This California Data Protection Addendum is agreed by Level Benefits, Inc. (“Level”, “we,” “our” or “us”) and the organization purchasing or receiving services from Level  (“Customer,” “you,” or “your” and together with Level, the “Parties”) and is incorporated into your agreement with us for the purchase of Services provided by Level (the “Underlying Agreement”).  This Addendum sets forth the Parties’ respective obligations under applicable California data protection and privacy laws and regulations, including but not limited to, the California Consumer Privacy Rights Act of 2018 (CCPA), as amended by the California Consumer Privacy Rights Act of 2020 (CPRA) (together the “California Data Privacy Laws”).  By purchasing the Services from Level, you agree to the the Platform Terms of Service (“Platform Terms”), Level Customer Terms (the “Customer Terms” available at level.com/legal/terms), and all other applicable terms listed at level.com/legal/terms or incorporated by reference herein (together, the “Terms”). Defined terms will have the same meaning as those found in the Terms, unless otherwise re-defined herein.

In this agreement, “Business,” “Service Provider,” “Consumer,” “Sell or Share,” “Business Purpose,” and “Commercial Purpose” are as defined by the California Data Privacy Laws.

1. Responsibilities of the Parties

‍
Roles of the Parties. The Parties agree that with respect to any operation or set of operations Level performs (“Processes, Processing”) on information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household (“Personal Information”), Customer is the Business and Level is the Service Provider. Personal Information does not include information exempt from the California Data Privacy laws.‍

Selling and Sharing.   Level will not Sell or Share the Personal Information it gathers, obtains, receives, or accesses (“Collects”) pursuant to the Underlying Agreement with the Customer (“Customer Personal Information”).

Business Purposes. The Parties agree that Level is Processing the Customer Personal Information, and that Customer is disclosing Customer Personal Information to Level, for the Business Purposes set forth within the Underlying Agreement. The Business Purposes for which Level will Process the Customer Personal Information (“Level Business Purposes”) include:

• Administering benefits to employees of Customer and their dependents, on behalf of the Customer;
  Retaining and employing subcontractors;
• Building and improving the quality of Level’s services;
• Preventing, detecting, or investigating data security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity; and
• Complying with court orders, defending legal claims, and cooperating with law enforcement.

Use Limitation. Level agrees that it will not retain, use or disclose the Customer Personal Information: 

• For any other purpose than the Level Business Purposes or as otherwise permitted by California Data Privacy Laws; 
• For any Commercial Purpose other than the Level Business Purposes, unless expressly permitted by California Data Privacy Laws; and 
• Outside of the direct business relationship between Level and Customer, unless expressly permitted by the California Data Privacy Laws inclusive of the uses described in the Level Business Purposes.

Compliance with CCPA. With respect to the Customer Personal Information, Level will comply with the California Data Privacy Laws and provide the same level of privacy protection as Businesses are required to provide. This compliance includes:

• Cooperating with Customer in responding to Consumers’ requests made pursuant to the California Data Privacy Laws; 
• Implementing reasonable security procedures and practices to protect the Customer Personal Information from unauthorized or illegal access, destruction, use, modification, or disclosure. A description of Level’s technical and organizational security measures as of the date of this agreement is included in Level’s Security Annex;
• Granting Customer the right to take reasonable and appropriate steps to ensure that Level is using the Customer Personal Information in a manner consistent with the Customer’s obligations under California Data Privacy Laws;  
• Granting Customer the right, upon notice and reasonable belief that unauthorized use has occurred, to take reasonable and appropriate steps to remediate the unauthorized use of Customer Personal Information by Level; and
• Notifying Customer if Level determines if can no longer meet its obligations under the California Data Privacy Laws. 

Consumer Requests. Customer will inform Level of any Consumer request made pursuant to the California Data Privacy Laws that the Customer must comply with, and provide the information necessary for Level to comply with the request.  

2. Term

The Term of this Data Protection Addendum will begin on the effective date of the Underlying Agreement, and will continue until all Customer Personal Information is erased, returned to Customer, de-identified or aggregated. 

3. Amendment

Level may revise this Data Protection Addendum from time to time, and will post the most current version on the Site. By continuing to use or access the Services after the updates come into effect, you agree to be bound by the revised Terms.  

4. Assignment

Level may assign its rights and obligations, in whole or in part, pursuant to the Terms to (i) any of its affiliates, or (ii) in connection with any merger, consolidation or reorganization involving Level (regardless of whether Level is a surviving or disappearing entity), or a sale of all or substantially all of Level’s business or assets relating to the Services to an unaffiliated third party. Your information may be transferred as a result of such assignment.

‍

Last updated: November 23, 2022

‍

‍

‍

‍

‍