Last Revised: April 2, 2025
1. SCOPE.
1.1 General Scope. Subject to the terms and conditions of this Agreement, Grata agrees to provide to Client access to the features and functions of the Solution as set forth in a Solution Schedule.
1.2 License to Use the Solution. Subject to the terms of this Agreement, Grata hereby grants to Client during the Term, and Client hereby accepts from Grata, a limited, non-exclusive, non-transferrable, non-sublicensable, and fully revocable right and license to: (a) use the outputs or results generated from Client’s use of the Solution (the “Grata Data”) for Client’s legitimate internal business purposes, and (b) use, and make a reasonable number of copies of the text and/or graphical documentation that describe the Solution (the “Documentation”). Client is not permitted to use the Solution in excess of the usage restrictions set forth in this Agreement and the applicable Solution Schedule or in any manner not expressly authorized thereby or by applicable law. For avoidance of doubt and except as expressly authorized herein or in a Solution Schedule, Client is not permitted to share the Solution, the Grata Data, or the Documentation with any third parties, provided, however, that decks, models, memos, and reports created by Client using Grata Data may be shared with Client’s consultants and/or advisors that are bound to protect the Grata Data through confidentiality obligations consistent with those herein or professional/ethical obligations. All rights not specifically granted to Client are hereby reserved by Grata. Notwithstanding the foregoing, Grata may discontinue or alter any aspect of the Solution or restrict the availability of the Solution in Grata’s sole discretion without prior notice or any liability, provided that, subject to Section 1.3, the functionality of the Solution will not be materially diminished during the applicable Term.
1.3 Third Party Data. As part of the Grata Data, Client may have access to third party information (the “Third Party Data”) which has been independently obtained by Grata from publicly available web data, financial markets information services, financial publishers, various securities markets, and other sources (collectively, “Third Party Data Providers”). The Third Party Data is the property of the Third Party Data Providers or others, may be protected by copyright and/or other intellectual property rights, and its accuracy or continued availability is not controlled or guaranteed by Grata. Except as expressly provided herein or in a Solution Schedule, Client agrees not to reproduce, retransmit, disseminate, sell, distribute, publish, broadcast, circulate, or commercially exploit the Third Party Data in any manner without the consent of Third Party Data Provider(s). Client’s obligations under this provision shall remain in effect upon the expiration or termination of this Agreement.
1.4 Client Data; Usage Data; Grata Use; Opt-in Data.
1.4.1 Client Data. Client Data is defined herein as any material submitted by Client to Grata through the Solution. As further set forth in Section 5.1 below, Client owns Client Data. Client grants to Grata a limited, non-exclusive, transferrable, perpetual, irrevocable, royalty-free, worldwide license for the Term, to use, copy, store, process, display, perform, and transmit the Client Data solely to enable Grata to provide the Solution to Client.
1.4.2 Usage Data. Usage Data is defined herein as information related to Client’s configuration and use of the Solution. As further set forth in Section 5.2 below, Grata owns Usage Data.
1.4.3 Grata Use. Client acknowledges and agrees that Grata and its Affiliates may use the Client Data and/or Usage Data, for its business purposes, including, without limitation, for analytical purposes and for servicing and/or improving the Solution, provided that prior to any disclosure of Client Data and Usage Data, as applicable, such data has been aggregated and/or de-identified. For clarity, aggregated data cannot be linked specifically to Client or its Authorized Users (defined below) and de-identified data has had all individual identifiers removed. Additionally, Grata does not and will not use Client Data to train any internal AI or machine learning models or algorithms as part of its Solution without Client’s explicit written consent.
1.4.4. Opt-in Data. The Solution may enable Client to opt-in to add Client Data to Grata Data, in order to improve the Solution and the Grata Data. If Client opts in, Client acknowledges and agrees that Grata may supplement the Grata Data and/or Solution with information Grata is able to verify was submitted by Client hereunder. In the event that Client so elects to add Client Data into the Solution, Client grants to Grata and its Affiliates an irrevocable, sublicensable, perpetual, worldwide, fully-paid, royalty free right and license to use the Client Data, without restriction, as part of the Grata Data. The inclusion of the Client Data into the Grata Data shall not result in Client receiving any ownership over the Grata Data, it being understood that the Grata Data shall remain the sole property of Grata.
