; or (ii) is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims. (B) Exclusion Such term does not include a covered entity that processes or transfers the covered data outside of the direct relationship between the service provider and the covered entity. (22) Service provider data The term service provider data means covered data that is collected by or has been transferred to a service provider by a covered entity for the purpose of allowing the service provider to perform a service or function on behalf of, and at the direction of, such covered entity. (23) Small business (A) In general The term small business means an entity that can establish that, with respect to the 3 preceding calendar years (or for the period during which the entity has been in existence if, as of such date, such period is less than 3 years) the entity does not— (i) maintain annual average gross revenue in excess of $25,000,000; (ii) annually process the covered data of an average of 100,000 or more individuals, households, or devices used by individuals or households; and (iii) derive 50 percent or more of its annual revenue from transferring individuals’ covered data. (B) Common control; common branding For purposes of subparagraph (A), the annual average gross revenue, data processing volume, and percentage of annual revenue of an entity shall include the revenue and processing activities of any person that controls, is controlled by, is under common control with, or shares common branding with such entity. (24) Third party The term third party — (A) means any person or entity that— (i) processes or transfers third party data; and (ii) is not a service provider with respect to such data