Appointment Confirmation

AAA DocuShred LLC Destruction Services Contract

At AAA DocuShred LLC our primary focus is to make sure our customers are federally compliant with such regulations
as FACTA, HIPPA, and Gramm-Leach Bliley. With Our on-site service and current NAID members status, your
business can be assured that by working with us, you are receiving the most secure method of destruction available
with excellent service provided by a locally Woman owned and operated company.

This Agreement is entered into as of this on the day this booking form is complete online at www.aaadocushred.com by and between AAA DocuShred LLC having a place of business at 2921 N 34th Pl Mesa, Arizona 85213 and the customer's name or business associated with this form located at the address assigned to this form.

1. SERVICES
Services to be Furnished. AAA DocuShred LLC will provide onsite Document Shredding services and stage 1 65 Gallon container for the customer to place paper only documents to be shredded on the next scheduled service date. All containers staged at customers location will remain property of AAA DocuShred LLC. and must be returned in like condition at the end of this contract. Failure to return staged containers will result in customer paying AAA DocuShred LLC. full replacement value of missing or damaged containers. The frequency of this service is based off the plan selected by the customer and paid monthly in advance for the next scheduled service.


300 Pounds Quarterly | $19.95 per month (12-month recurring agreement)

1.1 Custom Services not set forth in which case Service Provider will consult with Customer as to the terms
and conditions of the Services requested. Services necessarily require a transfer of records, data, media,
electronic equipment (Customer Materials) potentially containing Personal Information.

1.2 Services to Affiliates and Subsidiaries. Customer’s related, affiliated and subsidiary companies (including
subsidiaries of affiliates) may acquire Services pursuant to this Agreement. Any such acquisition of Services
will be evidenced by an Order executed by an authorized representative of the applicable affiliate or subsidiary
in its own corporate name and referencing this Agreement. Invoices for such Services shall be directed to and
be payable by such affiliate or subsidiary.

1.3 Services by Third-Parties. Service Provider may procure the services of any responsible third-party to perform
all or part of the Services, insofar as said third-party complies with all security standards and procedures
required of Service Provider by Customer, and further that said third-party shall accept in writing the fiduciary
responsibility requisite of the transfer of custody. Service Provider will remain liable for all Services
performed for Customer. Service Provider will record all custody transfers and/or the use of any subcontractor
to render contracted services to the Customer and make Customer aware of any use of a subcontractor,
including their identity.


2. RESPONSIBILITIES

2.1 Right to Rely on Instructions. Service Provider may act in reliance upon any instruction, instrument, or
signature reasonably believed by Service Provider to be genuine and may assume that any of Customer’s
employees or any employee of Customer’s affiliates or subsidiaries giving any written notice, request, or
instruction has the authority to do so.

2.2 Compliance with Contracts, Laws and Regulations. Customer shall be responsible for, and warrant
compliance with, all contractual restrictions and all applicable laws, rules, and regulations, including but not
limited to environmental laws and contractual restrictions and laws governing the confidentiality, retention,
and disposition of information contained in any Customer Materials delivered to Service Provider. Service
Provider shall comply with applicable laws, statutes, regulations and ordinances.

2.2.1 Per regulatory requirements, the Customer will designate and identify a qualified Compliance Officer, either
an employee or contractor, to oversee and be responsible for the Customer’s compliance with applicable data
protection and privacy regulations. For purposes of reporting, authorization, and inquires, the Customer’s
Compliance Officer will be designated in Exhibit [“___”], and the Service Provider notified within a
reasonable time of any change.

2.2.2 Per regulatory requirements, the Service Provider will designate and identify a qualified Compliance
Officer, either an employee or contractor, to oversee and be responsible for the Service Provider’s compliance
with applicable data protection and privacy regulations. For purposes of reporting, authorization and inquires,
the Service Provider’s Compliance Officer will be designated in Exhibit [“___”], and the Customer will be
notified within a reasonable time of any change.

2.3 Cooperation and data processing. Customer shall cooperate with Service Provider with regard to the
performance of the Services, subject to normal security requirements and in a manner that is not unnecessarily
disruptive to Customer’s business operations, by providing to Service Provider such information, data, access
to premises, management decisions and approvals as may be reasonable to permit Service Provider to perform
the Services hereunder.
To the extent the Service Provider processes Personal Data (i.e. information or an opinion, whether true or
not, about an identified individual, or an individual who is reasonably identifiable or information by which a
living individual may be directly or indirectly identified, the “Personal Data”) on behalf of the Customer when
providing Services, the Service Provider undertakes to comply, and to contractually impose on each of its
subcontractors to comply, throughout the term of this Agreement with its obligations under applicable data
protection laws and notably all matters outlined at Clause 3 of this Agreement.