1.4.5 Trade Names. With Client’s prior written consent (email acceptable), Client allows Grata to use Client’s trade names, trademarks, and service marks in connection with any marketing materials prepared by or for Grata disclosing the existence of a business relationship between the parties.
1.5 Usage Restrictions. Client will ensure that its use of the Solution, Grata Data, and the Documentation complies with all applicable laws, statutes, regulations or rules. Client will not: (a) copy, duplicate, or modify the Solution or modify the Documentation or the Grata Data; (b) decompile, disassemble, reverse engineer, attempt to create a competitive product to the Solution, or otherwise attempt to obtain or perceive the source code from which any software component of the Solution is compiled or interpreted, and Client acknowledges that nothing in this Agreement will be construed to grant Client any right to obtain or use such source code; (c) create any commercial product from the Solution, the Documentation or the Grata Data, except with the prior written consent of Grata; (d) populate, publish, transfer, transmit, or use the Grata Data in a separate platform or service offering, except with the prior written consent of Grata; or (f) assign, sublicense, sell, resell, lease, rent, or otherwise encumber the license(s) granted to Client under this Agreement; (g) use any robot, spider, service search/retrieval application, or other automated device, process or means to access, retrieve, copy, scrape, or index any portion of the Solution. Client shall not use the Solution, Grata Data, and/or the Documentation except in compliance with this Agreement. Client shall be responsible for those employees, agents and independent contractors of Client who are authorized by Client to use the Solution (“Authorized Users”). Client shall not integrate Grata Data into any system for the purpose of allowing persons who are not Authorized Users to access or use the Grata Data. Client shall ensure that the Authorized Users are at all times under the direct control of Client, and shall ensure that the use of the Solution by the Authorized Users is in accordance with this Agreement, it being understood that any breach of this Agreement by the Authorized Users shall be deemed a breach by Client of this Agreement. Client is responsible for maintaining the security of usernames and passwords provided to Client, and Client accepts all responsibility for all activities that occur under its or its Authorized Users’ accounts. Grata is not liable for any loss or damage resulting from Client or Authorized Users’ failure to protect the accounts. In the event Grata has a reasonable belief that Client or any Authorized User is engaged in any unauthorized access or use of the Grata Data, Solution, or Documentation or is in violation of this Agreement, Grata, in its sole discretion, may immediately suspend Client’s access to the Solution and/or Grata Data until such violation is resolved to Grata’s reasonable satisfaction. Grata will have no liability to Client for such period of suspension and a suspension shall have no effect on the Term or on Client’s obligation to pay the Fees.
1.6 Excused Down Time. Client’s use of the Solution may be interrupted or unavailable from time to time, including under the following circumstances (collectively, “Excused Down Time”): (a) third party equipment malfunctions; (b) periodic maintenance or repairs which Grata may undertake from time to time; (c) emergency maintenance or repairs; (d) malfunctions and other failures relating to the web sites or services of third parties affecting the Solution or Client Data; or (e) causes beyond the reasonable control of Grata, including, without limitation, interruption or failure of telecommunication or digital transmission links, hostile network attacks, network congestion, or other failures.
1.7 Additional Obligations. Client acknowledges and agrees that Client shall be solely responsible for procuring and/or maintaining the applicable information technology and telecommunications capabilities to access and use the Solution as set forth in the Documentation. Client shall reasonably cooperate with Grata to enable Grata to perform its obligations under this Agreement and/or applicable law.
1.8 Flat File. Client may have access to functionality that enables Client to download Grata Data from the Solution via a CSV format on a daily basis (“Flat File”), as specified in the Solution Schedule. For the avoidance of doubt, Flat File shall be considered Grata Data hereunder. Client may only use the Flat File for internal review and analysis, and, except as otherwise permitted in this Agreement and a Solution Schedule, in no event shall Client share or distribute the Flat File to any third party whatsoever.
