For purposes of the Agreement and this Excluded Data Policy, “Excluded Data” means any data that Customer is not permitted to upload, submit, transmit, process, or store in the Software Subscription Services, including:

1. Sensitive personal information beyond basic business information, including information that can be used to identify, authenticate, or contact a specific individual, except for limited business information expressly permitted by the Documentation or the applicable Order, such as name, business title, business email address, business telephone number, and similar business information or contact details;
2. Protected health information or medical information, including any “protected health information” as defined under HIPAA, medical records, treatment information, diagnosis information, health insurance information, or other individually identifiable health information;
3. Consumer financial account or payment card data, including bank account numbers, routing numbers, payment card numbers, debit card numbers, credit card numbers, card security codes, PINs, or other information that could permit access to a financial account or payment instrument;
4. Government-issued identification numbers or highly sensitive identifiers, including Social Security numbers, driver’s license numbers, passport numbers, taxpayer identification numbers, national identification numbers, or similar government-issued identifiers;
5. Authentication credentials, including passwords, security answers, authentication tokens, private keys, or other credentials that could provide access to accounts, systems, or devices;
6. Special category, highly sensitive, or regulated data that would subject the Software Subscription Services to legal, regulatory, security, or contractual requirements not expressly undertaken by Ontario in the Agreement, applicable Ontario Policies, or an applicable Order; and
7. Any other data expressly designated by the Agreement, Documentation, an applicable Order, or written notice from Ontario as prohibited from the applicable Software Subscription Services.

For clarity, Customer shall not upload, submit, or store any Excluded Data, and Customer bears sole responsibility for all Excluded Data and all consequences arising from Customer’s failure to comply with the Agreement and this Excluded Data Policy.

Customer is responsible for ensuring that it and its Authorized Users do not upload, submit, transmit, process, or store Excluded Data in the Software Subscription Services.

Without limiting Customer’s responsibilities under the Agreement, Customer shall:

• use the Ontario Services in accordance with the Agreement, Documentation, and Ontario Policies;
• implement reasonable administrative, technical, and organizational safeguards designed to prevent the introduction of Excluded Data into the Software Subscription Services;
• instruct its personnel and Authorized Users not to upload, submit, or store Excluded Data in the Software Subscription Services;
• promptly notify Ontario after becoming aware that any Excluded Data has been uploaded, submitted, transmitted, processed, or stored in the Software Subscription Services; and
• provide all Required Support reasonably requested by Ontario to identify, contain, remove, delete, remediate, or otherwise address Excluded Data or any related operational, security, compliance, or support issue.

Customer shall provide such notice without undue delay and, where reasonably possible, include sufficient information to allow Ontario to identify the affected account, records, systems, and approximate scope of the issue.

4. Ontario Rights and Operational Response

If Ontario reasonably believes that Customer has uploaded, submitted, transmitted, processed, or stored Excluded Data in the Software Subscription Services, Ontario may take such actions as Ontario deems reasonably necessary to protect the Ontario Services, Customer Data, other customers, and applicable systems, including:

• notifying Customer;
• requiring Customer to remove the Excluded Data;
• removing, deleting, quarantining, blocking, or disabling access to the affected Excluded Data;
• suspending affected processing, features, or access where reasonably necessary to address security, legal, compliance, or operational risks; and
• requiring Customer to provide Required Support in connection with investigation, containment, mitigation, and remediation.

Where practicable under the circumstances, Ontario will provide Customer notice and an opportunity to cure before removing or disabling access to Excluded Data. However, Ontario may act without prior notice where Ontario reasonably determines that immediate action is necessary to prevent or mitigate material security, legal, compliance, or operational risk.

Ontario is not obligated to review Customer Data to determine whether it contains Excluded Data and shall have no duty to detect Excluded Data before it is uploaded or stored.

5. Removal Timing and Cooperation

Upon becoming aware of Excluded Data in the Software Subscription Services, Customer shall use commercially reasonable efforts to remove, or assist Ontario in removing, such Excluded Data as promptly as possible.

