This website (“Website”) is operated by Grata, Inc. (“Grata”). The terms “Grata,” “we,” “us,” “our,” and “ours” when used in this privacy policy (“Privacy Policy”) includes subsidiaries, divisions, branches, affiliates, or companies in common control of Grata, unless such entity maintains its own privacy policy. The terms “you,” “your,” and “yours” when used in this Privacy Policy means any user of this Website or Online Services (as defined below).

Scope of Privacy Policy

This Privacy Policy describes our current policies and practices regarding personal data collected by us from you directly and/or through the Website or Online Services (as defined below). The term “personal data” refers to information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your device. This Privacy Policy applies only to operation of Websites and Online Services that directly link to this policy when you click on the Privacy Policy link. We have adopted this Privacy Policy to comply with applicable law. Nothing in the Privacy Policy shall be interpreted or construed to limit, undermine, curtail other rights granted to you by applicable law. We may provide separate privacy policies that apply to specific products or services that we offer; in which case this Privacy Policy does not apply.

Online Services

Grata’s Online Services include Grata Intelligence and related private-market intelligence and AI-assisted search and analysis, and additional services that may be added from time to time (“Online Services”). By accessing or using our Online Services, you acknowledge that your personal data may be collected, used, and processed in accordance with this Privacy Policy.

Notification of Changes to this Privacy Policy

Grata is continually improving our methods of communication and adding new functionality and features to this Website and to our existing services. Because of these ongoing changes, changes in the law and the changing nature of technology, our data privacy practices may change. We encourage you to check this page frequently and anytime you submit personal data via the Website or Online Services. If we make any changes to this Privacy Policy, we will change the Effective Date above. If such changes are material in nature, we will provide you with additional notice (such as adding a statement to the main website page or sending you an email notification).

Collection, Use, and Disclosure of your Personal Data

This Privacy Policy sets forth how Grata collects and processes information through our website as well as the business search and discovery services we provide through the Online Services to registered users.

Please read this Privacy Policy carefully to understand our policies and practices regarding the information we maintain and process, and how we will treat such information. If you do not agree with our policies and practices, you should not use our Online Services. By accessing or using our Services, you agree to this Privacy Policy.

Accessibility: If you have trouble accessing this Privacy Policy, contact us at privacy.grata@grata.com.

Grata as a processor or service provider

Some Online Services require Grata to process data submitted to Grata via its Customer, which may include personal data. Some materials supplied by customers for processor services may contain sensitive personal data subject to customer instructions. Grata may act as a service provider or processor under agreements with customers, processing that information on documented customer instructions, subject to applicable law. The customer generally determines the purpose and lawful basis of that customer-directed processing and is responsible for any required notices.

Grata as a controller or business

Information provided directly to us

We may collect names, work contact details, employer, job title, account credentials or identifiers, correspondence, requests, support records, professional interests, billing and transaction information, event registration information, survey responses and job application materials. Customer administrators or other users may invite or identify colleagues and provide their work contact information on your behalf.

Information collected through use of the Website, Online Services, and by automated means

We may automatically collect IP addresses, device and browser characteristics, approximate location inferred from IP addresses, cookie and similar identifiers, authentication records, pages visited, searches, feature usage, access dates, user actions, diagnostic and security logs, and interactions with emails or marketing content. We use various technologies to collect and store this information, including cookies, pixel tags, local storage (such as browser web storage and application data caches), databases, server logs, and other similar technologies. Some service features retain user-supplied notes, lists, queries, feedback, integration settings, and other workspace content.

Information we receive from third parties

To build, maintain, verify, enrich and deliver searchable business-intelligence datasets, we obtain and derive information from publicly available company websites, professional profiles and directories, registries and filings, licensed data vendors and partners, contributed data from users, and other business-related sources. We may use automated web technologies, analytical models, machine learning and human research to classify, deduplicate, infer, update and verify company or professional information. Users may also contribute contact information about themselves or other people. Data may include a professional’s name, employer, position, professional contact details, public professional profile, business affiliations and related company attributes. We may combine these records with other information and draw inferences relating to businesses and professional roles.

Sensitive Personal Data

Grata does not intentionally seek sensitive personal data for its standard company and professional-contact datasets. Please do not provide sensitive personal data unless specifically requested for a legitimate purpose. We handle any sensitive personal data in accordance with applicable law.

Links to Other Websites

This Website may contain hyperlinks to websites that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement of the activities of these third-party Websites or any association with their operators. We do not control these websites and are not responsible for their operation, data, or privacy practices. We urge you to review any privacy policy posted on any site you visit before using the site or providing any personal data about yourself.

Cookies & Similar Technologies

Internet activity and browsing Information is automatically collected through various means such as cookies and pixels through our Services or in our emails.

“Cookies” are pieces of information that may be placed on your device by a service for the purpose of facilitating and enhancing your communication and interaction with that service. “Pixels” are small tags placed on a website or within the body of an email for the purpose of tracking certain activities, such as views or open rates.