1.9 API. Client may have access to one or more application program interfaces (“APIs”), as specified in the Solution Schedule. APIs are deemed part of the Solution. Grata hereby grants to Client a non-exclusive, non-transferable, and non-sublicensable right and license to use the APIs solely to develop, reproduce and/or distribute internal applications or implementations that interoperate with the API, which are only accessible to Client (the “Client Applications”), and that display any Grata Data made available through the API solely internally to Client. Client is solely responsible for the operation of the Client Application. Grata makes no representation or warranty that the API will properly interface with the Client Application, and shall not be responsible for any errors or outages due to the use of the Client Application with the API.
1.10 Attribution. Any Grata Data downloaded and/or integrated into any system must be maintained with information clearly indicating that the Grata Data originated with Grata by, for example, indicating that the lead source of the Grata Data is “Grata.”
2. FEES AND PAYMENT.
2.1 Fees. Client shall pay to Grata all fees in the amount, at the times, and in the manner set forth in the applicable Solution Schedule (the “Fees”). Solution Schedules are non-cancelable and all Fees are non-refundable.
2.2 Payment. If Client does not comply with the payment terms herein, Grata may pursue any and all of the remedies set forth herein or otherwise available at law and in equity. Client agrees to pay interest at the rate equal to the maximum rate allowed by applicable law, on any outstanding balance, together with costs of collection. Fees do not include any applicable taxes or duties, including, without limitation, all use, sales, value added, excise, transfer, privilege, property and any other applicable taxes and duties. Client shall be responsible for all taxes and duties assessed with respect to the Solution provided under this Agreement, excluding taxes which may be levied against Grata’s income, property or employees. No failure by Grata to request any payment or to demand any performance hereunder shall be deemed a waiver by Grata of Client’s obligations hereunder or a waiver of Grata’s right to suspend Client’s access to the Solution or terminate this Agreement.
2.3 Suspension of Access to the Solution. Failure of Client to fully pay any Fees when due or Client’s breach of Section 1.3 or 1.5, as applicable, shall be deemed a material breach of this Agreement and justify the immediate suspension of Client’s access to the Solution or, in Grata’s discretion, the termination of this Agreement pursuant to Section 4.2 below. Any such suspension does not relieve Client from paying all Fees due Grata under this Agreement for the remainder of the applicable Term.
3. TERM AND TERMINATION.
3.1 Term. This Agreement commences on the Effective Date of the first Solution Schedule between the parties and continues until all subscriptions granted in accordance hereunder have expired or been terminated. The Term of a Solution Schedule shall be as set forth therein, will commence on the Effective Date thereof, and will automatically renew for additional, successive twelve (12) month renewal periods (each, a “Renewal Term”) unless otherwise specified in the Solution Schedule or terminated by either party with written notice of non-renewal at least thirty (30) days prior to the last day of the then current Term.
3.2 Termination for Cause. Either party may terminate this Agreement (or a Solution Schedule) immediately upon written notice to the other party in the event that the other party: (a) materially breaches any provision of this Agreement (or a Solution Schedule) and fails to cure such breach within thirty (30) days after written notice of such breach; (b) is the subject of a voluntary or involuntary bankruptcy, reorganization or liquidation proceeding, is insolvent, makes an assignment for the benefit of creditors or admits in writing its inability to pay debts when due; or (c) dissolves or otherwise ceases operation of its business. Additionally, Grata may immediately terminate this Agreement (or a Solution Schedule) upon written notice to Client, and refund a pro rata portion of prepaid, unused Fees in the event (i) Grata’s rights or licenses to deliver content with which the Client Data is to be made available via the Solution are terminated; or (ii) Grata ceases to operate the Solution for any reason.
