Data Protection Addendum

(Version v.2026.1)

This Data Protection Addendum (“Addendum”) sets forth the terms and conditions relating to R. R. Donnelley & Sons Company’s (“RRD”) processing of Personal Information (defined below) in compliance with the Applicable Data Protection Laws (defined below) in connection with the Goods provided by RRD to Customer pursuant to an Order. This Addendum is attached to and incorporated into the agreement by and between RRD and Customer.

Whereas, Customer is a business subject to the Applicable Data Protection Laws;

Whereas, RRD (i) is a service provider, a data processor, or data sub-processor as defined in the Applicable Data Projections Laws, providing Goods to Customer pursuant to the Agreement and (ii) processes, on behalf of Customer, Personal Information that is necessary to provide the Goods under the Agreement;

Now therefore, in consideration of the mutual covenants and agreements in this Addendum and the Agreement, and for other good and valuable consideration, the sufficiency of which is hereby acknowledged, Customer and RRD agree as follows:

Definition
1. “Personal Information” means information received from or on behalf of Customer that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, that may be (i) Processed at any time by RRD in anticipation of, in connection with or incidental to the performance of the Agreement or (ii) derived by RRD from such information.
2. “Applicable Data Protection Laws” means U.S. privacy laws and regulations in any relevant jurisdiction applicable to the respective party in its role in Processing Personal Information under the Agreement, including California Consumer Privacy Act of 2018, Cal. Civil Code § 1798.100 et seq. (“CCPA”) and Colorado Privacy Act of 2021 (“CPA”), as each is amended and modified from time to time.
Any capitalized term used but not defined herein shall have the meaning ascribed to it in the Applicable Data Protection Laws except that the definition of Personal Information set forth in this Addendum shall control in any and all cases.
Privacy of Personal Information
1. In addition to the representations, warranties and covenants set forth in the Agreement, RRD further represents, warrants and covenants as follows:
  1. RRD is acting solely as a service provider and/or data processor as defined in Applicable Data Protection Laws with respect to its Processing of Personal Information. RRD shall Process Personal Information only in accordance with the instructions from Customer as reflected in the Agreement.
  2. RRD shall not (1) Sell Personal Information, (2) retain, use or disclose Personal Information (i) for any purpose other than for the specific purpose of performing the services, or (ii) outside of the direct business relationship between Customer and RRD, unless otherwise required by law to do so, or (3) or (c) combine the Personal Information with personal information RRD receives from or on behalf of a third party or collects itself. RRD is prohibited from retaining, using, or disclosing the Personal Information outside of the direct business relationship between Customer and RRD, unless otherwise required by law.
  3. To the extent RRD provides to a subcontractor access to Personal Information, RRD will enter into a legally binding written agreement with each such subcontractor that (i) imposes obligations on the subcontractor that are at least equivalent to, and protective as, those imposed on RRD under this Addendum; (ii) requires such subcontractor to access, retain, Process and use Personal Information solely as necessary to provide the Goods to Customer or to RRD acting on Customer’s behalf; and (iii) prohibits such subcontractor from Selling Personal Information.
2. Upon Customer’s written request, RRD shall delete a particular individual’s Personal Information from RRD’s records, within the timeframe required by Applicable Data Protection Laws, where such record(s) exist within an in scope RRD system of record or application. Alternatively, where such record(s) exist in a print file provided to RRD, RRD will delete the record within the print file or the print file that the record(s) is contained within. In the event RRD is unable to delete the Personal Information for reasons permitted under the Applicable Data Protection Laws, RRD shall (i) promptly inform Customer of the reason(s) for its refusal of the deletion request to the extent allowable by law, (ii) ensure the privacy, confidentiality and security of such Personal Information as required by the Agreement, and (iii) delete the Personal Information promptly after the reason(s) for RRD’s refusal has expired. By sending a consumer’s request to delete covered Personal Information, Customer represents it has verified each such request and will hold harmless RRD from any third party claims related thereto. In addition, any such request by Customer shall identify other such relevant information as may be needed by RRD to identify the Personal Information, including on what date it was provided to RRD.
3. The Parties acknowledge and agree as follows:
  1. The Personal Information that Customer discloses to RRD is provided to RRD for a Business Purpose only, and that Customer will only provide Personal Information that is required for RRD to Process in connection with or incidental to the performance of the Agreement.
  2. During the time the Personal Information is disclosed to or accessible by RRD, the Parties have no knowledge or reason to believe that RRD is unable to comply with the provisions of this Addendum. RRD will notify Customer if it makes a determination that it can no longer meet its obligations under Applicable Data Protection Laws.
  3. If RRD receives a request to know, to opt out, or a request to delete directly from a consumer regarding the Personal Information, RRD shall without undue delay direct the consumer to contact Customer. Any response to such direct request from a consumer shall be the responsibility of Customer.
