OverDrive Data Privacy Addendum

This Data Privacy Addendum (“DPA”) is entered into in connection with, and incorporated into, the OverDrive Order Form for digital library services or Kanopy Master Agreement (the “Contract”) executed by and between the entity named therein (“Customer”) and OverDrive, Inc. or its related subsidiary or affiliate (“OverDrive”). This DPA is effective at the commencement of Services contracted for in the Contract, and its term is commensurate with that of the Contract. All capitalized words used and not defined herein have the meanings assigned to them in the Contract, or in the OverDrive Access Agreement incorporated therein.

1. Definitions
   1. Adequacy Decision: an adequacy decision issued by the European Commission pursuant to either:
      1. Article 45(3) of the EU GDPR (defined herein); or,
      2. Article 25(6) of European Parliament Directive 95/46/EC and affirmed pursuant to Article 45(4) of the EU GDPR.
   2. Adequacy Regulations: any adequacy regulations made pursuant to Section 17A of the UK Data Protection Act 2018.
   3. Data Protection Law(s): all applicable laws and regulations pertaining to the security, confidentiality, protection, or privacy of Personal Data (defined herein), as amended or revised from time to time, including but not limited to the EU GDPR, the UK GDPR, the Hong Kong Personal Data (Privacy) Ordinance, and the California Consumer Privacy Act.
   4. Data Subject Request: a request by a data subject to exercise their rights under the applicable Data Protection Law(s).
   5. EU GDPR: the General Data Protection Regulation (EU) 2016/679.
   6. EU Restricted Transfer: a transfer of Personal Data governed by the EU GDPR to a country outside of the European Economic Area for which there is no Adequacy Decision.
   7. GDPR: the EU GDPR and/or UK GDPR, as applicable.
   8. Personal Data: personal data, or data intentionally treated by OverDrive as personal data, belonging to the Customer and processed by OverDrive in accordance with this DPA for the purpose of providing Services under the Contract. For the avoidance of doubt, business contact information related to a Customer or Customer employee does not constitute Personal Data.
   9. SCCs: The European Commission’s standard contractual clauses for the transfer of personal data to third countries pursuant to the EU GDPR.
   10. Service(s): any OverDrive-provided digital library service(s) provided to Customer, including but not limited to, Libby, Sora, Kanopy, TeachingBooks, Marketplace, and/or Corporate Digital Library.
   11. UK Restricted Transfer: a transfer of personal data governed by the UK GDPR to a country outside of the UK for which there are no Adequacy Regulations.
   12. UK Addendum: The International Data Transfer Addendum to the SCCs issued by the UK ICO pursuant to the UK Data Protection Act 2018.
   13. UK GDPR: the EU GDPR as integrated into the law of England and Wales, Scotland, and Northern Ireland by virtue of Section 3 of the European Union (Withdrawal) Act 2018.
   14. Controller, data subject, personal data, processing/process, processor, personal data breach, and subprocessor (or sub-processor) shall have the meanings given to them in the appropriate Data Protection Law(s).
2. Data Processing Agreement. Customer and OverDrive agree to the following:
   1. This DPA governs the processing of all Personal Data by OverDrive (as processor) on behalf of Customer (as controller) during the provision of Services, unless OverDrive and Customer have entered into a separate DPA (“Customer DPA”), in which case the Customer DPA shall govern all processing and this DPA shall be of no force or effect.
   2. Customer and OverDrive shall comply with all applicable Data Protection Law(s) at all times, including (without limitation) the provision of any required notices and obtaining any required consents to enable the lawful transfer of Personal Data to OverDrive and for the Customer’s written processing instructions to OverDrive to comply with the Data Protection Law(s).
   3. The Description of Processing contained in Appendix A to this DPA accurately describes the relevant data processing details as required by the GDPR.
   4. This DPA applies only to Personal Data provided by Customer to OverDrive in which OverDrive acts as processor, and not to any data provided directly from a data subject to OverDrive for which OverDrive acts as a Controller (“OverDrive-Controlled Data”). OverDrive’s Privacy Policy (the “Privacy Policy”), as updated from time to time, located at https://www.overdrive.com/policies shall govern OverDrive’s collection, storage, and use of OverDrive-Controlled Data.
   5. Customer agrees to only provide OverDrive with the Personal Data necessary for OverDrive to perform the Services, and to do so accurately and pursuant to relevant OverDrive documentation and instructions. Customer represents and warrants that it has the legal authority to provide such Personal Data to OverDrive, in compliance with the Data Protection Law(s) and any other applicable law. OverDrive shall have no liability to Customer or any third party for any Personal Data incorrectly or improperly provided to OverDrive.
3. Processing Instructions. OverDrive shall process Personal Data in accordance with Customer’s written instructions (if any and if applicable), unless otherwise required by applicable law (if applicable law requires the processing of data contrary to Customer’s instructions, OverDrive shall notify Client in advance thereof to the extent allowed). Customer may provide additional processing instructions to OverDrive to the extent consistent with this DPA and applicable law. In the event that a Customer processing instruction is reasonably believed by OverDrive to violate the Data Protection Law(s), OverDrive will inform Customer thereof, but this does not constitute legal or professional advice to the Customer.
4. OverDrive Employee Obligations. All OverDrive employees shall:
   1. be informed of the confidential nature of Personal Data and bound by confidentiality obligations and use restrictions regarding the Personal Data;
   2. be trained on the Data Protection Law(s) and how they apply to an employee’s particular role and responsibilities;
   3. have access to Personal Data only to the extent required to perform the responsibilities of their role.
5. Security
   1. OverDrive shall implement and maintain appropriate technical and organizational measures as required under the Data Protection Law(s) to protect Personal Data from accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.
   2. OverDrive conducts regular penetration and vulnerability testing of its information technology infrastructure and networks at a commercially reasonable frequency. Upon Customer request, OverDrive shall provide a summary of testing or letter of attestation (OverDrive’s option) pertaining to the most recent testing. OverDrive may, at its option and without notice, modify the frequency and/or scope of any testing, provided that the scope shall not materially and negatively affect the security of Personal Data.
6. Business Continuity and Backup. OverDrive maintains business continuity and disaster recovery plans in line with industry standards and the Services provided. In the event of an issue or incident affecting public-facing systems or services, OverDrive has a rapid response plan to notify customers of an actual or potential issue, with actions and expected resolution time where possible. OverDrive regularly backs up all data stored on its systems, with essential backups stored at a secure, off-site confidential location. Customer shall not be charged any fees for disaster recovery services or for the restoration of Customer data performed due to a disaster. OverDrive may, in its sole discretion, modify any of its business continuity or disaster recovery plans, but no modification will materially and negatively affect the provision of the Services.
7. Notification of Breach. In the event that OverDrive becomes aware of, or reasonably suspects, a personal data breach affecting Personal Data, OverDrive shall, without undue delay:
   1. Investigate the cause of the breach;
   2. Notify the Customer of the breach and provide all information (to the extent feasible) required for an initial notification under the applicable Data Privacy Law(s) and as may be required for Customer to notify data subjects or authorities under the applicable Data Privacy Law(s);
   3. Take commercially reasonable steps to contain, remedy, and mitigate the effects of the breach;
   4. Provide commercially reasonable and appropriate assistance to Customer for any mitigation or remedial action related to the breach; and,
   5. Take commercially reasonable steps to restore the security and functionality of any systems or services compromised by the breach.

