Last Updated: 08/21/2026
Middesk Platform Services Agreement
Middesk Business Verification End User Terms And Conditions
These terms and conditions (“Middesk Terms and Conditions”) govern use by the organization as an end user (“End User”) of the Middesk, Inc. (“Middesk”) solutions (“Services”) provided through a third-party reseller (“Partner”) to End User. Middesk and End User are collectively referred to as the “Parties” and are each individually referred to as a “Party.”
1. SERVICES ACCESS. End User is responsible for obtaining and maintaining any equipment needed to access the Services (e.g., computers, operating system, internet connection, etc.). End User is also responsible for maintaining the security of, and for all uses (even if such use is without End User’s knowledge or consent) of, End User’s: (i) account; (ii) passwords; and (iii) equipment used to access the Services.
2. LICENSE GRANT AND RESTRICTIONS
2.1. General. End User’s access of the Services through Middesk’s platform, including any online portal or related tools made available to other customers, (the “Platform”), and related application programming interface(s) used to provide the Services (“API(s)”), are subject to these Middesk Terms and Conditions.
2.2. Use License. Subject to the provisions of these Middesk Terms and Conditions, Middesk agrees to provide End User with access to the Services through the Platform and related APIs. Subject to End User’s compliance with the terms and conditions of these Middesk Terms and Conditions, Middesk hereby grants to End User a non-exclusive, non-transferable and non-sublicensable right to use the Platform solely to receive the Services.
2.3. Middesk Data License. As used in these Middesk Terms and Conditions, “Middesk Data” means business data, beneficial owner data, market data, and other data or information related to businesses that Middesk has collected, licensed, or generated. Middesk Data includes any such data delivered by Middesk to End User in response to an End User query. Middesk Data does not include End User Data. Information remains Middesk Data, and does not become End User Data, even if End User separately submits the same or substantially similar information to Middesk. Subject to End User’s compliance with the terms and conditions of these Middesk Terms and Conditions, Middesk hereby grants to End User a non-exclusive, non-transferable and non-sublicensable right to access the Middesk Data through the Services. Middesk reserves the right to withdraw or restrict access to Middesk Data or the Services to meet any requirement imposed by federal, state, or local law, rule or regulation, a third-party supplier, or to address matters concerning privacy, confidentiality or security, upon reasonable notice to End User. End User will satisfy any condition that a data source places on access to, or use of, the Middesk Data (such as a legitimate-interest requirement for beneficial-owner data), of which Middesk notifies End User. If End User cannot satisfy any such condition, End User will cease accessing and using the affected Middesk Data until it can.
2.4. Restrictions.
2.4.1. End User may only access and use the Platform, Services and Middesk Data for End User’s own internal business purposes, and shall not sell, resell, lease, distribute, or transfer any form of license to any third-party. End User may only access and use the Platform, Services, and Middesk Data in the manner explicitly permitted in these Middesk Terms and Conditions and will not directly or indirectly (i) reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas, know-how or algorithms relevant to the Services or any software, documentation or data related to the Platform; (ii) use, transform, modify, or adapt the Services, Platform, or Middesk Data for any other purpose, including but not limited to the development or functioning of any product or service that is competitive, in part or in whole, with any existing or reasonably anticipated product or service of Middesk; (iii) use the Services or Platform for timesharing or service bureau purposes or otherwise for the benefit of a third-party; (iv) remove any proprietary notices or labels; or (v) use the Services, Platform, or Middesk Data in a manner which violates any applicable law, rule, or regulation.
2.4.2. Unless otherwise permitted by Middesk in writing, End User may not resell, share, disclose, modify, or create derivative works from Middesk Data, and may only access, receive, and use Middesk Data in the manner explicitly permitted under these Middesk Terms and Conditions. End User: (a) acknowledges that the Services provided by Middesk under these Middesk Terms and Conditions do not include any consumer report information as defined in Fair Credit Reporting Act (“FCRA”) Section 603(d); and (b) shall not use, or permit its servicers, vendors, or any third-party, to use Middesk Data in any way that would cause Middesk to be viewed as a credit reporting agency under state or federal laws.
3. INTELLECTUAL PROPERTY; DATA PRIVACY
3.1. Proprietary Rights. As between End User and Middesk, Middesk reserves all right, title and interest in and to the Services, the Middesk Platform, and Middesk Data, including all intellectual property rights embodied therein, which shall remain the sole and exclusive property of Middesk or its licensors. Except for the limited license rights expressly granted hereunder, these Middesk Terms and Conditions do not transfer or convey to End User or any third-party any ownership interest in or to the Services, the Middesk Platform, or Middesk Data. End User acknowledges that the Middesk Data is an original compilation protected by United States copyright laws. End User grants Middesk a non-exclusive, worldwide, royalty-free, sublicensable, perpetual, irrevocable license to use, modify, and incorporate any suggestions, ideas, enhancement requests, recommendations, or other feedback provided by End User to Middesk relating to the Platform (“Feedback”) into Middesk's products and services. This license survives any termination or expiration of this Agreement. Middesk shall not publicly attribute Feedback to End User without End User’s prior written consent. Nothing in this Section transfers ownership of any intellectual property of End User.