2.4 Hazardous Substances. Customer shall not deliver to Service Provider any material considered toxic or
dangerous or which is regulated under any federal or state law or regulation relating to hazardous materials.

In the event of the accidental or negligent custodial transfer of hazardous or regulated waste, including bio-
hazard, Customer agrees to arrange to appropriately, safely, and legally assume custody of such hazardous

materials at their expense. And further to indemnify the Service Provider from any property damage or
personal injury resulting from such transfer of material.

2.5 Performance of Services. All Services performed by Service Provider will be in a professional manner
described in the AAA DocuShred llc. written policies and procedures

2.6 Material Descriptions: Itemized lists or descriptions of contents of materials submitted by the Customer to
the Service Provider shall be generally considered for record-keeping, reconciliation, and reference purposes
only, and are not considered proof that said documents contained on such lists and descriptions are in fact
contained in the materials accepted. Service Provider will make provision for validation of such document
contents in advance and under special terms and fees at the request of the Customer.

2.6 Negotiable Items: Customer agrees to make Service Provider aware in writing and in advance of any instance
in which negotiable instruments, including but not limited to checks, bearer bonds, traveler’s checks, or
coupons will be sent to a single facility in a single service where the total combined amount of said instruments
will be in excess of [$__$100,000 _______] .


3. PERSONAL DATA PROCESSING

3.1 Personal data processing to comply with this Agreement and applicable laws. The Service Provider will
process Personal Data solely for the purposes of exercising any rights it has under this Agreement or the
performance of its obligations under or in connection with this Agreement, including to allow the Service
Provider to comply with any applicable law or the request of any competent regulator, or as otherwise
provided for under this Agreement, but in each case remains subject to Clause 5 of this Agreement.

3.2 Documented lawful instructions. The Service Provider will process Personal Data only on documented lawful
instructions, including with regard to transfers of Personal Data to a third country or an international
organization, except in the cases referred to in Clause 3.6 below or where the Service Provider is required to
do so by applicable law to which the Service Provider is subject; in the latter case, the Service Provider shall
inform the Customer of that legal requirement before the transfer, unless applicable law prohibits such
information on important grounds of public interest. The Service Provider shall inform, in accordance with
applicable law, the Customer if, in its opinion, an instruction infringes applicable data protection law. The
Customer acknowledges that its instructions to the Service Provider and as a consequence, the instructions to
natural persons acting under the authority of the Service Provider, are set out in Clauses 2 and 3 of this
Agreement, and the Service Provider should use its reasonable endeavors to ensure that each such person
complies with those instructions.

3.3 Authorized persons to be subject to confidentiality. The Service Provider will ensure that persons authorized
to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality.

3.4 Data security. The Service Provider will implement appropriate technical and organizational measures to
protect Personal Data it receives from the Customer from misuse, interference, and loss, as well as
unauthorized access, modification, or disclosure, as detailed in this Agreement.

3.5 Engagement of subcontractors. The Service Provider will not engage a subcontractor without prior specific
or general written authorization of the Customer. The Service Provider shall inform the Customer of any
intended changes concerning the addition or replacement of subcontractors, thereby giving the Customer the
opportunity to object to such changes based on reasonable grounds. If the Customer has not objected based
on reasonable grounds within 30 days as of the receipt of the notice from the Service Provider, the use of a
new subcontractor is deemed as having been accepted by the Customer.

3.6 Privacy notices rendered to Data Subjects. Responsibility for providing appropriate privacy notices to Data
Subjects lies with the Customer.

3.7 Notification of Personal Data breaches. The Service Provider will notify the Customer of any Personal Data
Security Breach (i.e. any accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access
to Personal Data) related to records, data, media, and/or electronic equipment potentially containing Personal
Information as described in Clause 2.3 without undue delay after the detection of a data breach. The
notification shall at least:

3.7.1 if possible, describe the nature of the Personal Data breach including where possible, the categories
and approximate number of data subjects concerned, and the categories and approximate number
of Personal Data records concerned;

3.7.2 if possible, communicate the name and contact details of the Compliance Office or any other point
of contact where more information can be obtained;

3.7.3 describe the likely consequences of the Personal Data breach;

3.7.4 describe the measures taken or proposed to be taken to address the Personal Data breach, including,
where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is
not possible to provide the information at the same time, the information may be provided in phases
without undue further delay.

