Effective January 23, 2026
California Jurisdiction-Specific Terms
California, USA
The following additional provisions apply to Hyland’s Processing of the Personal Information that is subject to the CPRA.
a. Definitions: Unless otherwise indicated in this DPA, the capitalized terms used in these California Jurisdiction Specific Terms shall have the meaning assigned to them in the CPRA.
“Business Purpose(s)” means: (1) to provide technical support services, professional services, services relating to Hyland’s hosted offering, or other services as specifically defined in the Agreement; (2) to detect security incidents or protect the Personal Information against malicious, deceptive, fraudulent or illegal activity; (3) to develop and improve the Products or Services as permitted by the CPRA; or (4) as otherwise expressly permitted by the CPRA or the CPRA Regulations.
“Consumer” means a California resident (1) who is a natural person, and (2) whose Personal Information is Processed by Hyland on Customer’s behalf for the Business Purposes.
“Personal Information” shall have the meaning set forth in the CPRA but shall be limited to Personal Information of Consumers which Hyland Processes on Customer’s behalf pursuant to the Agreement.
b. Processing Of Personal Information: Customer is a Business and appoints Hyland as its Service Provider to Process Personal Information only for the Business Purposes. Hyland shall comply with all applicable sections of the CPRA, including providing the same level of protection for Personal Information as the CPRA requires Customer, as a Business, to provide. Hyland grants Customer the right to take reasonable and appropriate steps Hyland‘s compliance with these California Jurisdiction Specific Terms and the CPRA and to stop and remediate unauthorized use of Personal Information.
c. Restrictions On Processing Personal Information: Hyland is prohibited from: (i) Processing Personal Information for any purposes but for the Business Purposes unless otherwise required by law to do so; (ii) Processing Personal information for any additional commercial purpose (other than the Business Purposes) including in the servicing of a different business, unless otherwise expressly permitted by the CPRA; (iii) Processing Personal Information outside the direct business relationship between Hyland and Customer unless otherwise expressly permitted by the CPRA; (iv) Selling or Sharing Personal Information; (v) combining Personal Information with personal information that it receives from, or on behalf of, a third party, or Collects from its own interaction with a Consumer (except as permitted by the CPRA); or (vi) Processing the Personal Information for any other purpose except as permitted by this DPA.
d. Inability To Comply With CPRA: Hyland shall notify Customer after Hyland determines that it no longer can meet its obligations under these California Jurisdiction Specific Terms, the CPRA. In the event Hyland is unable to meet its obligations, Customer may, in its discretion: (i) take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information, or (ii) terminate the Agreement.
The most current version of this document shall be such in effect as of 12:00am EST (Eastern Standard Time) of the date stamped on such online version.