{"id":29036,"date":"2022-11-17T16:43:25","date_gmt":"2022-11-17T23:43:25","guid":{"rendered":"https:\/\/grin.co\/?page_id=29036"},"modified":"2026-02-05T11:44:21","modified_gmt":"2026-02-05T18:44:21","slug":"legal-data-security","status":"publish","type":"page","link":"https:\/\/grin.co\/legal-data-security\/","title":{"rendered":"Legal Data Security"},"content":{"rendered":"\n
\n

GRIN Technologies Inc.<\/strong>
Data Security Policy<\/strong><\/strong><\/h1>\n\n\n\n

(Last updated Nov 17, 2022)<\/strong><\/p>\n\n\n\n

<\/div>\n<\/div><\/section>\n\n\n\n
\n

Programs and Policies<\/strong>
a. \u00a0Security Program. Grin maintains and enforces a security program that addresses the management of security and the security controls employed by Grin. The security program includes:
i. \u00a0 documented policies that Grin formally approves, internally publishes, communicates to appropriate personnel and reviews at least annually;
ii. \u00a0documented, clear assignment of responsibility and authority for security program activities;
iii. policies covering, as applicable, acceptable computer use, information classification, cryptographic controls, access control, removable media, and remote access; and
iv.\u00a0regular testing of the key controls, systems and procedures.
b. Privacy Program. Grin maintains and enforces a privacy program and related policies that address how data is collected, used and shared.
\u00a0
2. Risk and Asset Management
a. \u00a0Risk Management. Grin performs risk assessments and implements and maintains controls for risk identification, analysis, monitoring, reporting, and corrective action.
b. \u00a0Asset Management. Grin maintains and enforces an asset management program that appropriately classifies and controls hardware and software assets throughout their life cycle.
\u00a0
3. Worker Education
a.\u00a0 Workers. All Grin employees, agents, and contractors (collectively \u201cWorkers\u201d) acknowledge their information security and privacy responsibilities under Grin\u2019s policies.
b.\u00a0 Worker Controls. For Workers who will create, process, receive, access, transmit or store (\u201cHandle\u201d or \u201cHandling\u201d) data, Grin:
i. \u00a0 conducts security and privacy training;
ii. \u00a0implements disciplinary processes for violations of information security or privacy requirements; and
iii. upon termination or applicable role change, promptly removes or updates Worker access rights and requires the return or destruction of data.
\u00a0
4. Network and Operations Management
a.\u00a0 Policies and Procedures. Grin implements policies and procedures for network and operations management. Such policies and procedures address: hardening, change control, segregation of duties, separation of development and production environments, technical architecture management, network security, virus protection, media controls, protection of information in transit, data integrity, encryption, audit logs, and network segregation.
b.\u00a0 Vulnerability Assessments. Grin performs periodic vulnerability assessments and testing on systems and applications that Handle data.
\u00a0
5. Access Control
a.\u00a0 Access Control. Grin implements access controls designed to maintain the confidentiality of data. Such controls include:
i. \u00a0 authorization processes for physical, privileged, and logical access to facilities, systems, networks, wireless networks, operating systems, mobile devices, system utilities, and other locations containing data; and
ii. \u00a0granting access only if it is logged, strictly controlled, and needed for a Worker or third party to perform their job function.
b.\u00a0 Authentication. Grin authenticates each Worker\u2019s identity through appropriate authentication credentials such as strong passwords, token devices, or biometrics.
\u00a0
6. Information Security Incident Management
a.\u00a0 Incident Management Program. Grin implements an information security incident management program that addresses management of information security incidents including a loss, theft, misuse of or unauthorized access, disclosure or destruction of any data (\u201cIncident\u201d).
b.\u00a0 Incident Reporting. Grin will promptly, and no less than within 48 hours, notify Customer of any Incident affecting customer data.
c.\u00a0 Response. Grin agrees to partner with Customer to respond to the Incident. Response may include: identifying key partners, investigating the Incident, providing regular updates, and determining notice obligations. Except as may be required by law, Grin may not notify Customer\u2019s affected customers about an Incident without first consulting Customer.
<\/p>\n<\/div><\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":35,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"landing-pages":[],"header-type":[],"class_list":["post-29036","page","type-page","status-publish","hentry"],"acf":{"subtitle":""},"_links":{"self":[{"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/pages\/29036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/comments?post=29036"}],"version-history":[{"count":8,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/pages\/29036\/revisions"}],"predecessor-version":[{"id":52014,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/pages\/29036\/revisions\/52014"}],"wp:attachment":[{"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/media?parent=29036"}],"wp:term":[{"taxonomy":"landing-pages","embeddable":true,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/landing-pages?post=29036"},{"taxonomy":"header-type","embeddable":true,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/header-type?post=29036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}