3.8 Assistance to notify affected data subjects of Personal Data breach. The Service Provider will assist the
Customer with respect to the notification of Personal Data breaches to the affected Data Subjects.

3.9 Assistance with data protection authority investigations. The Service Provider will assist the Customer
regarding investigations from or consultations with the appropriate data protection authority.

3.10 Data processing records. The Service Provider will provide to the Customer copies of the records of data
processing concerning such Customer, which are maintained by the Service Provider in accordance with its
legal obligations.

3.11 Compliance and audit. The Service Provider will make available to the Customer all information necessary
to demonstrate compliance with the obligations laid down in this Agreement and allow for and contribute to
audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. An
audit may be carried out only during normal working hours, on reasonable and in any event not less than 14
days' prior written notice, and not more than once during each Contract Year (“Contract Year” being each
entire year as from the anniversary date of this Agreement). The scope of the audit shall be limited to matters
relevant to this Agreement. The Customer shall in respect of any audit ensure that persons conducting that
audit shall comply with the Service Provider's reasonable security requirements and confidentiality
obligations at least to the standard of those referred to in Clause 5 of this Agreement.

3.12 Written request by Data Subject. The Service Provider shall notify the Customer of any written request
from a natural person whose data is processed on behalf of the Customer:

3.12.1 requesting information concerning the Processing of, or copies of, Personal Data (including a copy of
the request);

3.12.2 requiring the rectification of any inaccurate or incomplete Personal Data;

3.12.3 requiring the erasure of Personal Data;

3.12.4 restricting the processing of Personal Data;

3.12.5 exercising his or her right to data portability in respect of Personal Data;

3.12.6 objecting to the processing of Personal Data; or, in each case made in accordance with Applicable
Laws (each a Data Subject Request) and the Service Provider shall provide assistance only to the
extent (i) it is still possible (which may not be the case if the information has been destroyed in
accordance with this Agreement and the request relates to data access, correction, or portability) and
(ii) in case the destruction process has already started, it is still reasonably possible to comply with the
request.

3.13 Notice of intention to inform regulator or Data Subject of Personal Data breach. The Customer should
give the Service Provider prior written notice of its intention to make any notification of a data breach to a
regulator or to a Data Subject where such breach has been, at least partially, caused by the Service Provider. The
Service Provider shall have sight of any disclosure to a regulator or a Data Subject of a data breach and the right
to make reasonable comments that the Customer should take into account.

3.14 Notice to Service Provider to fall within legislated timeframes. Notwithstanding Clause 3.13, prior written
notice to the Service Provider and opportunity to make comment shall not interfere with any legislated
timeframes for breach notification to a regulator or to affected Data Subjects.

3.15 Fees for compliance. The Service Provider may charge the Customer, and the Customer shall pay,
reasonable fees for the compliance with its obligations listed in Clauses 3.9 to 3.13 (but, in relation to 3.11,
only if the audit or inspection is requested by the Customer), unless it is established that the reason for the
relevant obligation being performed is due to a breach by the Service Provider of this Agreement.

3.16 Information destruction. Where the Service Provider stores, retains, or otherwise comes to be in control
of records, information, media, or electronic equipment under this Agreement, the Service Provider will
comply with Customer instructions to destroy such items as is required by regulations that restrict the retention
of Personal Data beyond its usefulness or stated retention period. It is the Customer’s responsibility to comply
with such regulatory obligations.


4. FEES AND PAYMENTS - All standard charges for Services under this Agreement shall be as specified on
Exhibit A. The prices set forth in Exhibit A shall remain in effect for the first twelve (12) months of this
Agreement. Thereafter, price adjustments shall be made only after thirty (30) days’ prior written notice. For
any service requested by Customer that is not listed on Exhibit A, the charges will be as agreed to in writing
by Customer and Service Provider prior to the rendering of such Service. Invoices shall be due and payable
within thirty (30) days from receipt of the applicable invoice. Amounts due and not paid within thirty (30)
days after Customer’s receipt of the invoice shall bear interest at the rate of one and one-quarter percent
(1.25%) per month.

4.1. ABANDONMENT BY NON-PAYMENT – Should Customer’s non-payment as stipulated in Exhibit A
bring its account “_10_” days past due, regardless of the cause, including insolvency or bankruptcy, the
Customer’s owners, partners, shareholders, and/or directors, as determined appropriate by its ownership
structure, accept personal responsibility for the Customer’s obligations herein, including any expense for the
removal or disposition of Customer Materials.

