This Yelp Leads Program Agreement ("Agreement") is effective as of the date specified in the accompanying Order Form ("Effective Date") entered into between the partner identified in the Order Form or incorporating agreement ("Partner") and Yelp Inc., a Delaware corporation with its principal office at 350 Mission Street, 10th Floor, San Francisco, California, 94105 ("Yelp").

This Agreement may be incorporated by reference into an Order Form, or amendment thereto. In the event of any conflict between this Agreement and an incorporating document (other than with respect to economic terms, which shall be governed by the incorporating document), the terms of this Agreement shall control with respect to the Leads Program and Customer Data.

Agreement

The Parties agree to a collaboration designed to enhance each other's online products and services. Under this Agreement, Yelp shall grant the Partner access to Yelp’s Leads API, enabling the Partner's business clients (“Business Client(s)”) to receive and respond to the potential consumer leads for the Business Clients generated through Yelp's Request-A-Quote feature, which allows consumers on Yelp to message Business Clients directly through Partner’s online portal (the “Leads Program”). Additionally, the Partner may guide its Business Clients in creating or claiming a business listing ("Yelp Business Listing") on Yelp’s platform ("Yelp Platform").

Term and Termination. The term of this Agreement is specified in the Order Form. Either Party may terminate this Agreement if the other Party (the "Breaching Party") materially breaches any provision of this Agreement, including any breach of the Additional Legal Terms outlined in the Order Form, and fails to cure such breach within thirty (30) days of receiving written notice from the non-breaching Party, or as otherwise specified in the Order Form. Termination will be effective immediately upon the expiration of the cure period if the breach is not remedied.
Product Integrations. Yelp shall offer technical support to Partner during the integration process where Partner integrates with Yelp’s APIs and incorporates Yelp URL(s).
1. To manage and respond to Yelp-driven leads (“Request-A-Quote” or “RAQ”):
  1. Partner may offer Business Clients the ability to respond to Yelp-driven leads via Leads API. Such access is available to all Partner Business Clients who have claimed their Yelp listing.
  2. Partner sets up authorization and webhooks. Once setup is complete, Partner shall be notified of every new RAQ interaction for the businesses it has subscribed to.
  3. Partner may use the “read” APIs (Get Lead/ Get Interaction events) to get the full list of interaction events for a particular lead.
  4. Partner may use the “write” APIs to reply to a lead, mark a lead as “read” or as “replied outside of Yelp.”
2. To create and/or claim a Business Client’s Yelp listing in order to enable their Request a Quote feature on Yelp:
  1. Partner may prompt Yelp-eligible Business Clients during initial Client onboarding to create and/or claim their Yelp page.
  2. Partner may redirect users to https://biz.yelp.com/claim and merchandise the claim prompt throughout its platform to increase enablement of Request a Quote for its Business Clients.
Access to Leads API. Yelp shall provide Partner with access to the Leads API to help its Business Clients receive and respond to Yelp consumer leads that are generated through Request a Quote. Then, through OAuth, Partner’s Business Clients shall provide permission and delegated access for the Partner to surface Yelp generated leads from the Business Client’s Yelp business account into the Partner’s platform. Partner may only access and use the Leads Program through its own account and Partner shall not share its credentials with any other person or third-party.
Economics. Any economic arrangement between Yelp and the Partner shall be set forth in the Order Form.
Yelp Leads Policy. Partner shall communicate the following requirements to its Business Clients when using Yelp’s Leads API to receive, respond to, and manage Yelp-generated leads in Partner’s platform.
1. If AI-generated or artificial voices are used to initiate contact via telephone or SMS, Partner must ensure the Business Client has obtained Prior Express Written Consent (PEWC) that specifically names the caller and the use of automated technology, as required by the TCPA and applicable state laws."
2. Be Who You Say You Are: Only Business Clients and their authorized representatives (e.g., agents, resellers, or software providers) are permitted to respond to Yelp Request-A-Quote messages.
3. Be Direct: Responses should directly address the quote request. If the user inquires about availability, the response should address this without ignoring the primary question or diverting the consumer to a phone call.