3.2. End User Data.
3.2.1. As between End User and Middesk, End User reserves all right, title and interest in and to the non-public information provided to Middesk by End User, or by Partner on behalf of End User, in connection with the Services (“End User Data”). Middesk agrees and acknowledges that the End User Data is the exclusive property of End User. End User Data does not include Middesk Data. End User represents and warrants that it shall comply with all applicable laws, rules, and regulations, including by obtaining all necessary rights, licenses, or consents from individuals, for the transmission and processing of End User Data by Middesk.
3.2.2. Except as otherwise expressly agreed in writing between the Parties, Middesk may only use End User Data to provide the Services to End User. Notwithstanding the foregoing, Middesk will have the right to collect and analyze data and other information relating to the provision, use, and performance of various aspects of the Services provided to the End User and related systems and technologies (including data derived from End User Data, where such End User Data is de-identified) (the “Usage Data”). As between the Parties, Middesk shall own the Usage Data and shall be free to use such Usage Data for the improvement and enhancement of the Services and for other development, diagnostic, and corrective purposes in connection with the Services and other Middesk offerings. Middesk may disclose the Usage Data, only in an aggregated and de-identified form that does not specifically identify End User, in connection with Middesk’s business. No additional rights or licenses are granted except as expressly set forth herein.
3.2.3. Data Protection; Data Processing Addendum. Middesk does not sell or share End User Data (as “sell” and “share” are defined in applicable United States state privacy laws) and uses End User Data only as permitted by this Section 3.2. The Middesk End User Data Processing Addendum attached as Appendix 1 (the “End User DPA”) applies and forms part of these Middesk Terms and Conditions only where: (a) Middesk processes personal information or personal data contained in End User Data on End User’s behalf, and End User’s processing of such data in connection with the Services is subject to the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, or other applicable data protection law that requires a written data processing agreement between End User and Middesk; or (b) Middesk and End User agree in writing (email sufficient) that it applies. Where the End User DPA applies, each Party is deemed to have executed it (including any standard contractual clauses incorporated therein, where applicable) upon the later of End User’s first access to the Services and the date on which it begins to apply, and in the event of a conflict between these Middesk Terms and Conditions and the End User DPA with respect to personal information or personal data, the End User DPA controls.
3.3. Machine Learning; GenAI. The Services incorporate ML and GenAI as core components of their operation and delivery. The restrictions in this Section on the use of End User Data for ML training or model improvement apply to End User Data in identifiable form. The restrictions in this Section on the use of End User Data for GenAI training or model improvement apply to End User Data in any form. Any use of End User Data beyond the scope of this Section requires End User's express written consent.
3.3.1. Machine Learning. Middesk may process End User Data using computer programs and algorithmic models that are capable of learning trends and patterns from data to make predictions or recommendations ("Machine Learning" and "ML") in order to provide the Services. Middesk shall not use End User Data in identifiable form to train or improve its ML models. For the avoidance of doubt, Middesk may extract, aggregate, and use anonymized or de-identified features and signals derived from End User Data to train and improve its ML models, provided that such derived features cannot reasonably be used to re-identify End User or any individual whose data is reflected in the End User Data.
3.3.2. Generative AI. Middesk may use systems that can create new content that reflects general characteristics of training data without necessarily duplicating the training data, such as text generation from large language models, ("Generative AI" or "GenAI") to process End User Data for the purpose of delivering the Services to End User. Middesk may not use End User Data in any form to train or fine-tune GenAI models, including by using End User Data to update the weights or parameters of any GenAI model. Middesk shall require any third-party provider of generative AI technology used to process End User Data in connection with the Services to agree, by contract, not to use End User Data to train or improve their models
3.3.3. As used in these Middesk Terms and Conditions, “Probabilistic Outputs” means any reports, summaries, findings, recommendations, scores, risk indicators, classifications, labels, and other content generated in whole or in part by GenAI, ML, or other statistical or probabilistic models used in the Services.
4. CONFIDENTIALITY; SECURITY
4.1. Confidentiality. Each Party receiving information (the “Receiving Party”) understands that the other Party (the “Disclosing Party”) has disclosed or may disclose business, technical, or financial information relating to the Disclosing Party’s business (hereinafter referred to as “Proprietary Information” of the Disclosing Party). Proprietary Information of Middesk includes but is not limited to Middesk Data, non-public information regarding features, functionality, and performance of the Service. Proprietary Information of End User includes End User Data, and any other non-public data provided by End User to Middesk to enable the provision of the Services. The Receiving Party acknowledges that the Disclosing Party has disclosed or may disclose Proprietary Information, and agrees to: (a) use Proprietary Information solely as necessary to perform its obligations or exercise its rights under this Agreement; and (b) not disclose Proprietary Information to any third-party except to its personnel, subcontractors, and professional advisors who are bound by confidentiality obligations no less protective than those of this Agreement. The Receiving Party remains responsible for any breach of this Section 4 by any person to which it discloses Proprietary Information.
4.2. Exceptions. Each Party agrees that the foregoing will not apply with respect to any information that the other Party can document (a) is or becomes generally available to the public, (b) was in its possession or known by it prior to receipt from the Disclosing Party, (c) was rightfully disclosed to it without restriction by a third-party, or (d) was independently developed without use of any Proprietary Information of the Disclosing Party. The Receiving Party may also disclose Proprietary Information in response to a valid order of a court or other governmental body or as otherwise required by law to be disclosed; provided that, the Receiving Party gives sufficient notice to the Disclosing Party to enable the Disclosing Party to take protective measures, and in any event the Receiving Party will disclose only the Proprietary Information, or portion thereof, specifically requested.
