Sensitive Data Terms

Last modified January 2, 2025

Ambivo Sensitive Data Terms

Last Modified: January 02, 2025

PLEASE READ THESE TERMS CAREFULLY.

The Ambivo Sensitive Data Terms (“Sensitive Data Terms”) apply to your use of the Subscription Services and information considered sensitive under applicable law. In case of and to the extent applicable, any conflict or inconsistency with the other terms of the Agreement, these Sensitive Data Terms will take precedence over the other terms of the Agreement.

Capitalized terms used herein and not otherwise defined here will have the meanings assigned to them in the Agreement.

1. DEFINITIONS

2. COVERED SERVICES

3. SERVICE TERMS

4. DISCLAIMER OF WARRANTIES

1. DEFINITIONS

1.1 "Beta Covered Services" means the beta features within the Subscription Services supporting Permitted Sensitive Data and expressly included in the 'Beta Covered Services Table' of the Sensitive Data Terms.

1.2 "Covered Services" means the features within the Subscription Services supporting Permitted Sensitive Data and expressly included in the 'Covered Services Table' of the Sensitive Data Terms.

1.3 "Permitted Sensitive Data" means any information expressly permitted under the 'Covered Services Table' and the 'Beta Covered Services Table.'

1.4 "Prohibited Sensitive Data" means i) any information belonging to a sensitive category of information under applicable law relating to privacy or data protection not expressly permitted under Permitted Sensitive Data, and ii) any use of Permitted Sensitive Data outside the scope of the Covered Services or otherwise processed outside of the express and authorized scope of these terms (for example, storing financial data for the purposes of directly processing payments is prohibited).

2. COVERED SERVICES

You agree to use only the Covered Services for the categories of Permitted Sensitive Data detailed in the 'Covered Services Table.'

COVERED SERVICES TABLE Permitted Features and Data
COVERED SERVICES	PERMITTED SENSITIVE DATA
The Ambivo Enterprise Subscription Services support Permitted Sensitive Data within the following features: CRM object properties, including manual update, import, export, properties API and import API CRM activities (notes, emails, calls, tasks, meetings) CRM objects API list creation workflows search reporting integrations forms form submissions authenticated API CRM attachments added to records manually, via notes, call logs, meetings, tasks, email, forms and sensitive file properties *(call logs are permitted, but call recordings and transcripts including Sensitive Data are not permitted)	Citizenship and immigration status
	Limited government issued identification information (for example, passport numbers, driver's licenses, and government issued identification cards) This does NOT include government-issued numbers used to grant access to highly sensitive information for example Social Security Numbers or tax identifiers.
	Last 4 digits of bank or financial institution account numbers. Full account numbers are NOT included in Permitted Sensitive Data.
	Last 4 digits of credit or debit card numbers Full card numbers and card security codes (CSCs) are NOT included in Permitted Sensitive Data.
	Payment history (for example payments due, missed payments, remaining balance)
	Income and salary data (for example, income history, individual salary, salary bands/average salary data)
	Gender
	Professional performance reviews
	Employment history
	Veteran status
	Demographic data (for example ethnicity, gender, age, religion and sexual orientation)
	Children's information protected under any applicable child data protection laws (for example, age, grade level, attendance, credits, discipline, etc.) For the avoidance of doubt, the Subscription Services and the Sensitive Data Covered Services are not permitted for use by i) anyone under 18 years of age, ii) entities maintaining online services that specifically target children, or iii) entities engaging in targeted advertising to children protected under applicable child data protection laws.
	Health data / For example, fitness information, wellness information and sensitive health information of individuals subject to GDPR. Protected Health Information (PHI) subject to the Health Insurance Portability and Accountability Act (HIPAA)). This includes health information in the US such as patient information, provider information and medical history.

4. SERVICE TERMS

4.1 Permitted and Prohibited Use. Permitted Sensitive Data can only be used within the Subscription Service in accordance with these terms, and with the Permitted Features identified in the Covered Services. Prohibited Sensitive Data is not permitted in any Subscription Services features, including Covered Services. Exceeding the permitted scope of the Ambivo Sensitive Data Terms it may result in suspension or termination under the Ambivo Customer Terms of Service.4.2 Third Party Products. If you choose to integrate with or otherwise use third party products in connection with the Subscription Service, you acknowledge that Customer Data hosted or processed by such third-party products are hosted in accordance with policies maintained by those third-parties.

4.3 Customer Obligations. You are responsible for assessing and determining whether your use of the Subscription Services meets your compliance obligations. Your obligations also include, at your own cost and expense, to supply your own personnel and resources (or that of your designated third party service provider) to support, at a minimum, (i) management and oversight of Sensitive Data within your Ambivo Account; (ii) data subject access request responses associated with Sensitive Data maintained within your Ambivo Account; and (iii) inquiries, obligations, or other lawful orders set forth by enforcement officials under applicable law or regulation.

4.3.1 Permitted Sensitive Data Identification. The Covered Services functionality relies on the use of sensitive data properties, and you agree to i) appropriately identify sensitive data and ii) only process Permitted Sensitive Data within the Covered Services and Beta Covered Services.

4.4 Ambivo Obligations. We agree to continue providing the physical, administrative, and technical security controls reflected in the existing terms of the Agreement.

4.5 Sensitive Information Data Breaches. As detailed in the Ambivo Data Processing Agreement we maintain security incident management policies and procedures as specified in the “Security Measures” section of our DPA.

4.6 BAA Security and Notice. We maintain security incident management policies and procedures as specified in the “Business Associate’s Obligations” section of our BAA, and we will notify you as detailed in those terms if the BAA applies to you.

5. DISCLAIMER OF WARRANTIES

Ambivo MAKES NO WARRANTY THAT ANY OF THE COVERED SERVICES WILL MEET YOUR REQUIREMENTS AND/OR THAT THE COVERED SERVICES WILL BE UNINTERRUPTED, TIMELY OR ERROR-FREE.

6. MISCELLANEOUS

6.1 Changes to Sensitive Data Terms. We may make changes to these Sensitive Data Terms to increase the Covered Services, Beta Covered Services, or Permitted Sensitive Data allowed under these terms without notifying you; other updates to these terms will be made in accordance with the Agreement. You understand and agree that if you use the features under the Sensitive Data Terms after the updated date, we will treat your use as acceptance of the updated Sensitive Data Terms.

6.2 Conflict. All other terms in the Agreement remain unchanged. In case and to the extent of any conflict or inconsistency with the terms of the Agreement, these Sensitive Data Terms will take precedence over the terms of the Agreement. For customers who store Protected Health Information subject to HIPAA, the BAA will take precedence over the terms of the Agreement, including any other terms within these Sensitive Data Terms, to the extent of such conflict or inconsistency.

6.3 Survival. These Sensitive Data Terms, and the BAA as applicable, will also survive the expiration or termination of the Agreement.