4.2. ABANDONMENT BY ABSENTIA - Should the Service Provider be unable to locate the Customer or its
owners, partners, shareholders, and/or directors after documenting reasonable attempts to do so, the Customer
agrees the Service Provider will be held harmless from any consequences of the final disposition of Customer
Materials.

4.3. REGULATORY OBLIGATIONS – The Customer agrees that the abandonment of Personal Data is a
violation of prevailing data protection and privacy protection laws and regulations, and as such the Customer,
its owners, partners, shareholders, and/or directors are subject to prosecution, fines, and other sanctions as
regulators may determine. The Customer agrees that the Service Provider will be held harmless in regard to
such regulations in the event the disposition of abandoned Customer Materials by the Service Provider is
deemed non-compliant with mandated retention requirements.


5. CONFIDENTIALITY – The Service Provider will keep information relating to Customer’s property,
business, and affairs reasonably confidential unless instructed otherwise in writing by the Customer, wherein
such instruction to the Service Provider does not entail an illegal act. Unless such Confidential Information
was previously known to Service Provider, it is free of any obligation to keep it confidential, is subsequently
made public by Customer or by a third-party having a legal right to make such disclosure, or was known to
Service Provider prior to receipt of same from Customer, it shall be held in confidence by Service Provider
and shall be used only for the purposes provided in this Agreement. However, Service Provider may comply
with any subpoena or similar order related to materials delivered to Service Provider, provided that it shall,
unless prohibited by law, notify Customer promptly of any such subpoena or notice. Customer shall pay
Service Provider’s reasonable costs for such compliance.


6. TERM AND TERMINATION

6.1 Term. This Agreement shall commence on the Effective Date set forth above and, unless otherwise terminated
in accordance with Section 6.2, shall continue in effect for one year, with automatic renewal for successive
one-year terms, unless written notice of nonrenewal is delivered by either party to the other not less than
ninety (90) days prior to the date of expiration of such term.


6.2 Termination. Either party may terminate this Agreement if the other is in material or repeated breach of any
of its obligations hereunder and the breaching party has not cured the breach within sixty (60) days after
written notice from the non-breaching party. In the event of any such termination, all amounts due for Services
rendered up to the effective date of termination shall become due and payable.

Required procedure, penalties and payments resulting from termination of a
contact – for instance, the return of bins or permanent removal fees and moving
costs would be added here or in Exhibit A, which would then be referenced.


7. CLAIMS AND DISPUTE RESOLUTION

7.1 Time for Presenting Claims. Customer must present any claim with respect to any Service in writing to
Service Provider within a reasonable time and in no case later than three (3) months after the occurrence of
the event on which the claim is based.

7.2 Arbitration. Any claim, controversy, or dispute arising out of or relating to this Agreement, or any
interpretation or breach of this Agreement or performance under this Agreement, including without limitation
to any dispute concerning the scope of this Article 7, that cannot be resolved within fifteen (15) days by
informal discussions between the parties, shall be resolved by submission to final, binding, and non-
appealable arbitration, without any right by either party to trial de novo in any court. Such arbitration and all
pre-hearing, hearing, and post-hearing arbitration procedures, including for discovery, disclosure of
arbitrator’s interests, and challenge of designation of any arbitrator, shall be conducted under the Commercial
Arbitration Rules of the American Arbitration Association. A single arbitrator shall be selected by the
American Arbitration Association.

7.3 Services during Arbitration. During any arbitration proceedings, Service Provider shall continue to provide
Services, and Customer shall continue to make payments to Service Provider, in accordance with this
Agreement. The fact that arbitration is or may be allowed shall not impair the exercise of any termination
rights under this Agreement.


8. LIABILITY AND WARRANTY

8.1 Limitation of Liability. Service Provider shall not be responsible or liable in any manner whatsoever
for the release or loss of any materials deposited in bins, or otherwise staged or segregated, while such
materials remain within the care and custody of the Customer, and prior to the Service Provider
practicably accepting physical custody. In event the Customer can demonstrate financial damages
resulting from Service Provider’s negligence or willful misconduct, the maximum liability for any and
all claims arising with respect to the Services provided under this Agreement shall not exceed the
aggregate amounts paid by Customer with respect to the Services provided at the particular Customer
location during the six (6) months preceding the event which gives rise to a claim. In no event shall
Service Provider be liable for any consequential, incidental, special, or punitive damages, regardless of
whether the action is brought in tort, contract, or any other theory.