3.3 Consequences upon Termination/Expiration. Upon the termination or expiration of this Agreement (or a Solution Schedule) for any reason: (a) Grata’s obligations to Client shall immediately and automatically terminate; (b) Client shall immediately pay to Grata any Fees outstanding pursuant to this Agreement; (c) Client shall remove all Grata Data from its systems, servers, and other locations where Grata Data may be stored, and Client will, upon Grata’s request, for up to one (1) year after termination or expiration hereof, provide Grata with a certificate executed by an authorized representative certifying 24500compliance with this provision. Notwithstanding the foregoing, Client may retain (i) copies of Grata Data consistent with its existing electronic document retention policies and systems; and (ii) except in the event of a termination by Grata due to Client’s material breach, de minimis amounts of Grata Data contained in decks, models, and reports created by Client prior to expiration or termination hereof, both (i) and (ii) subject to Client’s continued compliance with the obligations and restrictions in this Agreement with regard to any such retained Grata Data.
4. RISK ALLOCATIONS.
4.1 Warranties. Each party represents and warrants to the other party that it has full power and authority to enter into and perform its obligations under this Agreement and that it has all necessary rights, licenses, and consents in accordance with applicable laws including data protection laws(including, with respect to Grata, to Third Party Data) to fulfill its obligations hereunder. Client represents and warrants to Grata that: (a) the Client Data shall not violate any applicable law or infringe upon or violate the rights of any person; and (b) Client owns the Client Data and all intellectual property rights therein, or has all necessary rights to grant the licenses to Grata herein.
4.2 Disclaimer. Grata does not represent or warrant that: (i) the Solution will meet Client’s specific requirements; or (ii) that the quality of the Solution or any products, services, or information provided therewith (including the Grata Data) will meet Client’s expectations. Client assumes sole responsibility for results obtained from the use of the Solution by the Client, and for conclusions drawn from such use. Grata shall have no liability for any damage caused by errors or omissions in the Solution or Grata Data, or any information, instructions or scripts provided by Client. WITH THE EXCEPTION OF THE LIMITED WARRANTY SET FORTH IN SECTION 4.1, THE SOLUTION IS PROVIDED “AS IS”, WITHOUT WARRANTIES OF ANY KIND, AND GRATA HEREBY DISCLAIMS ANY WARRANTIES, EXPRESS OR IMPLIED, RELATING THERETO, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR TIMELINESS. GRATA DOES NOT WARRANT THAT THE SOLUTION WILL BE UNINTERRUPTED, ALWAYS AVAILABLE, TIMELY, SECURE, OR ERROR FREE, NOR DOES GRATA MAKE ANY WARRANTY OF ANY KIND AS TO THE PERFORMANCE OF THE SOLUTION OR THAT ANY RESULTS THAT MAY BE OBTAINED OR GENERATED BY THE SOLUTION WILL BE ACCURATE, TIMELY, OR RELIABLE.
4.3 Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER OR ANY THIRD PARTY FOR ANY INDIRECT, CONSEQUENTIAL, SPECIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, ANY DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, OR LOSS OF DATA, IN ANY WAY ARISING OUT OF OR RELATED TO THE SOLUTION OR THIS AGREEMENT, EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE CUMULATIVE LIABILITY OF A PARTY FOR ALL CLAIMS ARISING FROM OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL AMOUNT OF ALL FEES PAID AND PAYABLE TO GRATA BY CLIENT UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD PRIOR TO THE ACT, OMISSION, OR EVENT GIVING RISE TO SUCH LIABILITY.
4.4 Mutual Indemnification. Each party shall indemnify, defend and hold the other party harmless from all third party claims (and pay all liabilities, costs and expenses that are finally awarded or agreed to in a settlement) to the extent caused by (i) the indemnifying party’s gross negligence or willful misconduct, (ii) in case of Client as the indemnifying party, the Client Data, or (iii) in case of Grata as the indemnifying party, allegations that the Solution, when used in accordance with this Agreement and the applicable Solution Schedule, infringes a third party’s intellectual property rights.
4.5 Class Action Waiver. No party shall commence or seek to prosecute or defend any dispute, controversy, or claim based on any legal theory arising out of or relating to this Agreement, or the breach thereof, other than on an individual, non-class, non-collective action basis, nor in a representative or private attorney general basis.