4. Provide Authentic Responses: Avoid using templates or inauthentic language when responding. While some templating is acceptable to maintain brand voice, avoid mindless copy-pasting. Word choice should vary between responses. AI-generated responses are permitted, but they must be reviewed by human staff to ensure authenticity and compliance with the FTC's guidelines on authentic reviews. Auto-responders are discouraged.
5. Comply with Applicable Regulations: Responses must comply with all applicable laws and regulations, including but not limited to HIPAA, CAN-SPAM, and the FTC's rules on authentic reviews and the use of AI. The FTC requires that AI-generated content be clearly disclosed and reviewed by humans to ensure it accurately reflects the business's stance or experience.
6. Prohibition of Fake Reviews: The Partner must ensure that no fake reviews are created, purchased, or solicited. All reviews must be based on actual consumer experiences and must not misrepresent the identity or experience of the reviewer.
7. Disclosure of AI Use: If AI is used in generating responses or reviews, this must be clearly disclosed to consumers to maintain transparency and avoid misleading them about the source or authenticity of the content.
8. Additionally, Partners are encouraged to share the following material with its Business Clients: 4 tips for turning job requests into sales (Yelp Blog, 2024).
Data Protection and Privacy.
1. Independent Roles and Compliance.
  The Parties acknowledge that for purposes of applicable Privacy Laws, Yelp and Partner each respectively act as an independent "Businesses" or "Controllers" as those terms are defined by applicable laws.
  1. Yelp’s Role: Yelp is the Business responsible for the initial collection of individual Customer Data from consumers on the Yelp platform and for providing any required notices or obtaining necessary consents. Yelp is directed by the business do share Customer Data with Partner as described in the Leads Program.
  2. Partner’s Role: Partner is an independent Business that receives Customer Data from Yelp to perform its own business functions as described in the Leads Program.
  3. Compliance: Each Party shall be independently responsible for complying with its respective obligations under applicable Privacy Laws, including responding to consumer rights requests and maintaining data security.
2. Permissible Business Purposes.
  Partner shall process Customer Data for the specified business purposes of the Leads Program. For the avoidance of doubt, these purposes include:
  1. Facilitating the transmission of leads to Business Clients;
  2. Managing leads within Partner’s platform (e.g., creating jobs, estimates, or service records);
  3. Enabling native communications between Business Clients and consumers via Partner’s platform;
  4. Facilitating related business functions such as attribution, reporting, or other integrated features agreed upon by the Parties;
    Internal auditing and debugging related to the Leads Program.
3. B2B Data Transfer Protections (CCPA Safe Harbor).
  Pursuant to Privacy Laws for the transfer of personal information between independent businesses , Partner agrees:
  1. To provide the same level of privacy protection for Customer Data as is required by applicable Privacy Laws.
  2. To notify Yelp immediately if Partner determines it can no longer meet its obligations under Privacy Laws.
  3. That Yelp has the right to take reasonable and appropriate steps to ensure that Partner uses the Customer Data in a manner consistent with Yelp’s obligations under Privacy Laws.
  4. That Yelp may, upon notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Data.
4. No "Sale" or "Sharing."
  The Parties agree that the transfer of Customer Data by Yelp to Partner is not a "Sale" or "Sharing" (as defined by applicable Privacy Laws). The business directs Yelp to share Customer Data with Partner as described in the Leads Program above.
5. Security and Monitoring.
  Partner shall implement and maintain reasonable administrative, physical, and technical safeguards designed to protect Customer Data. Yelp reserves the right to monitor Partner’s compliance with this sSection. Upon request, Partner shall provide a written certification signed by an authorized officer confirming its ongoing compliance.
Economics Any economic arrangement between Yelp and Partner shall be set forth in the Order Form or incorporating agreement.
Partner Terms: If applicable, Partner represents and warrants that it has the authority as an agent to bind its Business Clients to the terms of this Agreement, and that all of Partner’s actions related to this Agreement shall be within the scope of such relationship. Partner further represents and warrants that any consumer leads surfaced through the Leads API have provided valid, 1:1 Prior Express Written Consent for the Business Client to contact them using automated or AI technology. Partner shall defend, indemnify, and hold harmless Yelp and each of its affiliates, employees from claims resulting from Partner’s breach, or alleged breach, of this Section. Upon request, Partner shall make available to Yelp written confirmation of the relationship between Partner and the respective Client.
Indemnification.
