{"id":29039,"date":"2022-11-17T17:34:38","date_gmt":"2022-11-18T00:34:38","guid":{"rendered":"https:\/\/grin.co\/?page_id=29039"},"modified":"2025-10-09T14:25:10","modified_gmt":"2025-10-09T21:25:10","slug":"legal-dpa","status":"publish","type":"page","link":"https:\/\/grin.co\/legal-dpa\/","title":{"rendered":"Legal DPA"},"content":{"rendered":"\n
\n

GRIN Technologies Inc.<\/strong>
Data Processing Addendum<\/strong><\/h1>\n\n\n\n

(Last updated April 15, 2024)<\/strong><\/p>\n\n\n\n

<\/div>\n<\/div><\/section>\n\n\n\n
\n

This Data Processing Addendum including all schedules and annexes (\u201cDPA<\/strong>\u201d) forms part of the GRIN Subscription Services Agreement (\u201cAgreement<\/strong>\u201d) between GRIN Technologies Inc. (\u201cVendor<\/strong>\u201d) and Customer. Except as modified below, the terms of the Agreement shall remain in full force and effect.<\/p>\n\n\n\n

Customer enters into this DPA on behalf of itself and, to the extent required under Applicable Data Protection Laws, in the name and on behalf of its Affiliates. For the purposes of this DPA only, and except where indicated otherwise, the term \u201cCustomer\u201d shall include Customer and its Affiliates. All capitalized terms not defined herein shall have the meaning set forth in the Agreement.<\/p>\n\n\n\n

In the course of providing the Services to Customer pursuant to the Agreement, Vendor may Process Personal Data on behalf of Customer and the Parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.<\/p>\n\n\n\n

  1. Definitions. Capitalized terms not defined shall have the meaning given in the Agreement. In this DPA, the following terms (and derivations of such terms) have the following meanings:<\/span>
    1. \u201cApplicable Privacy Laws<\/strong>\u201d means all international, federal, national, and state privacy and data protection laws and regulations applicable to the Processing of Personal Data that is the subject matter of the Agreement.<\/span><\/li>
    2. \u201cCCPA<\/strong>\u201d means the California Consumer Privacy Act of 2018 and related regulations and amendments, as further amended from time to time.<\/span><\/li>
    3. \u201cController<\/strong>,\u201d \u201cData Subject<\/strong>,\u201d \u201cProcessor<\/strong>,\u201d and \u201cProcessing<\/strong>\u201d have the meanings set forth in Applicable Privacy Laws. If and to the extent that Applicable Privacy Laws do not define such terms, then the definitions in the European Data Protection Laws shall apply.<\/span><\/li>
    4. “Data Privacy Framework<\/strong>” means the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce, as may be amended, superseded, or replaced.<\/span><\/li>
    5. \u201cData Privacy Framework Principles<\/strong>\u201d means the Principles and Supplemental Principles contained in the relevant Data Privacy Framework, as may be amended, superseded or replaced.<\/span><\/li>
    6. \u201cBusiness<\/strong>\u201d and \u201cThird Party<\/strong>\u201d have the definitions set forth in the CCPA.<\/span><\/li>
    7. \u201cData Subject Rights<\/strong>\u201d means those rights identified in the Applicable Privacy Law.<\/span><\/li>
    8. \u201cEEA<\/strong>\u201d means the European Economic Area.<\/span><\/li>
    9. \u201cEuropean Data Protection Laws<\/strong>\u201d means the laws of the European Union or any member state of the European Union to which the Customer or Vendor is subject, the EEA, the United Kingdom, or Switzerland which relates to the protection of Personal Data<\/span><\/li>
    10. \u201cEU GDPR<\/strong>\u201d means the General Data Protection Regulation ((EU) 2016\/679).<\/span><\/li>
    11. \u201cEU Standard Contractual Clauses<\/strong>\u201d means the standard contractual clauses set out in the Commission Implementing Decision (EU) 2021\/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016\/679 of the European Parliament and of the Council, as amended or replaced from time to time by a competent authority.<\/span><\/li>
    12. \u201cCreator<\/strong>\u201d means an individual who, has accepted Vendor\u2019s Terms of Use and has an active Creator account and login credentials for access to the Platform.<\/span><\/li>
    13. \u201cPersonal Data<\/strong>\u201d means any data related to an identified or identifiable natural person.<\/span><\/li>
    14. \u201cPublic Authority<\/strong>\u201d means a government agency or law enforcement authority, including judicial authorities.<\/span> <\/span><\/li>
    15. \u201cCustomer Data<\/strong>\u201d means any Personal Data for which Customer is a Controller or Processor on behalf of another Controller, which is provided by Customer (directly or indirectly) to Vendor in connection with the Agreement and\/or which may be processed by Vendor as a Processor on behalf of Customer or Customer\u2019s Controller client, and which includes Personal Data relating to:<\/span>
      1. Customer\u2019s employees, contractors, representatives, agents and consultants (and those of Customer\u2019s) Affiliates; and<\/span><\/li>
      2. Customer\u2019s client.<\/span><\/li><\/ol><\/li>
      3. \u201cSupervisory Authority<\/strong>\u201d means the relevant supervisory authority in the territories where the parties to this Agreement are established or have legal representatives for the purposes of compliance with Applicable Privacy Laws.<\/span><\/li>
      4. \u201cCustomer Data Incident<\/strong>\u201d means the accidental, unauthorized or unlawful Processing, destruction, loss, alteration, damage, corruption, disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed by Vendor.<\/span><\/li>
      5. \u201cSub-Processor<\/strong>\u201d means an entity engaged by a Processor or any further sub-contractor to Process Personal Data on behalf of and under the instructions of a Controller, including any applicable \u201cService Provider\u201d as the term is defined in the CCPA.<\/span><\/li>
      6. \u201cSwiss DPA<\/strong>\u201d means the Swiss Federal Data Protection Act and its Ordinance.<\/span><\/li>
      7. \u201cUK Data Protection Laws<\/strong>\u201d means the EU GDPR as transposed into United Kingdom national law by operation of section 3 of the European Union Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) Regulations 2019 (\u201cUK GDPR<\/strong>\u201d), together with the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended) and other data protection or privacy legislation in force from time to time in the United Kingdom.<\/span><\/li>
      8. \u201cUK Addendum<\/strong>\u201d means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) Data Protection Act 2018.<\/span><\/li>
      9. \u201dVendor Data<\/strong>\u201d means any Personal Data for which Vendor is a Controller which is provided (directly or indirectly) by Vendor to Customer in connection with Vendor\u2019s provision of the Services to Customer and which includes Personal Data relating to:<\/span>