Many services use these technologies. For example, we may use cookies (and similar items such as clear gifs, web beacons, tags, etc.) through our Online Services to customize your visit, analyze how you use our Services and for other purposes to make your visit more convenient, to manage your account or to enable us to enhance our Services.

The type of Cookies that we use can be found at the footer of our website. You can control the Cookies via the Cookies Settings located as a footer to the Website. Please note that third parties (including, for example, advertising networks and providers of external services, like web traffic analytic services) may also use cookies, over which we have no control. You may exercise your cookie preferences generally by setting or amending your web browser controls to accept or refuse all cookies.

How We Use Your Information Collected from You

We use information that we collect from you only as described in this Privacy Policy or as otherwise disclosed to you at the time of collection:

Use of Personal Data	Legal Basis
1. To provide you with the requested information on products or services	For the performance of our contract with you or to take steps at your request before entering into a contract;
2. To provide and to facilitate the delivery of products and services you request;	For the performance of our contract with you or to take steps at your request before entering into a contract;
3. To provide customer service and support	For the performance of our contract with you;
4. To send you related information, including confirmations, invoices, technical notices, updates, security alerts, training and support and administrative messages;	For the performance of our contract with you;
5. To create, maintain, transition, customize, and secure your account with us;	For the performance of our contract with you or to take steps at your request before entering into a contract;
6. For direct marketing purposes;	For our legitimate interests, i.e., to promote our business, products, and services to existing and former customers; and consent where applicable
7. To operate, audit and improve the Website or Online Services;	For the performance of our contract with you; and For our legitimate interests, i.e. – to understand how Online Service or Website is accessed, and how it is used, - to determine if there are any potential security issues arising from such use, - to make sure we are following our own internal procedures so we can deliver the best service to you, - to understand customer/potential customer feedback and in responding to your communications in a consistent way, for other quality control and training purposes, - to understand impact of any marketing offers that we make, and – to maintain our accreditations so we can demonstrate we operate at the highest standards;
8. To conduct research and development;	For our legitimate interests, i.e. - to be as efficient as we can so we can deliver the best service for you at the best price, - to develop, improve, support, service and maintain our products and services, - to develop new services and to improve or personalise existing services, and - to understand market and usage trends;
9. To perform customer surveys; Create anonymous data	For our legitimate interests, i.e. - collecting and assessing feedback, - identifying usage and market trends, - determining the effectiveness of our marketing campaigns, and – to evaluate and improve our products, services; - marketing and customer relationships; We may create anonymous data from your personal data and other individuals whose data we collect and make sure that we exclude data that personally identifies you and only use the data for our legitimate interests
10. To understand you and your preferences when using our Website or Online Services;	For our legitimate interests, i.e., to develop new services and to improve or personalise existing services;
11. To disclose the information in our databases and server logs to comply with a legal requirement;	For the administration of justice, for the purposes of national security only to the extent that is strictly necessary and proportionate, to interact with anti-fraud databases, to protect your vital interests, to protect the security or integrity of our databases or this Website and Online Services, to take precautions against legal liability;
12. Link or combine it with other personal information we get from third parties;	For our legitimate interests, i.e. - to minimize fraud that could be damaging for us and for you, - to promote our business, products, and services to existing and former customers, - to be as efficient as we can so we can deliver the best service for you at the best price, and - to help understand your needs, provide you with better service
13. If you submit your resume or CV, we will use the information to process your inquiry and to monitor recruitment statistics;	For our legitimate interests, i.e. - Job candidate processing, - to provide more information about employment opportunities, or - to take steps at your request before entering into employment with us;
14. In the event of a corporate sale, merger, reorganization, dissolution or similar event, your personal data may be part of an asset transfer or sale;	For our legitimate interests, i.e., corporate development;
15. Preparing internal and financial reports, and business modeling.	Our legitimate interest in the management of our business operations and reporting obligations

Where we rely on our legitimate interest, we will balance that against our applicable legal obligations to you. We will not collect additional categories of personal data or use the personal data we collected for materially different, unrelated, or incompatible purposes without providing you with notice.

If we request your consent to use your personal data, you have the right to withdraw your consent any time in the manner indicated when we requested the consent or by contacting us. If you have consented to receive marketing communications from our third-party partners, you may withdraw your consent by contacting those partners directly.

Sharing of Personal Data

We may disclose your information as described in this Privacy Policy or otherwise with your consent:

To contractors, service providers, and other third parties we use to help operate and support our Services;
For customer service and account management, such as a chatbot that creates AI generated responses based on your service questions;
To supplement, update, or correct the data or provide additional publicly available data;
To manage mailings on our behalf;
To aggregate data collected through our Online Services and Website;
To perform customer surveys and call recordings;
To assist with personalized marketing efforts;
To personalize your Website or Online Services experience;
To facilitate marketing events and customer surveys;
Where necessary in the course of the professional services that professional advisors such as lawyers, bankers, auditors, and insurers provide to us;
To prevent fraud, money laundering, undertake credit checks, comply with laws, and check with identity verification agencies;
To process an order, issue invoices, take payment from, make payment to your organization, or manage account or payment history;
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which information held by the Company about our Services users is among the assets transferred;
To comply with any court order, law, or legal process, including to respond to any lawful government or regulatory request;
For safety and security purposes; and
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our users or third parties.