(Alternative Clause Option in 8.1)

8.1 Limitation of Liability. Service Provider shall not be responsible or liable in any manner whatsoever
for the release or loss of any materials deposited in bins, or otherwise staged or segregated, while such
materials remain within the care and custody of the Customer, and prior to the Service Provider
practicably accepting physical custody. In event the Customer can demonstrate financial damages
resulting from Service Provider’s negligence or willful misconduct, the maximum liability, including
consequential, incidental, special or punitive damages, regardless of whether the action is brought in
tort, contract or any other theory, for any and all claims arising with respect to the Services provided
under this Agreement shall not exceed the limits of the required professional liability indemnification
reflect in clause 8.1.1

8.1.1 Indemnification Requirement. At all times during the effective term of this Agreement, the Service Provider shall be indemnified by an appropriately structured professional liability insurance policy to pay any and all valid, applicable financial damages resulting from the Service Provider’s negligence or
willful misconduct. Evidence of such coverage must be provided upon execution of this Agreement and
updated as necessary on an annual basis. Furthermore, the Service Provider will be responsible to
notify the Customer of any claim against such insurance that depletes or affects the Service Provider’s
claim limitation under said professional liability insurance policy. For purposes of this agreement, the
limitation of the Service Provider’s professional liability, as defined in 8.1, is this booking form per month for 12 months.

8.2 Ownership Warranty. Customer warrants that it is the owner, legal custodian, or otherwise has the right to
deliver for confidential destruction any and all Customer Materials provided to Service Provider hereunder.
Customer shall reimburse Service Provider for any expenses reasonably incurred by Service Provider
(including reasonable legal fees) by reason of Service Provider complying with its obligations under this
Agreement to [store/manage/destroy] such Customer Materials in the event of a dispute concerning the
[storage/management/destruction] of the materials provided by Customer to Service Provider.


9. MISCELLANEOUS

9.1 Notices. All notices hereunder shall be in writing and addressed to either party at its address set forth above
(or to such other address as either party may specify by notice given in accordance with this Section). Notices
to Service Provider shall be sent to the attention of [__Melanie Siewers__].

9.2 Binding Nature and Assignment. Customer agrees the Service Provider may assign this Agreement to a
Successor provided the Successor is bound by the same covenants and obligations, operates under the same
policies and procedures, and meets or exceeds Service Provider

9.3 Force Majeure. Each party shall be excused from any delay or failure in performance under this Agreement
for any period if and to the extent that such delay or failure is caused by acts of God, governmental actions,
labor unrest, riots, unusual traffic delays, or other causes beyond its control.

9.4 Relationship of Parties. Service Provider is acting as an independent contractor hereunder and the Customer
has the sole right and obligation to supervise, manage, contract, direct, procure, perform, or cause to be
performed all work to be performed by Service Provider under this Agreement.

9.5 Entire Agreement. This Agreement constitutes the entire agreement between Service Provider and Customer
with respect to the subject matter of this Agreement. No change, waiver, or discharge of this Agreement shall
be valid unless in writing and executed by the party against whom such change, waiver, or discharge is sought
to be enforced. Except as provided in Section 3, this Agreement may be amended only by an amendment in
writing signed by Customer and Service Provider.

9.6 Invalidity. If any provision of this Agreement is declared invalid by any tribunal of competent jurisdiction,
then such provision shall automatically be adjusted to the minimum extent necessary to the requirements for
validity as declared at such time and as so adjusted shall be deemed a provision of this Agreement as though
originally included herein. In the event that the provision invalidated is of such a nature that it cannot be so
adjusted, the provision shall be deemed deleted from this Agreement as though such provision had never been
included herein. In either case, the remaining provisions of this Agreement shall remain in effect.

9.7 Exclusivity: Customer agrees to retain Service Provider on an exclusive basis at all facilities covered by this agreement for the term of this contract.

IN WITNESS WHEREOF, each of the parties have caused this Agreement to be executed by its duly authorized
representative as of the Effective Date first set forth above.

Note re: U.S. Data Protection Regulations: Though the U.S. has no overarching data protection or privacy law, federal regulations such as the Health Insurance Portability & Accountability Act (HIPAA), The Financial Services Modernization Act (a.k.a. Gramm-Leach-Bliley Act or GLBA), and several other Federal and most state data protection regulations require a written agreement between the Data Controller and any Data Processor.