To the extent that a data breach is caused by Customer action, all costs incurred by OverDrive related to the foregoing shall be paid or reimbursed by Customer.

8. 1. OverDrive engages Amazon Web Services (AWS) and Microsoft Azure to store Personal Data described in Appendix A in the United States. In the event that OverDrive intends to engage a particular subprocessor or subprocessors, OverDrive will provide at least thirty (30) days notice to Customer prior to the first use thereof, including the name and location of the prospective subprocessor, the category or categories of Personal Data to be provided, and the nature of the subprocessing activity. If Customer does not provide a written objection to the prospective subprocessor within thirty (30) days after receiving such notice, Customer will be deemed to have consented to the use of the subprocessor. If Customer provides written objection and OverDrive engages the objected-to subprocessor, the Contract shall be deemed to be terminated without liability to either party as of the date of the objection.
   2. In the event that OverDrive engages a subprocessor or subprocessors for Personal Data, OverDrive shall enter into a written agreement requiring the engaged subprocessor to conform to substantially similar requirements as those herein concerning the protection of Personal Data; furthermore, OverDrive shall remain responsible for any breaches of this DPA caused by a subprocessor.
9. Access Requests. Customer shall be primarily responsible for complying with Data Subject Requests in regards to Personal Data. OverDrive shall be responsible for complying with Data Subject Requests in regard to OverDrive-Controlled Data. OverDrive shall, consistent with its obligations as processor and the nature of the Services, provide reasonable assistance to Customer in responding to Data Subject Requests concerning Personal Data, and with Customer’s other obligations relating to security, breach notification, impact assessment, and communication with authorities or regulators, as required by the appropriate Data Protection Law(s). Regarding Data Subject Requests for OverDrive-Controlled Data, OverDrive shall communicate directly with the data subject in question, and shall do so in compliance with all appropriate Data Protection Law(s).
10. Sale or Sharing of Personal Data.
    1. OverDrive does not and shall not:
       1. “Sell” or “Share” Personal Data as defined in the Data Protection Law(s);
       2. Retain, use, disclose, or otherwise process Personal Data save as necessary for the business purposes specified in the Contract or as described herein;

• Combine Personal Data with that received from or on behalf of any other Customer or entity, except as permitted under the Data Protection Law(s).