5. OWNERSHIP.
5.1 Client Data Ownership. As between the parties, Client shall retain all right, title, and interest in and to Client Data. Grata hereby acknowledges and agrees that except as set forth herein, Grata has no right, title or interest in or to Client Data.
5.2 Grata Ownership. As between the parties, Grata shall retain all right, title, and interest in and to any of Grata’s materials and content, the Solution and any content displayed thereon, the Documentation, any materials and content transmitted by Grata to Client, the Grata Data (including Usage Data), and all of Grata’s trade names, trademarks and service marks, and all legally protectable elements, derivative works, enhancements, modifications, updates, or upgrades to the foregoing. In addition, Grata will shall retain all right, title, and interest in and to data reflecting access or use of the Solution by or on behalf of Client or its Authorized Users, including, without limitation, any clickstream data, bug tracking data, or any search queries entered by Client or Authorized Users while using the Solution. Client hereby acknowledges and agrees that except as expressly set forth herein, Client has no right, title, or interest in or to any of the foregoing.
6. CONFIDENTIALITY.
6.1 During the course of performance of this Agreement, either party may disclose to the other certain Confidential Information (as defined below). The receiving party shall maintain the secrecy of, and shall not use or disclose, Confidential Information disclosed to it pursuant to this Agreement except for such purposes as set forth herein. All files, lists, records, documents, drawings, documentation, end-user materials, specifications, equipment, or computer programs that incorporate or refer to any Confidential Information shall be returned, deleted, or destroyed (at the disclosing party’s election) by the receiving party promptly upon termination or expiration of this Agreement (or a Solution Schedule). As used herein, “Confidential Information” shall mean: (a) the terms and conditions of this Agreement and the applicable Solution Schedule or any other agreement executed between the parties,; (b) all nonpublic information concerning the business, technology, products, services, internal structure and strategies of the disclosing party that should reasonably be understood to be confidential given the nature of the information and the circumstances surrounding the disclosure, specifically including, Client Data, the Documentation, the Solution, and Grata Data; and (c) any information clearly labeled by the disclosing party in writing as “confidential” or with a similar label, prior to its disclosure. The following information will not be considered Confidential Information: (i) information which was in the public domain prior to its disclosure; (ii) information which becomes part of the public domain by any means other than through violation of this Agreement; and (iii) information independently developed by the receiving party without reference to the disclosing party’s Confidential Information. A party may disclose Confidential Information if required to do so in order to comply with any legal, court or administrative order; provided, however, that the receiving party gives the disclosing party reasonable notice as allowed by law that such Confidential Information is being sought by a third party, so as to afford the disclosing party the opportunity to limit or prevent such disclosure.
6.2 Client Data is stored at third-party hosting facilities [within the European Economic Area/[the United States of America] unless otherwise requested by Client. Client acknowledges that Grata’s provision of the Solution may involve the processing of personal data (as defined by applicable data protection laws) which may include Grata sharing such personal data with its authorized third-party users or as otherwise for provided in the Agreement, Solution Schedule or the Data Processing Addendum. Client has sole responsibility for ensuring that the provision of personal data to Grata for processing complies with applicable data protection laws. In addition to the obligations set forth, the Parties agree to the Data Processing Addendum attached to this Agreement. Client shall ensure it complies with the applicable data protection laws in relation to any personal data that Grata provides to the Client as part of the Solution
7. GENERAL PROVISIONS.
7.1 Relationship of the Parties. The relationship of Grata and Client established by this Agreement shall be solely that of independent contractors, and nothing herein shall create or imply any joint venture or other relationship. Except as otherwise provided herein, nothing in this Agreement shall be construed to give either party the power to direct or control the daily activities of the other party, to make or give any agreement, statement, representation, warranty, or other commitment on behalf of such party, to enter into any contract or otherwise incur any liability or obligation, express or implied, on behalf of such party, or to transfer, release, or waive any right, title, or interest of such party.