If Ontario requests that Customer remove Excluded Data, Customer shall do so within the timeframe reasonably specified by Ontario based on the nature of the risk and the affected Ontario Services. If Customer does not timely remove the Excluded Data, or if immediate action is reasonably necessary, Ontario may remove, delete, render inaccessible, or otherwise remediate the Excluded Data in its discretion.

Customer acknowledges that copies of Excluded Data may remain temporarily in logs, backups, disaster recovery media, caches, or other secured residual systems for a limited period in the ordinary course of operations, and such copies will be handled in accordance with Ontario’s retention practices, the Agreement, and applicable Ontario Policies.

6. Support, Security, and Service Effects

Issues, delays, unavailability, degradation, remediation activities, or other impacts caused by or relating to Excluded Data may constitute unsupported issues or Excluded Downtime under the Ontario Support and SLA Policy, including where such issues arise from Customer Data, Excluded Data, customizations, modifications, or third-party components not provided by Ontario.

Ontario’s obligations, including support obligations, security-related actions, response efforts, and service level commitments, may be reduced, delayed, or excused to the extent Customer fails to provide required cooperation, access, information, or other Required Support relating to Excluded Data, as provided in the Agreement and the Ontario Support and SLA Policy.

To the extent Excluded Data creates or contributes to a Security Incident, the parties’ respective rights and obligations will be governed by the Agreement, and, where applicable, the DPA with respect to Personal Data subject to the DPA.

7. Responsibility and Liability

Customer bears sole responsibility for:

• determining whether data is appropriate for the Software Subscription Services;
• preventing the upload, submission, transmission, processing, or storage of Excluded Data;
• all Excluded Data uploaded, submitted, transmitted, processed, or stored by or on behalf of Customer; and
• all consequences, claims, costs, delays, remediation efforts, losses, liabilities, and damages arising from or relating to Excluded Data.

Without limiting any disclaimers, limitations, exclusions, or indemnification obligations in the Agreement:

• Ontario will not be liable for any loss, corruption, deletion, disclosure, unavailability, or inability to use Excluded Data;
• Ontario will not be liable for any delay, degradation, suspension, or remediation action arising from or related to Excluded Data; and
• Customer’s upload, submission, or use of Excluded Data remains subject to Customer’s indemnification obligations under the Agreement.

8. No Expansion of Ontario Obligations

Nothing in this Excluded Data Policy obligates Ontario to:

• accept, host, process, remediate, segregate, return, export, or preserve Excluded Data;
• modify the Ontario Services to support any regulated or prohibited data category;
• assume any compliance obligations not expressly stated in the Agreement, the DPA, an applicable Order, or applicable Ontario Policies; or
• provide support, recovery, or restoration services with respect to Excluded Data, except to the extent expressly agreed in writing.

9. Relationship to Other Ontario Policies

This Excluded Data Policy supplements, and should be read together with, the Agreement and applicable Ontario Policies, including:

• the Ontario Data Processing Agreement (DPA);
• InfoSec Standard Policy;
• the Ontario Support and SLA Policy; and
• the Ontario Customer Platform Development Policy.

For clarity:

• the Ontario Data Processing Agreement (DPA) governs Ontario’s processing of Personal Data on behalf of Customer in connection with the Ontario Services;
• the Ontario InfoSec Standard Policy describes Ontario’s security program and safeguards;
• the Ontario Support and SLA Policy governs support channels, support obligations, severity levels, response targets, availability commitments, and support exclusions; and
• the Ontario Customer Platform Development Policy governs ownership, classification, and treatment of customer-specific items, but does not expand Ontario’s data protection obligations beyond the Agreement and this DPA.

Nothing in this Excluded Data Policy expands Ontario’s support, service level, warranty, indemnity, or other obligations beyond those expressly stated in the Agreement and applicable Ontario Policies.

10. Policy Changes

This Excluded Data Policy may be updated by Ontario from time to time in accordance with the Agreement. For each Order, the version of this Excluded Data Policy in effect as of the effective date of that Order will apply during the Initial Term of that Order, except as otherwise permitted under the Agreement.