1. The foregoing shall not apply to Personal Data that has been anonymized and aggregated in compliance with the Data Protection Law(s).

11. Deletion of Personal Data. Upon termination of the Contract, OverDrive shall anonymize and/or delete Personal Data within a commercially reasonable timeframe.
12. Audit. OverDrive shall, no more than once in a calendar year, upon Customer request and at Customer expense, make available to the Customer such public-facing data and information as is necessary to demonstrate OverDrive’s compliance with this DPA and the Data Protection Law(s). Nothing herein shall be construed as providing Customer with a right of access to OverDrive’s offices, facilities, infrastructure, network, or systems, and OverDrive reserves the right to withhold, limit, or redact materials, in its sole discretion, due to privilege or confidentiality, nor shall OverDrive be required to provide information that can be obtained by Customer through the use of the Services.
13. International Transfers and Data Privacy Framework.
    1. Data processed by OverDrive is transferred to, and stored in, the United States of America in secure locations provided by Amazon Web Services, Microsoft Azure, and OverDrive’s own hosted servers located in Ohio and Pennsylvania. Where and while lawfully permitted, transfers of Personal Data to the United States shall be made pursuant to the relevant Adequacy Decision and/or Adequacy Regulation, or such other comparable mechanism as is appropriate under the Data Privacy Law(s).
    2. OverDrive has adopted the International Data Transfer Agreement (IDTA) to safeguard transfers of Personal Data from the UK to the United States.
    3. In addition to, and consistent with our other statements on privacy, OverDrive has adopted the required principles for the EU-U.S. Data Privacy Framework (DPF), UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, as set forth by the U.S. Department of Commerce. OverDrive has certified its compliance with the aforementioned Data Privacy Frameworks to the U.S. Department of Commerce.
    4. This DPA and OverDrive’s Privacy Policy adhere to the EU-U.S. DPF Principles with regard to personal data transferred from the European Union and the United Kingdom and the Swiss-U.S. DPF Principles with regard to personal data transferred from Switzerland. Under the DPF program OverDrive may be required to disclose PII in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.  OverDrive is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).  OverDrive is obligated to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to OverDrive and following the procedures and subject to conditions set forth in Annex I of the DPF Principles.  Consistent with the DPF Principle II. 3., OverDrive maintains accountability for onward transfers.  If an individual has an unresolved privacy or data use concern that OverDrive has not addressed satisfactorily, they may contact our U.S.-based third party dispute resolution provider (free of charge) at TRUSTe.
    5. In the event that an Adequacy Decision or Adequacy Regulation no longer applies or is sufficient to rely on, any UK Restricted Transfer or EU Restricted Transfer shall be governed by the Controller-to-Processor and Processor-to-Controller IDTA or SCCs (and/or UK Addendum, as applicable), which are incorporated by this reference.
14. In the event of any conflict or inconsistency between this DPA and the Contract, this DPA shall prevail to the extent of the inconsistency, provided that nothing herein shall be interpreted to permit OverDrive to process or otherwise handle Personal Data in a manner prohibited by the Contract or applicable law. OverDrive shall notify the Customer if it becomes aware of any reason it is no longer able to meet its obligations under any Data Protection Law(s), and shall take reasonable and appropriate steps to ensure that Personal Data use is consistent with Customer obligations under the Data Protection Law(s).

 

APPENDIX A – DESCRIPTION OF PROCESSING

1. Categories of data subjects whose personal data is transferred:
   1. Customer’s students (if Customer is a school)
   2. Customer’s library patrons (if Customer is a library)
   3. Customer’s employees (if Customer is a company)
   4. Customer employees accessing Marketplace to purchase content
2. Categories of personal data transferred:
   1. Library Card Numbers or other unique identifiers
   2. Student ID Numbers or other unique identifiers
   3. Corporate ID Numbers or other unique identifiers
   4. Student or corporate email address
   5. Student information (age, grade, class, and/or graduation year)
   6. Teacher names and/or email addresses

• Sensitive data transferred:
  1. None

1. Frequency of the transfer:
   1. Continuous
2. Nature of the Processing:
   1. Purchasing of, and provision of access to, digital library content to Customer’s authorized users pursuant to the terms of the Contract.
3. Period for which personal data will be retained:
   1. Term of the Contract.

• Subprocessors:
  1. Data storage by Amazon Web Services (US East).
  2. Data storage by Microsoft Azure (US East).