DATA PROCESSING ADDENDUM FOR LEAD GENERATION SERVICES



This Data Processing Addendum (“Addendum”) is incorporated into Intuit SMB MediaLabs’ Advertising Guidelines and other relevant terms and conditions set forth between your entity (“ADVERTISER”) and Intuit Inc. (through its SMB MediaLabs service “MediaLabs”) (collectively, the “Agreement”),in connection with MediaLabs’ processing of personal information collected through Advertiser’s lead generation campaign(s) (the “Services”). This Addendum is effective for the duration of the Services until such time MediaLabs no longer holds the relevant personal information.

1. In addition to terms otherwise defined herein, the following definitions apply: “Data Protection Laws” means the California Consumer Privacy Act of 2018, the Colorado Privacy Act, and any other state or federal data protection or privacy laws that apply to Intuit’s Processing of Personal Information to provide the Services. “Controller,” “Personal Data,” “Processor,” “Process/ing,” “Sell,” “Share,” and “Service Provider” shall have the meanings given to them under Data Protection Laws. “Controller” has the same meaning as “Business”; “Processor” has the same meaning as “Service Provider.” As used herein, “Personal Information” means Personal Information processed by MediaLabs to provide the Services.

2. The parties acknowledge and agree that: (a) Attachment 1 describes the subject matter and details of the processing of Personal Information; (b) MediaLabs is a Processor of Personal Information; (c) Advertiser is a Controller of Personal Information; and (d) each party will comply with the obligations applicable to it under Data Protection Laws with respect to the processing of Personal Information.

3. Advertiser instructs MediaLabs to Process Personal Information in order to provide the Services. MediaLabs will process Personal Information solely on behalf of Advertiser and in accordance with Advertiser’s instructions unless prohibited by applicable laws. MediaLabs will not: (i) Sell or Share Personal information; (ii) retain, use, or disclose Personal Information (a) for any purpose other than to provide the Services, including retaining, using, or disclosing for a commercial purpose other than to provide the Services, or as otherwise permitted for Service Providers under Data Protection Laws, or (b) outside of the direct business relationship between MediaLabs and Advertiser unless expressly permitted of Service Providers under Data Protection Laws; (iii) combine Personal Information it receives from, or on behalf of Advertiser with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, unless expressly permitted under Data Protection Laws.

4. MediaLabs will (i) ensure that each person Processing Personal Information is subject to a duty of confidentiality with respect to such data; (ii) implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk; (iii) delete all Personal Information after the end of the provision of Services, unless retention is required by law; (iv) make available all information necessary to demonstrate compliance with Data Protection Laws and this Addendum; (v) permit Advertiser to take reasonable and appropriate steps to (a) ensure that MediaLabs uses the Personal Information consistent with Data Protection Laws, and (b) stop and remediate any unauthorized use of Personal Information; (vi) provide the same level of privacy protection as required of Advertiser in Processing Personal Information; and (vii) provide prompt notification if it makes a determination that it can no longer meet its obligations under Data Protection Laws.

5. Advertiser shall be responsible for responding to requests from individuals to exercise rights under Data Protection Law relating to Personal Information (each a “Data Subject Request”). MediaLabs shall only retain Personal Information for the duration of the Services and for ten (10) calendar days thereafter. At the expiration of the ten (10) day window, MediaLabs will permanently purge all Personal Information subject to this Addendum. For any Data Subject Requests received by MediaLabs from Advertiser via email, MediaLabs will rely on this Section 5 as confirmation of our deletion practices. MediaLabs will provide written confirmation within five (5) business days of Advertiser request. These instructions shall be construed to provide Advertiser written instruction of these practices.

6. Advertiser authorizes MediaLabs to use subcontractors to Process Personal Information in connection with providing the Services (each, a “Subprocessor”). Advertiser specifically consents to Intuit’s appointment of the Subprocessors identified on Attachment 1 (the “Subprocessor List”).

Attachment 1

Details of Processing



1. Description of Processing

  1. 1. Subject-Matter and Duration of Processing: Advertiser processes Personal Information collected through the Services for the duration of the Agreement and for up to ten (10) days thereafter.



  1. 2. Nature and Purpose of Processing: MediaLabs processes Personal Information to obtain customer leads through ads served on Advertiser’s behalf.


  1. 3 Types of Personal Information: Information input by individuals in the lead gen ads, which may include name, email address, phone number, or other personal contact information. At no time will sensitive personal information of an individual be requested via the Services.


  1. 4. Categories of Data Subjects: Individuals who provide Personal Information in response to lead gen ads


  1. 5. Retention Period: Personal Information will be retained for the duration of the Services and no more than ten (10) calendar days thereafter.


  1. 6 Sensitive Data (as applicable): N/A


  1. 7 De-identified data sharing (if applicable): N/A


2. Subcontractors and description of their Processing: A list of subprocessors will be provided upon written request.

3. For DSR requests: SMBMLDSR@intuit.com