physical or logical controls of Provider.

5. Disaster Recovery/Business Continuity

Provider shall maintain, update, as appropriate, and periodically test a disaster recovery plan, including business continuity, (“Disaster Recovery Plan”) to protect against any significant interruption of the Services to be provided by Provider in the event of a disaster or outage affecting Provider’s facilities. Favor may request reasonable changes to and testing of any Disaster Recovery Plan and such requests shall be addressed promptly by Provider. In the event of any disaster, Provider shall immediately implement the applicable Disaster Recovery Plan. Provider shall not increase any fees hereunder in the event of, in response to, or in contemplation of any disaster.

6. Audit

Provider shall maintain a complete audit trail of all transactions and activities associated with Favor PII. Upon reasonable notice to Provider, Provider shall permit Favor, its auditors and designated audit representatives, including auditors affiliated with the payment card industry, as well as data protection regulators to audit and inspect: (i) locations where Provider stores or maintains Favor PII; (ii) any computerized systems used to share, disseminate or otherwise exchange Favor PII; and (iii) Provider’s Security Program. The audit and inspection rights hereunder shall be, at a minimum, for the purpose of verifying Provider’s compliance with the Agreement and all applicable laws. Upon notice to Provider, Provider shall assist and support Favor in the event of an investigation by a regulator, data protection regulator, a payment card network or similar authority, if and to the extent that such investigation relates to the Favor PII held by Provider.

7. Disposal of Records

If Provider disposes of any paper or electronic record containing Favor PII, Provider shall do so by taking all reasonable steps to destroy the information by: (i) shredding; (ii) permanently erasing and deleting; or (iii) otherwise modifying the Favor PII in those records to make it unreadable, unreconstructable and indecipherable through any means.

8. Favor Privacy Policy

Provider agrees that it will abide by the limitations of any Favor privacy policy (“Privacy Policy”) published by Favor at https://favordelivery.com/privacy/ with respect to any Favor PII.

9. Security Breach

Provider shall notify Favor promptly, and in any event as soon as reasonably possible (within no more than forty-eight (48) hours) after Provider reasonably suspects that there has been or will be an unauthorized or accidental acquisition, destruction, modification, use, disclosure of or access to Favor PII or a breach or violation of these PII Terms (which shall include any such breach caused by any employee, third party provider or subcontractor of a party) that, in Provider’s reasonable judgment, is likely to put any data, including any Favor PII, or network of Favor at risk (“Security Breach”). Upon the occurrence of any Security Breach: (a) Provider shall, as soon as practicable and at its sole expense, implement an action plan to correct the Security Breach and prevent the continuation of such Security Breach, and shall promptly notify Favor of the corrective action and measures taken and (b) Favor may audit to determine whether the corrective action has been implemented and is effective. If there is any Security Breach relating to Favor PII maintained by or on behalf of Provider, then Provider shall pay the out of pocket expenses incurred by the parties in responding to the Security Breach, including paying the cost of notifying individuals that information about them was subject to a Security Breach. Any public notice sent concerning a Security Breach shall be subject to the prior written approval of Favor, which approval shall not be unreasonably withheld or delayed. Provider agrees that any Security Breach is serious and Favor may at its discretion immediately terminate Provider’s provision of goods and/or services under any or all agreements or arrangements between Provider and Favor without penalty, if a Security Breach occurs. Further, Provider agrees to fully indemnify Favor for all costs, fees, penalties, claims or actions associated with any Security Breach within Provider’s control or the control of an entity with which Provider has contracted. For purposes of clarity, any limitations on or exclusions from liability contained in the Agreement do not apply to Provider’s liability for breach of these PII Terms.

10. Security Reviews

Without limiting its other obligations set forth herein, Provider, at the request of Favor or to satisfy data protection regulators, shall cause a security review of those of its systems that affect Favor in connection with the Services to be provided by Provider (“Security Review”) to be conducted at Favor’s request no more than once every twelve (12) months (except as provided in Section 9 of these PII Terms). The Security Review shall include: Provider’s facilities where Favor PII is stored or maintained; any computerized systems used to share, disseminate or otherwise exchange Favor PII; and Provider’s security practices and procedures, data protection, business continuity and recovery facilities, resources, plans and procedures. The vulnerability scan portion of each Security Review shall be conducted by a nationally recognized third party engaged in the business of performing such vulnerability scans which shall be at the expense of Favor, which expense shall be reimbursed by the Provider if the Security Review reveals a material security risk. The remainder of each Security Review shall be conducted jointly by the parties and shall include a comprehensive review of vulnerabilities of Provider’s systems. At least thirty (30) days prior to each Security Review, the parties shall meet and consult reasonably and in good faith in an effort to agree on the minimum tests to be conducted in the Security Review. In the event that a Security Review reveals any material security exposures, Provider shall take such actions as are reasonably necessary to correct such exposures, to Favor’s reasonable satisfaction, as promptly as is commercially reasonable, and Favor may audit to determine whether the corrective action has been implemented and is effective.

11. No Rights to Favor PII

At no time shall Provider acquire any ownership, license, rights or other interest in or to Favor PII, all of which shall, as between Favor and Provider, be and remain the proprietary information of Favor.

12. Obligations upon Termination

Upon termination or expiration of the Agreement for any reason or upon Favor’s request, Provider shall immediately cease handling any Favor PII and shall return in a manner and format reasonably requested by Favor, or, if specifically directed by Favor, shall destroy, any or all Favor PII in Provider’s possession, power or control, in a manner consistent with Section 7 of these PII Terms. Upon Favor’s instruction to destroy or return Favor PII, all copies of Favor PII shall be permanently removed from Provider’s, its agents’, subcontractors’ or third parties’ systems, records, archives and backups and all subsequent use of such Favor PII by Provider, its agents, subcontractors or third parties shall cease.

13. Miscellaneous

These PII Terms supersede and take precedence over any conflicting terms or conditions found in any other agreement between the parties, including those found on any shrink-wrap, click-wrap, or other license agreement or provided on any website, purchase order, or other physical document or electronic portal. These PII Terms may only be superseded or modified by a written instrument that specifically references these PII Terms and is signed by authorized representatives of both Favor and Provider. These PII Terms shall not be subject to any provisions regarding limitations on liability or arbitration found in any other document. These PII Terms shall be governed by the laws of the State of Texas.

14. Survival

The obligations of Provider under these PII Terms shall continue for so long as Provider continues to have access to, is in possession of or acquires Favor PII, even if the Agreement has expired or been terminated.