4. Customer has the right to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information. Such steps will be achieved by, at Customer’s direction, suspending further transfer of Personal Information to RRD, requiring RRD to securely delete and/or destroy Personal Information used to provide the Products, and receiving information RRD regarding its Processing of said Personal Information.
5. RRD shall not retain Personal Information for longer than is necessary to provide the Goods or as required for its reporting obligations to Customer. At the end of the work, or upon Customer’s written request, RRD, for itself and any subcontractors receiving Personal Information, will either securely delete, destroy, or return the Personal Information to Customer. This requirement shall not apply to the extent that RRD is required by any applicable law to retain some or all of the Personal Information and/or its record retention requirements for any said reports; provided, however, in both circumstances RRD shall continue to maintain the information security safeguards for such Personal Information so long as such information is maintained.
6. Customer has the right to take reasonable and appropriate steps to ensure that RRD uses Personal Information subject to the Agreement in a manner consistent with Applicable Data Protection Laws. Once annually upon written request, RRD will provide all reasonably necessary information to enable Customer to complete a data protection assessment to the extent required by law.
7. RRD certifies that it understands and will comply with the requirements and restrictions set forth in Section II of this Addendum.
Information Security; Miscellaneous
1. Each party shall comply with its obligations under Applicable Data Protection Laws with respect to any Personal Information it Processes under the Agreement and shall provide the same level of privacy protection as required by Applicable Data Protection Laws. And at a minimum, RRD shall maintain appropriate administrative, physical, and technical safeguards for protection of the security, confidentiality, and availability of data, including Confidential Information and Personal Information, received from or on behalf of Customer (collectively, “Customer Data”). RRD will take commercially reasonable steps to ensure that Customer Data is available only to authorized personnel who have a need to access it to provide the Goods. RRD shall not:
  1. modify Customer Data, except as specifically authorized and required for the provision of Goods under this Agreement;
  2. disclose Customer Data, except as compelled by law or as expressly permitted in writing by Customer;
  3. access Customer Data except to provide the Goods and to prevent or address service or technical problems, or at Customer’s request in connection with customer support matters. RRD agrees to abide by the security requirements outlined in this Agreement for any systems and facilities which receive, transmit, process or store Customer Data; and
  4. RRD has adopted the NIST CSF 2.0 framework as the foundation for RRD’s information security program. RRD will once annually upon written request provide Customer with its SOC2 Type II report.
2. The parties are required under Applicable Data Protection Laws to notify each other of the relevant individual within its organization authorized to respond from time to time to inquiries regarding any Personal Information. The relevant contact details are set out in the agreement and/or Order.
3. Customer represents and warrants that Customer has the authority and/or has obtained all necessary and sufficient consents from the subject individuals required to transfer, disclose, and use such Personal Information provided to RRD and Customer will defend and hold harmless RRD from any claims related thereto. Customer shall provide only the minimum necessary Personal Information required for RRD to provide the Goods under the Agreement. For the avoidance of doubt, Customer shall notify RRD of any changes in, or revocation of, permission by a consumer to use or Process Personal Information to the extent that such changes may affect RRD’s Processing or use of Personal Information. Customer shall not request RRD to Process or use Personal Information in any manner that would not be permissible if done by Customer.
4. This Addendum is the complete agreement between the Parties and supersedes any prior or other oral or written agreement between the Parties concerning compliance with the Applicable Data Protection Laws in connection with the Goods. In the event of any conflict between information privacy and security standards or any other obligations contained in this Addendum and the Agreement, the conflict will be interpreted to provide the greatest privacy and security protections to Customer.
5. The Parties mutually agree to enter into good faith negotiations to amend this Addendum from time to time in order for the Parties to comply with the requirements of applicable laws, as they may be amended from time to time, and any implementing regulations thereto that may be promulgated or revised from time to time. If the Parties are unable to agree on an amendment within thirty (30) days thereafter, then either of the parties may terminate this Addendum upon thirty (30) days written notice to the other party.
6. RRD’s obligations under this Addendum shall survive the termination of the Agreement and the completion of all the services, but shall terminate when RRD no longer holds any Personal Information.
7. If any provision of this Addendum is held invalid or unenforceable, the remaining provisions shall remain in effect.
8. This Addendum is binding upon successors and assigns of the Parties.
9. A waiver by either party of any term or condition of the Addendum in one or more instances shall not constitute a permanent waiver of the term or condition or any other term or condition of the Addendum or a general waiver.