7.2 Entire Agreement; Modification. This Agreement and all Solution Schedules hereunder constitute the entire agreement between the parties with respect to the subject matter herein and supersede all other written or oral agreements and representations related thereto. Grata may modify or update this Agreement from time to time. Grata will post the modified or updated Agreement to this website and update the Last Revised date above. Modifications and updates will become effective upon posting. It is Client’s responsibility to periodically review this Agreement for any changes. Client’s continued use of the Solution after any modifications or updates constitutes Client’s acceptance of this Agreement, as updated. If Client does not agree to this Agreement or any updated Agreement, Client may not use or access (and/or shall immediately discontinue further use of and/or access to) the Solution. The terms and conditions of any inconsistent present or future purchase order submitted by Client shall not alter the terms of this Agreement unless expressly consented to in writing by Grata. No use of trade or other regular practice or method of dealing between the parties shall be used to modify, interpret, supplement, or alter in any manner the terms of this Agreement.
7.3 Severability; Survival. If any term or provision of this Agreement shall be held to be invalid, illegal or unenforceable, the remaining terms and provisions of this Agreement shall remain in full force and effect, and such invalid, illegal or unenforceable term or provision shall be deemed not to be part of this Agreement. Any provision of this Agreement which, by its nature, is intended to survive, shall remain in effect following any termination or expiration of this Agreement.
7.4 Governing Law; Venue. Subject to the Data Processing Addendum, his Agreement shall be governed by and construed, interpreted, and enforced in accordance with the laws of England and the parties shall submit to the non-exclusive jurisdiction of the courts of England and Wales
7.5 Notices. Any notice required hereunder shall be delivered by hand, by courier service, or by U.S. mail to the address provided by the party to be notified. Either party may change the referenced addresses and contact information by written notice to the other in accordance with this section. Notices shall be effective: (a) as of the date personally delivered if by hand or (b) for notices sent by U.S. mail, five (5) business days after the postmark date, or (c) upon receipt if sent by courier service. Notices also may be delivered by electronic means (with confirmation of receipt) and notices so delivered shall be effective upon actual receipt of the electronic transmission.
7.6 Waiver. Except as specifically provided in a written waiver signed by a duly authorized representative of the party seeking enforcement, the failure to enforce or the waiver of any term of this Agreement shall not constitute the waiver of such term at any time or in any circumstances and shall not give rise to any restriction on or condition to the prompt, full and strict enforcement of the terms of this Agreement.
7.7 Assignments and Benefit. Client may not assign this Agreement without the prior written consent of Grata. Grata may assign this Agreement in connection with the sale, merger, reorganization or disposition of the business operations relating to the Solution or to its Affiliates.. Affiliates means any entity that directly or indirectly controls, is controlled by, or is under common control of Grata. Client may not resell, assign, trade, exchange, barter, broker or otherwise transfer any of its rights under this Agreement without the prior written consent of Grata, and any attempt to do so in violation hereof shall result in the immediate termination of this Agreement. This Agreement shall be binding upon and inure to the benefit of Client and Grata and their respective successors and permitted assigns, subject to the other provisions of this section. Grata may subcontract its obligations relating to providing the Solution, to third party service providers. Grata will remain responsible for the acts and omissions of third party service providers it retains.
7.8 Third Parties. Except as expressly provided herein, nothing in this Agreement, express or implied, shall create or confer upon any person or entity not a named party to this Agreement any legal or equitable rights, remedies, liabilities or claims with respect to this Agreement.
This Addendum on Data Processing (hereinafter: “Addendum”) is by and between:
Client and its affiliates as defined in the Solution Schedule:
– hereinafter referred to as “Client” –
and
Grata entity as defined in the Solution Schedule :
– hereinafter referred to as “Grata”–
Hereinafter each individually referred to also as the “Party” and collectively as the “Parties.”