4.3. Security. Each Party agrees to: (a) implement reasonable physical, organizational, and technological safeguards that are appropriate to the sensitivity of the other Party’s Proprietary Information, designed to protect the confidentiality, security, and integrity of such Proprietary Information, in accordance with industry standards, or, if such information is protected by law, in accordance with applicable law; and which are in no case less stringent than those used to protect its own Proprietary Information; (b) restrict access to the Proprietary Information to only those individuals who require such access to perform their duties or services under this Agreement, and provide appropriate training to such individuals respecting handling Proprietary Information in accordance with applicable laws and this Agreement; (c) promptly advise the other Party of all inquiries, complaints, access requests, and other communications regarding Proprietary Information, and cooperate with the other Party to respond to such communications; (d) notify the other Party without undue delay, in writing, of any unauthorized access to, or use or disclosure of, Proprietary Information (a “Security Breach”), and cooperate with the other Party to remedy any Security Breach, and meet any requirements prescribed by law in respect of such Security Breach, including cooperation and agreement on any notification to affected individuals or regulatory authorities required by applicable law.
5. REPRESENTATIONS AND WARRANTIES; DISCLAIMER
5.1. Middesk will use commercially reasonable efforts consistent with prevailing industry standards to maintain the Services in a manner that minimizes errors and interruptions in the Services and will perform the Services in a professional and workmanlike manner.
5.2. EXCEPT FOR THE EXPRESS WARRANTIES IN SECTION 5.1, MIDDESK PROVIDES THE SERVICES, MIDDESK DATA, PROBABILISTIC OUTPUTS, AND ALL RELATED MATERIALS "AS IS," AND DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, CURRENTNESS, CORRECTNESS, RELIABILITY, TIMELINESS, AND UNINTERRUPTED OR ERROR-FREE OPERATION. MIDDESK DOES NOT WARRANT THAT THE SERVICES WILL MEET END USER'S REQUIREMENTS.
5.3. END USER ACKNOWLEDGES THAT PROBABILISTIC OUTPUTS ARE INHERENTLY PROBABILISTIC, MAY PRODUCE FALSE POSITIVES AND FALSE NEGATIVES, AND ARE NOT GUARANTEED TO BE ACCURATE, COMPLETE, CURRENT, OR CORRECT. MIDDESK DOES NOT WARRANT THE CORRECTNESS OF ANY PROBABILISTIC OUTPUT, AND END USER IS RESPONSIBLE FOR INDEPENDENTLY REVIEWING AND DECIDING WHETHER TO RELY ON ANY PROBABILISTIC OUTPUT. NOTHING IN THIS SECTION LIMITS MIDDESK'S OBLIGATION TO PERFORM THE SERVICES IN A PROFESSIONAL AND WORKMANLIKE MANNER UNDER SECTION 5.1.
5.4. WITHOUT LIMITING THE GENERALITY OF SECTION 5.2 OF THIS AGREEMENT, END USER ACKNOWLEDGES AND AGREES THAT BECAUSE THE SERVICE INVOLVES CONVEYING INFORMATION PROVIDED TO OR COLLECTED BY MIDDESK FROM OTHER SOURCES, MIDDESK CANNOT AND WILL NOT, FOR THE FEES CHARGED FOR THE SERVICE, BE AN INSURER OR GUARANTOR OF THE ACCURACY OR RELIABILITY OF THE SERVICE, THE MIDDESK DATA, OR ANY PROBABILISTIC OUTPUT.
6. INDEMNIFICATION
6.1. Middesk Indemnification.
6.1.1. IP Indemnification. Middesk will defend, indemnify, and hold End User and its directors, officers, and employees harmless from and against any third-party liabilities, damages, losses, judgments, costs, expenses (including reasonable attorneys’ fees), claims, actions, demands and suits (collectively “Claims”) arising out of or relating to liability to third parties resulting from an allegation of infringement by the Service of any patent, copyright, or misappropriation of any trade secret. The foregoing obligations do not apply with respect to portions or components of the Service to the extent (i) not supplied by Middesk, (ii) made in accordance with End User specifications, (iii) modified by End User, or any third-party after delivery by Middesk, (iv) commercialized by End User or combined with other products, processes, or materials where the alleged infringement relates to such combination, (v) where End User continues allegedly infringing activity after being notified thereof or after being informed of modifications that would have avoided the alleged infringement, or (vi) where End User’s use of the Service is in material breach of these Middesk Terms and Conditions and such breach is the proximate cause of the alleged infringement. If, due to a claim of infringement, the Services are held by a court of competent jurisdiction to be, or are believed by Middesk to be, infringing, Middesk may, at its option and expense (a) replace or modify the Service to be non-infringing provided that such modification or replacement contains substantially similar features and functionality, (b) obtain for End User a license to continue using the Service, or (c) if neither of the foregoing is commercially practicable, terminate these Middesk Terms and Conditions and End User’s rights hereunder.
6.1.2. Other Indemnification. Middesk will also defend, indemnify, and hold End User and its directors, officers, and employees harmless from and against any Claims to the extent arising out of liability to third parties resulting from Middesk’s gross negligence, fraud, or intentional misconduct.
6.1.3. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, THIS SECTION CONSTITUTES THE ENTIRE LIABILITY OF MIDDESK, AND END USER’S SOLE AND EXCLUSIVE REMEDY, FOR ANY THIRD-PARTY CLAIMS FOR WHICH MIDDESK HAS INDEMNIFICATION OBLIGATIONS UNDER THIS SECTION 6.1.
6.2. End User Indemnification. End User will defend, indemnify, and hold Middesk and its directors, officers and employees harmless from and against any third-party liabilities, damages, losses, judgments, costs, expenses (including reasonable attorneys’ fees), claims, actions, demands and suits arising out of or relating to liability to third parties resulting from End User’s (i) use of the Platform or Services other than as expressly authorized under these Middesk Terms and Conditions; (ii) breach of its obligation to obtain the rights or licenses necessary, including consents from individuals, to authorize Middesk’s processing of End User Data; (iii) breach of Section 2, Section 3, or Section 4 of these Middesk Terms and Conditions; and (iv) gross negligence, fraud, or intentional misconduct.
6.3. Indemnification Procedure. Each Party shall promptly notify the other Party in writing of any Claim for which such Party believes it is entitled to be indemnified pursuant to this Section. The Party seeking indemnification (the "Indemnitee") shall cooperate with the other Party (the "Indemnitor") at the Indemnitor's sole cost and expense. The Indemnitor shall promptly assume control of the defense and shall employ counsel reasonably acceptable to the Indemnitee to handle and defend the same, at the Indemnitor's sole cost and expense. The Indemnitee may participate in and observe the proceedings at its own cost and expense with counsel of its own choosing. The Indemnitor shall not settle any Claim without the Indemnitee's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed; provided that no consent is required for a settlement that (i) involves only the payment of money by the Indemnitor, (ii) includes no admission of fault or liability by or on behalf of the Indemnitee, (iii) imposes no injunctive or other non-monetary obligation on the Indemnitee, and (iv) includes a full and unconditional release of the Indemnitee with respect to the Claim. If the Indemnitor fails or refuses to assume control of the defense of such Claim, the Indemnitee shall have the right, but no obligation, to defend against such Claim, including settling such Claim after giving notice to the Indemnitor, in each case in such manner and on such terms as the Indemnitee may deem appropriate. The Indemnitee's failure to perform any obligations under this Section will not relieve the Indemnitor of its obligations under this Section, except to the extent that the Indemnitor can demonstrate that it has been materially prejudiced as a result of such failure.
7. LIMITATION OF LIABILITY
7.1. NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, PUNITIVE, SPECIAL, RELIANCE, INCIDENTAL, CONSEQUENTIAL, OR SIMILAR DAMAGES (INCLUDING LOSS OF REVENUE OR PROFITS), DAMAGES TO BUSINESS REPUTATION, DAMAGES ARISING FROM LOSS OF BUSINESS WITH THIRD PARTIES, LOSS OF PROFITS FROM TRANSACTIONS WITH THIRD PARTIES, OR WILLFUL INFRINGEMENT BY THE OTHER PARTY ARISING OUT OF OR RELATING TO THIS AGREEMENT, INCLUDING THE USE OR INABILITY TO USE THE SERVICE, OR FOR ANY INFORMATION OBTAINED FROM OR THROUGH THE SERVICE, ANY INTERRUPTION, INACCURACY OR ERROR IN THE CONTENT, EVEN IF SUCH PARTY HAS BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE FOREGOING WAIVER DOES NOT APPLY TO DAMAGES ARISING FROM A PARTY'S WILLFUL AND INTENTIONAL INFRINGEMENT OF THE OTHER PARTY'S INTELLECTUAL PROPERTY RIGHTS.
7.2. END USER AGREES THAT, EXCEPT FOR (A) MIDDESK’S INDEMNIFICATION OBLIGATIONS AND (B) MIDDESK’S BREACH OF ITS CONFIDENTIALITY OR DATA SECURITY OBLIGATIONS UNDER SECTION 4, MIDDESK’S TOTAL AGGREGATE LIABILITY UNDER THE AGREEMENT, REGARDLESS OF THE NATURE OF THE LEGAL OR EQUITABLE RIGHT CLAIMED TO HAVE BEEN VIOLATED, IS LIMITED TO DIRECT DAMAGES WHICH WILL NOT EXCEED THE AMOUNTS ACTUALLY RECEIVED BY MIDDESK FROM PARTNER THAT ARE ATTRIBUTABLE TO END USER’S USE OF THE PARTICULAR SERVICES THAT ARE THE SUBJECT OF THE CLAIM DURING THE TWELVE-MONTH PERIOD PRECEDING THE DATE ON WHICH THE CLAIM WAS MADE.
7.3. NOTWITHSTANDING THE FOREGOING: (A) MIDDESK’S TOTAL AGGREGATE LIABILITY TO END USER FOR MIDDESK’S BREACH OF ITS CONFIDENTIALITY OR DATA SECURITY OBLIGATIONS UNDER SECTION 4 WILL NOT EXCEED TWO (2) TIMES THE AMOUNTS ACTUALLY RECEIVED BY MIDDESK FROM PARTNER THAT ARE ATTRIBUTABLE TO END USER’S USE OF THE PARTICULAR SERVICES THAT ARE THE SUBJECT OF THE CLAIM DURING THE TWELVE-MONTH PERIOD PRECEDING THE DATE ON WHICH THE CLAIM WAS MADE; AND, (B) MIDDESK’S TOTAL AGGREGATE LIABILITY TO END USER FOR MIDDESK’S IP INDEMNIFICATION OBLIGATIONS UNDER SECTION 6.1.1 WILL NOT EXCEED FIVE (5) TIMES THE AMOUNTS ACTUALLY RECEIVED BY MIDDESK FROM PARTNER THAT ARE ATTRIBUTABLE TO END USER’S USE OF THE PARTICULAR SERVICES THAT ARE THE SUBJECT OF THE CLAIM DURING THE TWELVE-MONTH PERIOD PRECEDING THE DATE ON WHICH THE CLAIM WAS MADE.
7.4. FOR THE AVOIDANCE OF DOUBT, MIDDESK’S GROSS NEGLIGENCE, FRAUD, AND INTENTIONAL MISCONDUCT INDEMNIFICATION OBLIGATIONS UNDER SECTION 6.1.2 ARE NOT SUBJECT TO ANY AGGREGATE CAP SET FORTH IN THIS SECTION 7.
7.5. END USER ACKNOWLEDGES THAT THIS LIMITATION OF LIABILITY SECTION APPLIES TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, REPRESENTS A FAIR ALLOCATION OF THE RISK BASED ON THE FEES MIDDESK CHARGES FOR THE SERVICES, AND APPLIES EVEN IF AN EXCLUSIVE OR LIMITED REMEDY STATED IN THIS AGREEMENT FAILS OF ITS ESSENTIAL PURPOSE.
7.6. THE CAPS IN THIS SECTION 7 ARE AGGREGATE ACROSS ALL CLAIMS AND CLAIMANTS. AMOUNTS PAID BY MIDDESK TO PARTNER, OR TO ANY OTHER END USER THAT RECEIVES THE SERVICES THROUGH PARTNER, IN RESPECT OF THE SAME SERVICES COUNT TOWARD AND REDUCE THE APPLICABLE CAPS IN THIS SECTION 7.
8. Term; Termination. These Middesk Terms and Conditions take effect when End User first accesses the Services through Partner and continue until the earliest of: (a) termination or expiration of End User’s agreement with Partner; (b) termination or expiration of the agreement between Middesk and Partner, subject to any wind-down period provided thereunder; and (c) termination by Middesk upon written notice for End User’s material breach of these Middesk Terms and Conditions that remains uncured thirty (30) days after written notice, except that no cure period applies to End User’s misuse of Middesk Data. Upon termination, End User’s rights to access and use the Services and Middesk Data immediately cease, and all provisions that by their nature should survive (including confidentiality, warranty disclaimers, indemnification, and limitations of liability) will survive. Middesk may offer End User a direct agreement at any time.
9. MISCELLANEOUS
9.1. Amendments or Modifications. These Middesk Terms and Conditions may be amended or modified only by the written agreement of all the Parties.
9.2. Severability. If any provision of these Middesk Terms and Conditions is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that these Middesk Terms and Conditions will otherwise remain in full force, effect, and enforceability.
9.3. Assignment. Neither Party may assign this Agreement without the prior written consent of the other Party, except (a) in connection with a merger, acquisition, or sale of all or substantially all of a Party’s assets or voting securities; or (b) to an Affiliate of the assigning Party, upon written notice to the other Party and provided that the assigning Party remains jointly and severally liable for the obligations of the Affiliate under this Agreement. This Agreement binds and benefits the Parties and their respective successors and permitted assigns. For the purposes of these Terms and Conditions “Affiliate” means any entity that controls, is controlled by, or is under common control with a Party, where “control” means ownership of more than fifty percent (50%) of the voting securities or equivalent voting interests. Any other transfer or assignment of this Agreement except as expressly authorized under this section will be null and void.
9.4. Entire Agreement. These Middesk Terms and Conditions are the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements, communications, and other understandings relating to the subject matter of these Middesk Terms and Conditions. The Parties agree that all waivers and modifications must be in a writing signed by both Parties, except as otherwise provided herein.
9.5. Relationship Between the Parties. No agency, partnership, joint venture, or employment is created as a result of these Middesk Terms and Conditions, and End User does not have any authority of any kind to bind Middesk in any respect whatsoever.
9.6. Notices. All notices under these Middesk Terms and Conditions will be in writing and sent, in the case of Middesk, to Middesk, Inc., Attn: Legal Department, at Middesk’s then-current principal place of business, and in the case of End User, to the notice address provided by End User to Partner in connection with the Services, and will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by e-mail; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested. Each Party shall notify the other in writing in the event of a change of address.
9.7. Force Majeure. Except for payments due under these Middesk Terms and Conditions, neither Party will be responsible for any failure to perform or delay in performance to the extent attributable to any cause beyond its reasonable control, including acts of God, natural disasters (such as fire, storm, flood, or earthquake), pandemic, epidemic, or other public health emergency, war, acts of terror, civil disturbances, government action or inaction, orders, or injunctions, disruption of telecommunications, internet connectivity, cloud infrastructure, power, or other essential services, interruption or termination of service by any third-party service provider, failure of third-party software, labor disturbances, computer viruses, denial-of-service attacks, network intrusions, or other malicious or unlawful acts of any third-party (each, a “Force Majeure Event”); provided that, with respect to computer viruses, denial-of-service attacks, and network intrusions, the affected Party has used industry-standard security measures designed to prevent them.
9.8. Export Law. End User agrees to comply with all export restrictions under applicable law in connection with the Services.
9.9. Governing Law. These Middesk Terms and Conditions are governed by and construed in accordance with the laws of the state of California, without giving effect to its conflict of laws provisions.
9.10. Arbitration.
9.10.1. Forum and Administrator. Any dispute not resolved by the Parties by mutual consultation will be determined by arbitration in San Francisco, California before a single arbitrator. The arbitration will be administered by JAMS. If JAMS is no longer in business or refuses or declines to administer any dispute between the Parties brought before it, either Party may petition the United States District Court for the Northern District of California to appoint the arbitrator.
9.10.2. Rules. For claims greater than $250,000, the JAMS Comprehensive Arbitration Rules and Procedures in effect at the time the arbitration is commenced will apply. For claims less than or equal to $250,000, the JAMS Streamlined Arbitration Rules in effect at the time the arbitration is commenced will apply. To the extent permitted by applicable law, all arbitration proceedings will be subject to the Confidentiality Section of this Agreement.
9.10.3. Substantive Law. The arbitrator will apply the substantive law of the State of California, exclusive of its conflict or choice of law rules.
9.10.4. Provisional Remedies. Nothing in this section will preclude the Parties from seeking provisional remedies in aid of arbitration from a court of appropriate jurisdiction.
9.10.5. Class Action Waiver. THE PARTIES AGREE THAT ALL DISPUTES WILL BE BROUGHT IN THEIR INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING; THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT PRESIDE OVER ANY FORM OF REPRESENTATIVE OR CLASS PROCEEDING.
9.10.6. FAA. The Parties acknowledge that this Agreement evidences a transaction involving interstate commerce. Notwithstanding the provisions in this paragraph referencing applicable substantive law, the Federal Arbitration Act (9 U.S.C. §§ 1-16) will govern any arbitration conducted pursuant to the terms of this Agreement.
9.10.7. Commencement. Either Party may commence arbitration by providing to JAMS and the other Party to the dispute a written demand for arbitration, setting forth the subject of the dispute and the relief requested.
9.10.8. Continued Performance. The existence of a dispute and the observance by the Parties of the dispute resolution procedures in this section will not: (a) excuse any Party from continuing to perform its obligations under this Agreement; or (b) suspend any obligation to pay any amount otherwise due and payable under this Agreement unless that obligation or the amount (to the extent in dispute) is itself the subject of the dispute.
9.10.9. Injunctive Relief. Nothing in this Agreement affects the right of a Party to institute proceedings to seek urgent injunctive or declaratory relief in respect of a dispute or any matter arising under this Agreement.
9.10.10. Fees. If any dispute leads to an arbitration or other legal proceeding to resolve such dispute, the prevailing Party in such proceeding will be entitled to receive its reasonable attorneys’ fees, expert witness fees and out-of-pocket costs incurred in connection with such proceeding, in addition to any other relief it may be awarded.
APPENDIX 1
to the Middesk Business Verification End User Terms and Conditions
MIDDESK END USER DATA PROCESSING ADDENDUM
This End User Data Processing Addendum (“DPA”) forms part of the Middesk Terms and Conditions to which it is attached (the “Agreement”), between Middesk and End User, and applies where and as provided in Section 3.2.3 of the Agreement. In the event of a conflict between this DPA and the body of the Agreement, this DPA shall control with respect to Personal Information. Terms used but not defined herein shall have the meaning ascribed to them in the Agreement.
This DPA is supplemental to the Agreement and sets out the terms that apply when Personal Information is Processed by Middesk under the Agreement. The purpose of this DPA is to ensure such Processing is conducted in accordance with Applicable Laws (as defined below), including the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100, et seq., as may be amended from time to time (“CCPA”).
1. Definitions: For the purposes of this DPA:
1.1. “Applicable Laws” means all (i) United States federal or state privacy and data protection laws applicable to Personal Information in the commercial context, including the CCPA, and (ii) the GDPR, including in both (i) and (ii) any implementing regulations relating to the same; in each case, as amended, superseded, or replaced.
1.2. “Business Purpose” means the Services described in the Agreement or any other purpose specifically identified in the Agreement, as further described in Annex A.
1.3. “Consumer” means a natural person who is the subject of Personal Information.
1.4. “Consumer Requests” means requests from individuals seeking to exercise their rights under Applicable Law with respect to Personal Information.
1.5. “GDPR” means the Regulation (EU) 2016/679 (General Data Protection Regulation) and, where applicable, the GDPR as incorporated into United Kingdom law (the “UK GDPR”) and the Swiss Federal Act on Data Protection.
1.6. “Processing” or “Processed” means any operation or set of operations that are performed on Personal Information or on sets of Personal Information, whether or not by automated means.
1.7. “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household and that is not otherwise exempt from the category of Personal Information as defined under Applicable Law. For purposes of clarity Personal Information does not include Middesk Data.
1.8. “Sell” and “Share” have the meaning defined in Applicable Laws.
1.9. “Subcontractor” means all subcontractors, service providers, and vendors of Middesk that are involved in Processing of Personal Information in connection with the provision of the Services.
2. Middesk Status. The Parties agree that with respect to the Personal Information Middesk is a “service provider” or “processor” as those terms are defined in Applicable Laws. For clarity, with respect to Middesk Data (including any business or beneficial-owner information that Middesk has independently collected, licensed, or generated), Middesk acts as a “business” or “controller” as those terms are defined in Applicable Laws and is independently responsible for its own compliance with Applicable Laws with respect to such data. This DPA applies only to Personal Information that Middesk Processes on End User’s behalf.
3. Middesk Obligations. Middesk agrees that:
3.1. Middesk will notify End User promptly and without undue delay if Middesk makes a determination that it can no longer meet its obligations under Applicable Law.
3.2. With respect to Personal Information, Middesk shall (1) only Process the Personal Information for the Business Purposes in accordance with End User’s written instructions, including the Agreement and this DPA; (2) not Sell or Share the Personal Information; (3) not retain, use, or disclose the Personal Information for any purpose other than provision of the Services or as otherwise permitted by Applicable Law; (4) not retain, use, or disclose any Personal Information outside the direct business relationship between Middesk and End User, except as permitted by Applicable Law; (5) not combine Personal Information with personal information Middesk received from another source, including from Middesk’s own interaction with a Consumer, except as permitted by Applicable Law.
3.3. Middesk shall ensure that any person it authorizes to Process Personal Information is subject to obligations of confidentiality.
3.4. Middesk may engage Subcontractors, where Middesk shall enter into a contract with such Subcontractor(s) that is no less protective than the applicable provisions of this DPA and Middesk shall remain responsible for Subcontractors’ performance hereunder. When required by Applicable Laws, Middesk shall provide End User at least thirty (30) days’ prior notice of any new Subcontractor (which Middesk may give directly, through Partner, or by updating a Subcontractor list made available by Middesk), where End User shall have a period of twenty-one (21) days to object in good faith to the use of the new Subcontractor. In the event of such objection, End User and Middesk shall work in good faith to resolve such objection. If the Parties cannot resolve the objection within thirty (30) days, End User may cease using and terminate the affected Service(s) by written notice to Middesk and Partner; any credit or refund of amounts pre-paid by End User is a matter between End User and Partner under their agreement.
3.5. Middesk shall implement and maintain administrative, technical, and physical safeguards reasonably designed to protect the Personal Information, including safeguards required under the Agreement and any security requirements incorporated therein. For clarity, the Security Breach provisions of the Agreement shall apply with respect to Personal Information under this DPA.
3.6. Middesk shall reasonably assist End User with meeting its compliance obligations under Applicable Law, taking into account the nature of Middesk's Processing and the information available to Middesk, including data protection impact assessments and consultation with regulatory authorities. End User shall reimburse Middesk for any assistance that exceeds the reasonable scope of Middesk's role as a service provider.
3.7. Upon End User’s written request, within sixty (60) days of termination or expiration of the Agreement, Middesk will delete (or, at End User’s written election made in such request, return) Personal Information, except to the extent retained in standard backup systems subject to Middesk's normal retention and destruction schedule, or as required by applicable law. This obligation is in addition to, and does not supersede, any End User Data deletion or cessation-of-use obligation in the Agreement.
3.8. Upon End User’s written request, no more than once per year, unless a breach of this DPA is reasonably suspected, Middesk shall make available to End User information reasonably necessary to demonstrate Middesk’s compliance with this DPA, including a summary of Middesk’s most recent Service Organization Control 2 (Type I or II) report or industry-standard successor report. Such information is Middesk’s Proprietary Information.
4. Cooperation with Consumer Requests. With respect to Consumer Requests, the Parties agree as follows:
4.1. Middesk, taking into account the nature of the Processing of Personal Information, shall provide End User with such assistance as may be reasonably necessary and technically feasible to assist End User in fulfilling its obligation to respond to Consumer Requests.
4.2. Further, Middesk shall: (a) promptly and without undue delay notify End User if it receives a Consumer Request; and (b) not respond to any Consumer Request except: (i) to advise the individual to submit the request to End User, after which End User will be responsible for responding to any such request; (ii) on the written instructions of End User (and in such circumstances, at End User’s cost); or (iii) as required by Applicable Laws.
5. Transfer mechanisms
5.1. Where End User is subject to the GDPR pursuant to Article 3(1) or Article 3(2), Middesk will make available the transfer mechanisms based on the Standard Contractual Clauses attached as Annex B. The Annex B mechanisms apply to any transfers of End User's Personal Information under this DPA from the European Economic Area (and member states), Switzerland, or the United Kingdom to countries that do not ensure an adequate level of data protection within the meaning of the GDPR.
5.2. For any other cross-border transfers, including forward transfers, of End User’s Personal Information subject to the GDPR, Middesk shall take steps necessary to ensure the compliance with the GDPR.
6. Survival. This DPA shall survive termination or expiration of the Agreement for so long as Middesk Processes Personal Information.
Annex A to End User DPA
Personal Information Processing and Details
1. Subject Matter and Services of Processing. Provision of business verification services (including matching identifying information against public records, government records, and third-party data sources, and returning verification results, risk signals, and pre-filled data values to End User), lien filing services, and/or entity management services (including registered agent services, government account creation, and formation), as made available to End User through Partner.
2. Duration of Processing. Term of the agreement.
3. Consumer Type. Clients of End User who are individuals; Employees of End User.
4. Business Purpose. Performing services on behalf of End User.
5. Personal Information Categories. Individuals associated with clients of End User: Identifiers, such as name, address, TIN, email, and phone number. Employees of End User: Identifiers such as name, business email, and business phone number.
6. Special Categories. None. Middesk does not knowingly solicit or process special categories of Personal Information (e.g., health data, biometric data, genetic data, racial or ethnic origin) in connection with the Services. To the extent any such information is inadvertently provided by End User, Middesk will treat it in accordance with the security and confidentiality protections in the Agreement and will not knowingly use it for any purpose other than the Business Purpose.
Annex B
Standard Contractual Clauses
1. The Standard Contractual Clauses take effect without further action: where Section 5.1 of this DPA applies, End User’s first access to the Services constitutes execution of the Standard Contractual Clauses (including Annex I) by both Parties, and the data exporter information in Annex I is deemed completed with the entity details and notice information provided by End User to Partner in connection with the Services. At either Party’s written request, the Parties will separately execute Annex I for evidentiary purposes.
2. In connection with any transfers of End User’s Personal Information under this DPA from the European Economic Area and/or their member states, Switzerland, and the United Kingdom to countries which do not ensure an adequate level of data protection within the meaning of the GDPR, this Annex B shall apply.
3. For purposes of Standard Contractual Clauses Module 2, End User is the data exporter, and Middesk is the data importer. Where End User acts as a processor on behalf of its own controller customers, Module 3 applies, with End User as data exporter (processor) and Middesk as data importer (sub-processor), and references in this Annex B to Module 2 are read accordingly.
4. The relevant provisions contained in the Standard Contractual Clauses (available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) are hereby incorporated by reference. In the event of a conflict between the terms of this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall control.
5. The information required for the purposes of the Standard Contractual Clauses are identified in this DPA, or as follows:
a. Docking Clause. The option under Clause 7 shall not apply.
b. Sub-processors. Option 2 under Clause 9(a) shall apply. Middesk shall provide End User notice of sub-processors in accordance with Section 3.4 of the DPA.
c. Redress. The option under Clause 11 shall not apply. Middesk provides a contact point to handle complaints via its Privacy Policy posted on the Middesk website.
d. Governing Law. Option 2 of Clause 17 shall apply and shall provide as follows: These Clauses shall be governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does allow for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
e. Choice of Forum and Jurisdiction. The Parties agree that 18(b) shall provide: The Parties agree that those shall be the courts of Ireland.
f. Annexes. In addition to Annex I, the Annexes shall be completed as follows:
i. Annex II. The contents of Annex II are those set forth in Section 4.3 (Security) of the Agreement.
ii. Annex III. The contents of Annex III are not applicable as End User provides general authorization under Section 3.4 of the DPA, and Middesk shall provide a list of Subcontractors upon End User’s request.
6. Data Exports from the United Kingdom under the Standard Contractual Clauses. For data transfers governed by UK Data Protection Laws and Regulations, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (the “UK Addendum”), available at the UK ICO's website, shall apply, including as revised under Section 18 of the UK Addendum. The information required for Tables 1 to 3 of Part One of the UK Addendum is set out in this Annex B and Annex I of this DPA (as applicable). For the purposes of Table 4 of Part One of the UK Addendum, neither Party may end this DPA when it changes.
7. Data Exports from Switzerland under the Standard Contractual Clauses. For data transfers subject to Swiss Data Protection Laws, the Standard Contractual Clauses also apply to the transfer of information relating to an identified or identifiable legal entity where such information is protected similarly as Personal Information under Swiss Data Protection Laws until such laws are amended to no longer apply to a legal entity. In such circumstances, general and specific references in the Standard Contractual Clauses to GDPR or EU or Member State Law shall have the same meaning as the equivalent reference in Swiss Data Protection Laws.
Annex I
DETAILS OF PROCESSING OF Personal Information
This Annex I includes certain details of the processing of Personal Information, and when applicable provides the information necessary in connection with the Standard Contractual Clauses:
1. List of Parties
1.1. Controller and Data Exporter:
■ Name and Address: End User, with the entity name and notice address provided by End User to Partner in connection with the Services.
■ Contact person: As provided by End User to Partner in connection with the Services.
■ Activities relevant to the data transferred under the Standard Contractual Clauses: Performance of the Services pursuant to the Agreement and further described in this Annex I.
■ Signature: Deemed executed by End User upon End User’s first access to the Services (see Annex B, Section 1).
1.2. Processor and Data Importer (when applicable): Middesk, Inc.
■ Address: 85 2nd St., Suite 710, San Francisco, CA, 94105, USA
■ Contact person: Attn: Legal Department
■ Activities relevant to the data transferred under the Standard Contractual Clauses: Performance of the Services pursuant to the Agreement and further described in this Annex I.
■ Signature: Deemed executed by Middesk upon End User’s first access to the Services (see Annex B, Section 1).
2. Description of Processing and Transfer
2.1. Categories of Data Subjects Whose Personal Information is Processed and Transferred:
■ End User’s customers, whose Personal Information is supplied by the End User to Middesk
2.2. Categories of Personal Information Processed and Transferred
■ Identifiers
2.3. Sensitive Data Processed and Transferred
■ N/A
2.4. Frequency of Transfer
■ Continuous as determined by End User’s use of the Services
2.5. Nature of the Processing
■ To perform the entity or identity verification Services as made available to End User through Partner
2.6. Purpose of the Processing, the Data Transfer and Further Processing
■ To perform the Services and to fulfill End User’s Instructions
2.7. Duration of the Processing
■ Duration of the Agreement
2.8. Sub-processor Processing
■ The Sub-processors will Process Personal Information as necessary to fulfill the Services and for the duration of the Agreement, and may include onward transfers to third parties located outside of the EEA for the purpose of performing the Services.