(i) Indemnification by Yelp: Yelp shall indemnify, defend, and hold harmless Partner against all Losses finally awarded by a court of competent jurisdiction arising out of any Action by an unaffiliated third party alleging that the Yelp APIs or Yelp Marks, when used strictly in accordance with this Agreement, infringe a United States patent, copyright, or trademark of such third party.
(ii) Exclusions: Yelp shall have no obligation to indemnify Partner for any Action to the extent it arises from: (ai) User-Generated Content (UGC), including but not limited to consumer reviews, photos, or metadata; (bii) any modification of the Yelp APIs by any party other than Yelp; (ciii) the combination of the Yelp APIs with any Partner software or third-party services; (d) any breach of the Yelp Leads Policy set forth in Section 5 by Partner or a Business Client, including but not limited to failures regarding authentic responses, disclosure of AI use, or the prohibition of fake reviews; or (eiv) Partner’s failure to use the most recent version of the Yelp APIs provided by Yelp.
(iii) Indemnification by Partner: Partner, as an Indemnifying Party, shall indemnify, defend, and hold harmless Yelp and its Indemnified Parties against all Losses (including, but not limited to, reasonable attorneys' fees, statutory damages under the TCPA and state mini-TCPA laws, expert witness fees, forensic investigation costs, regulatory fines, penalties, settlements, and consumer notification costs) arising out of or resulting from any Action by a third party, consumer, Business Client, or governmental or regulatory authority related to or arising out of:
(a) Platform and Services: The Partner Dashboard or Partner's online platform or portal, including any content, material, software, or services displayed or provided thereon (excluding Yelp Content and Yelp IP used strictly in accordance with this Agreement);
(b) Intellectual Property Misuse: Partner's use of Yelp IP, Yelp APIs, or Yelp Content in any manner not expressly authorized by this Agreement or in violation of Section 10(c) (Restrictions on Use of Yelp Content);
(c) Data Protection and Privacy Violations: Partner's breach of Section 6 or Section 6(a) (Compliance with Applicable Laws and Data Protection), including but not limited to:
A. Any Data Breach (as defined in Section 6(a)(iv)) involving Customer Data while in the possession, custody, or control of Partner or any of its subprocessors or third-party service providers;
B. Failure to implement required security safeguards;
C. Unauthorized retention, use, disclosure, or sharing of Customer Data;
D. Failure to delete Customer Data in accordance with the retention requirements;
E. Any violation of the California Privacy Rights Act (CPRA), California Consumer Privacy Act (CCPA), or other applicable federal or state privacy laws;
(d) Regulatory Fines and Penalties: Any fines, penalties, assessments, or sanctions imposed by any governmental authority (including but not limited to the California Attorney General, Federal Trade Commission, or state attorneys general) arising from Partner's handling, processing, storage, or protection of Customer Data, or Partner's failure to comply with applicable consumer protection, privacy, or data security laws;
(e) Consumer Claims: Any claims brought by consumers whose personal information was included in Customer Data, including but not limited to claims for violation of privacy rights, identity theft, fraud, or emotional distress arising from Partner's acts or omissions;
(f) Business Client Claims: Any claims brought by Business Clients arising from Partner's handling of their Yelp leads or Customer Data, or Partner's violation of the Yelp Leads Policy set forth in Section 5;
(g) Subprocessor Acts: Any acts or omissions of Partner's subprocessors, vendors, contractors, or other third parties to whom Partner has provided access to Customer Data, regardless of whether such access was approved by Yelp.

(iv) Indemnification Process:
(a) Notice: The Indemnified Party shall notify the Indemnifying Party promptly in writing of any claim for indemnification hereunder; provided, however, that the failure of the Indemnified Party to provide prompt notice shall not excuse the Indemnifying Party of its indemnification obligations except to the extent such failure materially prejudices the Indemnifying Party's ability to defend the claim.
(b) Control of Defense: The Indemnifying Party shall have the right to control the defense and settlement of any Action subject to indemnification, provided that: (1) the Indemnifying Party promptly acknowledges its indemnification obligations in writing; (2) the Indemnifying Party retains competent legal counsel reasonably acceptable to the Indemnified Party; and (3) the Indemnified Party is provided with regular updates on the status of the defense.
(c) Cooperation: The Indemnified Party shall provide, at the Indemnifying Party's expense (to the extent of actual out-of-pocket expenses only), all reasonably necessary assistance, information, documentation, and authority to allow the Indemnifying Party to defend such Action.
(d) Settlement Restrictions: The Indemnifying Party shall not enter into any settlement or consent to any judgment that: (1) includes any admission of liability, fault, or wrongdoing on the part of the Indemnified Party; (2) imposes any obligation or restriction on the Indemnified Party; or (3) does not include a full and unconditional release of the Indemnified Party, in each case without the prior written consent of the Indemnified Party, which consent shall not be unreasonably withheld, conditioned, or delayed.
(e) Right to Participate: The Indemnified Party shall have the right, but not the obligation, to participate in the defense of any Action with counsel of its own choosing and at its own expense. If the Indemnifying Party fails to assume the defense of any Action within thirty (30) days after receiving notice, the Indemnified Party may assume such defense, and the Indemnifying Party shall reimburse the Indemnified Party for all reasonable costs and expenses (including attorneys' fees) incurred in connection with such defense.
Warranty Disclaimers and Limitation of Liability.
1. PLEASE READ THIS SECTION CAREFULLY SINCE IT LIMITS THE LIABILITY OF THE YELP TO PARTNER. EACH OF THE SUBSECTIONS BELOW ONLY APPLIES UP TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW. NOTHING HEREIN IS INTENDED TO LIMIT ANY RIGHTS PARTNER MAY HAVE WHICH MAY NOT BE LAWFULLY LIMITED. BY ACCESSING OR USING THE SERVICE, PARTNER REPRESENTS THAT PARTNER HAS READ, UNDERSTOOD, AND AGREE TO THESE TERMS, INCLUDING THIS SECTION. PARTNER IS GIVING UP SUBSTANTIAL LEGAL RIGHTS BY AGREEING TO THESE TERMS.
2. THE REQUEST A QUOTE FEATURE, API’S AND YELP PLATFORM (THE “SERVICE”) ARE MADE AVAILABLE TO PARTNER ON AN “AS IS”, “WITH ALL FAULTS” AND “AS AVAILABLE” BASIS, WITH THE EXPRESS UNDERSTANDING THAT YELP MAY NOT MONITOR, CONTROL, OR VET USER CONTENT OR THIRD PARTY CONTENT. AS SUCH, PARTNER’S USE OF THE SERVICE IS AT PARTNER’S OWN DISCRETION AND RISK. YELP MAKE NO CLAIMS OR PROMISES ABOUT THE QUALITY, COMPLETENESS, ACCURACY, OR RELIABILITY OF THE SERVICE, ITS SAFETY OR SECURITY, INCLUDING WITHOUT LIMITATION THE SECURITY OF PARTNER’S DATA, OR THE SERVICE CONTENT. ACCORDINGLY, YELP IS NOT LIABLE TO PARTNER FOR ANY PERSONAL INJURY, LOSS OR DAMAGE THAT MIGHT ARISE, FOR EXAMPLE, FROM THE SERVICE’S INOPERABILITY, SERVICE UNAVAILABILITY, SECURITY VULNERABILITIES OR FROM PARTNER'S RELIANCE ON THE QUALITY, ACCURACY, OR RELIABILITY OF THE BUSINESS LISTINGS, RATINGS, REVIEWS (INCLUDING THEIR CONTENT OR OMISSION OF CONTENT, ORDER, AND DISPLAY), METRICS OR OTHER CONTENT FOUND ON, USED ON, OR MADE AVAILABLE THROUGH THE SERVICE.
3. YELP MAKE NO CLAIMS OR PROMISES WITH RESPECT TO ANY THIRD PARTY, SUCH AS THE BUSINESSES OR ADVERTISERS LISTED ON THE SERVICE OR THAT OFFER GOODS OR SERVICES THROUGH THE SERVICE, OR THE REQUESTS FOR SERVICE OR THE SERVICE’S USERS. ACCORDINGLY, YELP IS NOT LIABLE TO PARTNER FOR ANY PERSONAL INJURY, LOSS OR DAMAGE THAT MIGHT ARISE FROM ANY SUCH THIRD PARTY’S ACTIONS OR OMISSIONS, INCLUDING, FOR EXAMPLE, IF ANOTHER USER OR BUSINESS MISUSES PARTNER'S CONTENT, IDENTITY OR PERSONAL INFORMATION.
4. PARTNER'S SOLE AND EXCLUSIVE RIGHT AND REMEDY IN CASE OF DISSATISFACTION WITH THE SERVICE, RELATED SERVICES, OR ANY OTHER GRIEVANCE SHALL BE PARTNER'S TERMINATION AND DISCONTINUATION OF ACCESS TO, OR USE OF THE SERVICE.
5. Partner’s Liability. EXCEPT FOR (A) PARTNER’S INDEMNIFICATION OBLIGATIONS UNDER SECTION 10, (B) PARTNER’S BREACH OF SECTION 6 (COMPLIANCE WITH LAWS AND DATA PROTECTION), AND (C) PARTNER’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, PARTNER’S MAXIMUM AGGREGATE LIABILITY TO YELP UNDER THIS AGREEMENT SHALL BE LIMITED TO THE FEES PAID IN THE 12 MONTHS PRECEDING THE CLAIM.
6. Yelp’s Liability. EXCEPT FOR YELP’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, YELP’S MAXIMUM AGGREGATE LIABILITY TO PARTNER FOR LOSSES OR DAMAGES IN CONNECTION WITH THE SERVICE OR THIS AGREEMENT IS LIMITED TO $10,000.00.
7. Exclusion of Damages. IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY (i) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, EXEMPLARY, RELIANCE, OR CONSEQUENTIAL DAMAGES, (ii) LOSS OF PROFITS OR REVENUE, (iii) BUSINESS INTERRUPTION, (iv) REPUTATIONAL HARM, OR (v) LOSS OF INFORMATION OR DATA. THE WAIVERS AND LIMITATIONS SPECIFIED IN THIS SECTION 11 WILL SURVIVE AND APPLY REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE.
Arbitration and Choice of Law.
1. Partner and Yelp agree that, except for Excluded Business Claims, any claim, controversy or cause of action arising out of or relating to this Agreement, or the breach thereof, shall be settled through final and binding Arbitration to be administered by National Arbitration and Mediation (“NAM”) and governed by NAM’s Comprehensive Dispute Resolution Rules and Procedures in effect at the time such claim is filed. Partner agrees that any such claim arises from a business transaction and shall not be governed by the NAM rules, forms, or fees applicable to consumer transactions. Any award of the arbitrator is final and binding. If Partner has a question about the arbitration process or to obtain a current copy of the Comprehensive Dispute Resolution Rules and Procedures and/or fee schedule, NAM’s Commercial Dept. can be contacted at (800) 358-2550 or by NAM’s website at www.namadr.com.
2. “Excluded Business Claims” means any claim, controversy, or cause of action: (i) arising from any act in furtherance of a person’s right of petition or free speech under the United States Constitution or the California Constitution; or (ii) related to intellectual property (like patents, copyrights, moral rights, trademarks, and trade secrets and other confidential or proprietary information, but not privacy or publicity rights).
3. The arbitration shall be heard by a single arbitrator with exclusive authority to (i) determine the scope and enforceability of this arbitration agreement, and (ii) resolve any dispute related to the interpretation, applicability, enforceability or formation of this arbitration agreement including, but not limited to, any claim that all or any part of this arbitration agreement is void or voidable and whether a claim is subject to arbitration. Arbitrations will be held in San Francisco, California, but the parties may choose for themselves whether to appear in person, by phone, or through the submission of documents. The arbitration shall be governed by the laws of the State of California. The prevailing party shall be entitled to an award of reasonable attorneys’ fees. Any judgment on the award(s) rendered by the arbitrator may be entered in any court of competent jurisdiction.
4. This Agreement evidences a transaction involving interstate commerce and, notwithstanding the provision above with respect to the applicable substantive law, the Federal Arbitration Act, 9 U.S.C. §1 et seq. (“FAA”) will govern the interpretation and enforcement of this arbitration provision. If, for whatever reason, the FAA is inapplicable, the state law governing arbitration agreements in the state in which Partner resides shall apply.
5. PARTNER AND YELP AGREE THAT EACH MAY BRING OR PARTICIPATE IN CLAIMS AGAINST THE OTHER ONLY IN THEIR RESPECTIVE INDIVIDUAL CAPACITIES, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING. UNLESS BOTH PARTNER AND YELP AGREE OTHERWISE, THE ARBITRATOR MAY NOT CONSOLIDATE OR JOIN THE CLAIMS OF OTHER PERSONS OR PARTIES WHO MAY BE SIMILARLY SITUATED, AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. IF A CLAIM IMPLICATES THIS SECTION, AND THIS SECTION IS FOUND TO BE INVALID, UNENFORCEABLE OR ILLEGAL BY A COURT, SUCH CLAIM MUST BE ADJUDICATED BY A COURT AND NOT BY AN ARBITRATOR.
6. NOTWITHSTANDING THE FOREGOING, FOR ANY CLAIM THAT IS NOT SUBJECT TO ARBITRATION, INCLUDING WITHOUT LIMITATION EXCLUDED BUSINESS CLAIMS, YOU AGREE TO SUBMIT AND CONSENT TO THE PERSONAL AND EXCLUSIVE JURISDICTION IN, AND THE EXCLUSIVE VENUE OF, THE STATE AND FEDERAL COURTS LOCATED WITHIN SAN FRANCISCO COUNTY, CALIFORNIA, WHICH IS THE PLACE OF PERFORMANCE OF THIS AGREEMENT.
7. PARTNER AND YELP EXPRESSLY WAIVE THE RIGHT TO TRIAL BY A JURY.
8. This Agreement is to be governed by and interpreted under California law, without regard to its conflict of law principles. Both Partner and Yelp agree that all disputes that are not subject to mandatory arbitration as described in these Terms shall be resolved exclusively in state and federal courts located within San Francisco County, California and Partner consent to the personal jurisdiction of, and venue in, these courts for the purpose of litigating any such disputes.
9. This Agreement supersedes any prior agreement to arbitrate applicable claims and is applicable to unfiled claims that arose, were asserted, or involve facts occurring before or after the existence of this Agreement as well as to claims that may arise after the termination of this Agreement.
10. This Arbitration Agreement evidences a transaction involving interstate commerce and, notwithstanding the provision above with respect to the applicable substantive law, the Federal Arbitration Act, 9 U.S.C. §1 et seq. (“FAA”) will govern the interpretation and enforcement of this Arbitration Agreement. If, for whatever reason, the FAA is inapplicable, the state law governing arbitration agreements in the state in which Partner resides shall apply.
Survival. Upon the expiration or termination of this Agreement for any reason, all rights and licenses granted to Partner shall immediately cease; however, the following sections and obligations shall survive such expiration or termination in accordance with their respective terms: Section 5 (Yelp Leads Policy): specifically regarding Disclosure of AI Use and Authentic Responses; Section 6 (Data Protection and Privacy Compliance) and the Data Processing Addendum, including obligations regarding data retention, security, and subprocessor oversight; Section 8 (Partner Terms): specifically the representations and indemnities regarding Partner's authority; Section 9 (Indemnification); Section 10 (Warranty Disclaimers and Limitation of Liability); Section 11 (Arbitration and Choice of Law); Section 13 (Miscellaneous); and Section 12 (Survival).
Miscellaneous:
1. Notices: Notices to Yelp must be sent via email to [email protected] or via reputable overnight courier to Yelp Inc., Legal Department, 350 Mission Street, 10th Floor, San Francisco, CA 94105. Notices to Partner shall be sent to the email or physical address specified in the Order Form. Receipt is deemed effective on the date of delivery.
2. Relationship: The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship.
3. Assignment: Partner may not assign or transfer its rights under this Agreement without Yelp’s prior written consent; any attempt to do so is void.
4. Entire Agreement: This Agreement, including any Order Forms and terms incorporated herein by reference (including the Leads Program Terms at [URL]), constitutes the entire understanding between the parties and supersedes all prior agreements.
5. Severability: If any provision is held unenforceable, the remaining provisions remain in full effect, and the parties shall substitute a valid provision that achieves the original economic intent.

VERSION NUMBER [ 2.03 02-13-26 ]

Data Processing Addendum (DPA)

Data Processing Addendum (DPA)
This Data Processing Addendum ("DPA") forms part of the Yelp Leads Program Agreement ("Agreement") between Yelp and the Partner. Consistent with Section 6(i) of the Agreement , the Parties acknowledge that each acts as an independent "Business" or "Controller" under applicable Privacy Laws. This DPA establishes the technical and operational safeguards Partner shall implement to fulfill its obligations under Section 6, particularly Section 6(v) (Security and Monitoring), while processing Customer Data for the Permissible Business Purposes identified in Section 6(ii).

Technical Security Measures
The Partner shall implement a security program that meets or exceeds the following standards, consistent with its obligation to maintain reasonable safeguards under Section 6(v) of the Agreement:
- Encryption: All Customer Data must be encrypted at rest using AES-256 or a similar industry-standard algorithm and encrypted in transit using TLS 1.2 or higher.
- Access Control: Access to the Leads API and the resulting Customer Data must be restricted to authorized employees with a legitimate "need to know." Multi-factor authentication (MFA) is required for all administrative access.
- Vulnerability Management: The Partner must conduct regular vulnerability scans and penetration tests on the systems used to process Customer Data.
- Purpose Limitation: Partner shall configure its technical systems to process Customer Data solely for the Permissible Business Purposes identified in Section 6(ii) of the Agreement.
Masking Protocol and De-Identification
As specified in the primary agreement, the Partner must respect Yelp’s masking technology.
- No Unmasking: The Partner shall not attempt to reverse-engineer or "de-anonymize" masked email addresses or proxied phone numbers provided by Yelp.
- Header Integrity: If the Partner uses email forwarding or relay services to deliver leads to Business Clients, they must ensure that email headers do not inadvertently reveal unmasked consumer credentials.
- No Sale or Sharing: Partner's systems and subprocessor agreements shall be configured to ensure that no Customer Data is sold or shared as those terms are defined in applicable Privacy Laws, consistent with Section 6(iv) of the Agreement.
Subprocessor Oversight
If the Partner uses third-party vendors (e.g., cloud hosting providers or CRM tools) to handle Yelp leads, the Partner remains fully responsible for their conduct as an independent Business/Controller.
- Written Agreements: The Partner must have written contracts with all subprocessors that impose data protection obligations at least as stringent as those in this DPA.
- Transparency: Upon request, the Partner must provide Yelp with a current list of all subprocessors who have access to Customer Data.
Incident Response and Breach Notification
In the event of a suspected or actual Data Breach (defined as any unauthorized access, use, disclosure, alteration, or destruction of Customer Data), the Partner must:
- Notify Yelp: Send an email to [email protected] without undue delay, but in no event later than 48 hours of discovery. This notification obligation is in addition to the immediate notification requirement under Section 6(iii) regarding inability to meet Privacy Law obligations.
- Investigate: Provide a detailed report on the scope of the breach, the types of data involved, and the steps taken to mitigate further risk.
- Cooperate: Assist Yelp in any required consumer or regulatory notifications.
Data Retention and Deletion
To maintain compliance with the CCPA’s "minimization" principle and Section 6(iii) of the Agreement, Customer Data should not be stored indefinitely.
- Retention Period: Unless otherwise required by law, the Partner shall delete or de-identify Customer Data once the lead lifecycle is complete or upon termination of the Agreement. "Lead lifecycle" includes the permissible internal auditing and reporting period referenced in Section 6(ii) of the Agreement.
- Certification of Destruction: Within thirty (30) days of a written request from Yelp, the Partner shall provide a signed certification confirming that all Customer Data has been securely deleted. This is distinct from the general compliance certification required under Section 6(v) of the Agreement.

Key Improvements in this Version:

Independent Controller Context: Added the introductory paragraph to align with Section 6(i) , clarifying the legal relationship.
Notification Alignment: Changed the notification timeline in Section 4 to "without undue delay, but in no event later than 48 hours" to harmonize the DPA's specificity with the Agreement's "immediate" requirement.
Purpose Limitation: Added "Purpose Limitation" to Section 1 to tie technical processing back to the "Permissible Business Purposes" in Section 6(ii).
No Sale/Share Clause: Added explicitly to Section 2 to operationalize the "No Sale" commitment in Section 6(iv).
Lifecycle Clarification: Defined "lead lifecycle" in Section 5 to include the permissible auditing period from Section 6(ii) , preventing a technical breach for retaining data for legitimate internal purposes.