All Personal Data is stored at third-party hosting facilities within the European Economic Area (“EEA”). Client acknowledges that Grata may transfer Personal Data outside of EEA in performance of the Solution; however, Personal Data will continue to be in the EEA. Unless transferred on the basis of an adequacy decision issued by the applicable national authority, or as otherwise allowed under Data Protection Rules, all transfers of Personal Data out of the EEA shall be governed by SCCs together with Appendix 3, and all transfers of Personal Data out of the United Kingdom shall be governed by IDTA which shall be incorporated into this addendum by reference together with Appendix 4. Grata will abide by the requirements of European Data Protection Laws regarding the collection, use, transfer, retention, and other processing of Personal Data from the EEA, United Kingdom, and Switzerland.
Upon Client’s request and subject to reasonable notice, time, place, frequency and manner restrictions, and confidentiality requirements, Grata shall make available to Client information necessary to demonstrate compliance with Grata’s obligations under the Addendum and applicable Data Protection Rules. Grata will allow for and contribute to audits, including inspections, conducted by Client, or an independent third-party auditor appointed by Client. To the extent Client’s rights under this section cannot reasonably be satisfied through audit reports, documentation, or compliance information Grata makes generally available to its customers, Client shall be responsible for all costs and fees related to such audit.
Upon the request of the Client or upon termination of this Addendum, Grata will, return (in accordance with the Agreement) or destroy all Personal Data and copies thereof, unless applicable Data Protection Rules or another legal obligation require Grata to retain Personal Data for longer. Upon the request of the Client, Grata will certify that this has been done.
Without prejudice to the rights or remedies available to Data Subjects under Data Protection Rules, the liability of the Parties and the limitation thereof, including any claim brought by an Affiliate, shall be in accordance with the Agreement
Personal Data are transferred and Processed for the following purposes:
Subject Matter and Nature of Processing:
Categories of Personal Data:
The types of Personal Data are determined and controlled by Client in its sole discretion, and may include, but are not limited to:
Special Categories of Data (if applicable):
Subject to any applicable condition in the Agreement, the types of Special Categories of Data are determined and controlled by Client in its sole discretion, and may include, but are not limited to:
Data Subjects:
The categories of Data Subjects to which Personal Data relate are determined and controlled by Client in its sole discretion, and may include, but are not limited to:
Retention:
Transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:
Competent Supervisory Authority:
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Security Requirement | How Grata implements the specific information security measure | |
1. | Measures of encryption of personal data | Personal Data is encrypted at rest and in-transit using industry standard encryption and in-transit via Transport Layer Security (TLS) 1.2 protocol, which shall be updated from time to time in line with reasonable technological developments as determined by Grata. |
2. | Measure for ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services | Grata is SOC 2 Type 2 compliant ensuring that it maintains and enforces appropriate administrative, physical and technical safeguards to protect the integrity, availability, and confidentiality of Client’s Personal Data |
3. | Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident. | Grata has redundancy with each platform and maintains logs of system availability. In addition, redundancy allows for continuous system backups. Grata has Disaster Recovery and Business Continuity Plans that are reviewed, updated, and tested periodically. |
4. | Processes for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing | Grata completes regular code reviews, vulnerability testing, and annual penetration testing on the Website. |
5. | Measure for user identification and authorization | Access is governed by Grata’s access management standard that follows roles-based access controls. Access to Personal Data is provided only to personnel as strictly necessary for the sole purpose of satisfying Client’s instructions. The Access Management Standard requires the (a) access rights to be reviewed, updated, approved by management on a regular basis; and (b) access rights be withdrawn within 24 hours of employee’s termination. Other types of relevant controls are password requirements, multi factor authentication and restriction on removable media which are implemented at the corporate level. |
6. | Measures for the protection of data during transmission | Data is encrypted in transit using industry standard encryption technologies, currently via Transport Layer Security (TLS) 1.2 protocol, which shall be updated from time to time in line with reasonable technological developments as determined by Grata. |