We may transfer your personal data to any third party who is not otherwise covered by the categories listed above where you have given us permission to do so, or with whom you have entered into a contract when we need to transfer your personal data to that party in order to fulfill that contract.

When we disclose your personal data for a business purpose, we enter a contract that requires that all third-party processors process your personal data with the same level of protection and in a manner consistent with the uses agreed upon in this Privacy Policy.

Data Retention

We will retain your information for as long as your account is active or as needed for us to manage and provide our services and for our legitimate business needs. When personal data is no longer necessary or relevant for the stated purpose or to fulfil a legal or business requirement, it shall be securely destroyed. We will either physically or electronically erase personal data. When processing in our role as a processor, we will retain personal data for as long as our customer instructs us to and/or as required by applicable law. Personal data about unsuccessful candidates will be held for 12 months before being destroyed or deleted.

Even if we delete some or all your personal information, we may continue to retain and use de-identified or aggregate data previously collected.

Security

We maintain reasonable organisational, administrative, technical and physical precautions to protect against unauthorized access to our systems and to prevent data from being disclosed to unauthorized parties. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instruction, and they are subject to a duty of confidentiality.

Transfers

Your personal data may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country, and in some cases, may not provide an adequate level of protection for personal data. Where such laws are applicable to the processing of personal data, we will put in place the appropriate safeguards to require that your personal data will remain protected in accordance with applicable law for such processing or transfer, including United Kingdom International Data Transfer Agreements, European Commission’s Standard Contractual Clauses, and ANPD Standard Contractual Clauses.

Your Rights

We will make reasonable efforts to keep personal data accurate, complete, and up to date as is necessary to fulfill the purposes for which the information is to be used.

Depending on the territorial jurisdiction in which you are a resident of, in certain circumstances you may have certain rights regarding your personal data including:

right to withdraw consent in cases where consent is relied upon;
right to obtain access to or a copy of, correct and erase of your personal data;
right to lodge a complaint;
right to object to any automated processing of personal data;
right to restrict, or object to, how we use your personal data;
right to move or provide some of your personal data to other companies;
right to ask us to stop using your personal data;
right to ask why we are using your personal data, what personal data we are using, with whom we are sharing, the period for which it is retained, the source of the personal data where it was not provided by you, and the transfers of the personal data to countries outside the EU, Switzerland and the United Kingdom.

In certain circumstances we may not be able to do this or may not be required to do this. If you would like to exercise, or discuss, any of these rights, please see below (“Exercising Rights”).

California Residents

Within the past twelve (12) months, we have collected the categories of personal information identified above and have “sold,” as defined under the CCPA, such personal information contained in our searchable databases in connection with providing services to our customers. You have the right to opt out of such sales by following the process described below.

Automated Decision Making

You may have the right not to be subject to automated decision making (e.g., profiling) that significantly affects you. The exercise of this right is not available to you in the following cases:

The automated decision is required to enter into, or perform, a contract with you;
We have your explicit consent to make such a decision;
The automated decision is authorised by local law of an EU member state or English law.

Unless the automated decision is authorized by local, English or EU law, you still have the right to obtain human intervention in respect of the decision, to express your point of view and to contest the decision.

Exercising Your Rights

To exercise your data quality, access, choice, and corrections rights described above, please submit a verifiable request to our Office of the General Counsel by submitting a request to privacy.grata@grata.com. Only you may make a request related to your personal data. We endeavor to respond to a verifiable request within any legally required time limit or otherwise within thirty (30) days of its receipt. Such period may generally be extended with written notification, and deliver our response (or reasons we cannot comply with a request) via electronic mail. We will not discriminate against you for exercising any of your rights. We may make a charge, if excessive, repetitive, or manifestly unfounded.

For inquiries related to our activities in the EEA, you may contact our representative data protection contact at privacy.grata@grata.com or via mail at Datasite Germany GmbH, Company # 49989, Mainzer Landstr. 36, 60325 Frankfurt am Main, Germany.

For inquiries related to our activities in the UK, you may contact our representative data protection contact at privacy.grata@grata.com or via mail at Datasite UK Limited, 15 Bonhill Street, London, EC2A 4DN, United Kingdom.

For inquiries related to our activities in Brazil, you may contact our representative data protection contact at privacy.grata@grata.com or via mail at Datasite Brasil ADM. De Informacao E Documentos Ltda., Av. Brigadeiro Faria Lima, nº 3.311, in the City of São Paulo, State of São Paulo, Postal Code 05426-100.