7. | Measures for the protection of data during storage | Personal Data is encrypted at rest using industry standard encryption technologies, currently AES 256-bit encryption, which shall be updated from time to time in line with reasonable technological developments as determined by Grata |
8. | Measures for ensuring physical security of locations are which personal data are processed | Grata relies on cloud services providers for its data storage requirements. Information regarding Amazon Web Service’s physical security protocols for its servers locations is available at: https://aws.amazon.com/compliance/data-center/controls/#Physical_Access. All data centers hold ISO 27001:2013 and SOC 2 Type 2 certifications. With respect to Grata’s facilities, all offices require badge access and utilize newly updated video surveillance using cameras with recordings stored in the cloud. |
9. | Measures for ensuring events logging | Grata performs logging and monitoring that is centrally collected and normalized within its SIEM tool. Logs are retained for 180 days, and access is roles and responsibility based |
10. | Measures for ensuring system configuration, including default configuration | Grata has standard build processes and applies CIS hardening standards |
11. | Measures for internal IT and IT security governance and management | Grata maintains a robust information security management system governed by Grata’s PIMS committee that is responsible for implementing and maintaining a stable and secure environment. |
12. | Measures for certification/assurance of processes and products | Grata has maintained a SOC 2 Type 2 attestation since 2022. |
13. | Measures for ensuring data minimization | Personal Data collected and processed will not be held or used unless necessary to provide the solution in compliance with the Service Agreement and Grata’s policies and Privacy |
14. | Measures for ensuring data quality | Grata utilizes an anti-malware client on all systems. Personal Data uploaded to the Website is scanned by Grata’s anti-malware software as part of the document processing activities that occur within the platform. |
15. | Measures for ensuring limited data retention | Personal Data is purged beginning 30 days post project closure or upon termination of Service Agreement. |
16. | Measures for ensuring accountability | All activity logged is tracked and reportable. Personnel complete training and acknowledge compliance with Grata’s code of conduct and policies annually. All personnel are required to sign an NDA. The Code of Conduct is affirmed by all personnel on a yearly basis. |
17. | Measures for allowing data portability and ensuring erasure | Client hosts Personal Data on servers as defined in the Service Agreement which may be transferred to other locations in which Grata maintains servers, upon request. Personal can be returned to clients via a secure file, if requested. Deletion of Personal Data begins 30 days from project closure or termination of the Service Agreement. |
18. | For transfer to (sub-) processors, also describe the specific technical and organizational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter | Grata maintains a Vendor Security Standard that details minimum vendor security standards necessary to store, process or transmit Personal Data that provides a baseline of control expectations for the evaluation of each vendor, conformance, and risk acceptance based on the nature of the vendor relationship.Each in scope vendor is required to sign contracts (DPA SCCs) that ensure the same level of protection to Grata as Grata obligations to Client. |
Preamble
The SCCs are incorporated by reference to this Appendix 3 and the annexes to the SCCs as specified under Section 4 below, applies to the Processing of Personal Information by Grata in its role as a Processor as part of the provisions of the SOlution under the Agreement, between the Grata and Client, where such Personal Information is Processed by Grata and/or a Grata affiliate in a third country outside the EU/EEA that has not received an adequacy finding under European Data Protection Laws.
Only to the extent applicable with regards to the Processing of Swiss Personal Information, the Parties wish to clarify that (1) references to EU member states in the SCCs shall not be interpreted in such a way that data subjects in Switzerland are excluded from exercising their rights at their habitual residence in Switzerland, (2) these Clauses also protect data pertaining to legal entities as long as Swiss Federal Act of 19 June 1992 on Data Protection, as amended, including Ordinance of the FADP, remain in force; and that (3) the Swiss Regulator is the competent authority for the purposes of Agreement.
The parties shall agree on the following:
EU Standard Contractual Clauses As Supplemented by the UK International Data Transfer Addendum in Accordance with UK GDPR
Preamble
The SCCs as supplemented by the IDTA (version B1.0) applies to the Processing of Personal Information by Grata in its role as a Processor as part of the provision of Solution under the Agreement, between Grata and Client, where such Personal Information is Processed by Grata and/or an affiliate in a third country outside the United Kingdom that has not received an adequacy finding from the Information Commissioner’s Office or another competent UK Regulator where Grata is acting as a data exporter to the Client acting as Data Importer.
The parties agree the following: