Terms of Service
Data Use Addendum
Effective Date: November 26th, 2024
This Data Use Addendum (“Addendum”) supplements the Terms of Service (the “Terms”) entered into by and between you (“Customer”) and Crunchbase, Inc. (“Crunchbase”). Crunchbase enters into this Addendum on behalf of itself and, to the extent required under Applicable Privacy Laws (defined below), in the name and on behalf of its Affiliates (defined below), if any. This Addendum incorporates the terms of the Terms, and any terms not defined in this Addendum shall have the meaning set forth in the Terms. In the event of a conflict between the terms and conditions of this Addendum and the Terms, the terms and conditions of this Addendum shall supersede and control.
ARTICLE I – DEFINITIONS
“Affiliate” means (i) an entity of which a party directly or indirectly owns fifty percent (50%) or more of the stock or other equity interest, (ii) an entity that owns at least fifty percent (50%) or more of the stock or other equity interest of a party, or (iii) an entity which is under common control with a party by having at least fifty percent (50%) or more of the stock or other equity interest of such entity and a party owned by the same person, but such entity shall only be deemed to be an Affiliate so long as such ownership exists.
“Anonymous Data” means Personal Data that has been Processed in such a manner that it can no longer be attributed to an identified or identifiable natural person.
“Applicable Privacy Law(s)” means the CCPA, the EU GDPR, the UK GDPR (collectively, the EU GDPR and the UK GDPR, referred to as the “GDPR”), and any other data protection, privacy, data breach, or similar or related laws applicable to a party’s use or other Processing of Personal Data.
“CCPA” means the California Consumer Privacy Act of 2018, as amended, together with its implementing regulations..
“Controller” means any person who would fall under the definition of a “Controller” as set forth in the GDPR, a “Business” as set forth in the CCPA, or any similar definition under any other Applicable Privacy Laws.
“Content” has the same meaning as it does in the Terms of Service, excluding User Submissions provided to Crunchbase via Customer’s productivity tools (e.g. CRMs, e-mail, sales engagement tools, etc.).
“Data Subject” means an identified or identifiable person to whom Personal Data relates.
“Data Exporter” means Customer.
“Data Importer” means Crunchbase.
“EU SCCs” means the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for transfers of personal data to countries not otherwise recognized as offering an adequate level of protection for Personal Data by the European Commission (as amended and updated from time to time).
“ex-EEA Transfer” means the transfer of Personal Data, which is Processed in accordance with the GDPR, from the Data Exporter to the Data Importer (or its premises) outside the European Economic Area (the “EEA”), and such transfer is not governed by an adequacy decision made by the European Commission in accordance with the relevant provisions of the GDPR.
“ex-UK Transfer” means the transfer of Personal Data, which is Processed in accordance with the UK GDPR and the UK Data Protection Act 2018, from the Data Exporter to the Data Importer (or its premises) outside the United Kingdom (the “UK”), and such transfer is not governed by an adequacy decision made by the Secretary of State in accordance with the relevant provisions of the UK GDPR and the UK Data Protection Act 2018.
“ex-Switzerland Transfer” means the transfer of Personal Data, which is Processed in accordance with the FADP, from the Data Exporter to the Data Importer (or its premises) outside Switzerland, and such transfer is not governed by an adequacy decision made by the Federal Council in accordance with the relevant provisions of the FADP.
“FADP” means the Federal Act on Data Protection of 25 September 2020, as amended from time to time.
“EU GDPR” means EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016.
“Included Data” means any Personal Data included in the Content and provided to or otherwise accessed by Customer under the Terms.
“Personal Data” means any information relating to a Data Subject which is subject to Applicable Privacy Laws.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed.
“Process” or “Processing” means any operation or set of operations which is performed upon the Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.
“Processor” means any person who would fall under the definition of a “Processor” as set forth in the GDPR, a “Service Provider” as set forth in the CCPA, or any similar definition under any other Applicable Privacy Laws.
“Protected Data” means any Personal Data which Crunchbase Processes in its capacity as a Processor on behalf of Customer, and, for clarity, includes Personal Data contained in User Submissions provided to Crunchbase via Customer’s productivity tools (e.g. CRMs, e-mail, sales engagement tools, etc.), and excludes Included Data, Anonymous Data and Personal Data collected, used, and shared in accordance with Crunchbase’s Privacy Policies.
“Services” means the Service (as defined in the Terms).
“Standard Contractual Clauses” means the EU SCCs and the UK SCCs.
“Supervisory Authority” means an independent public authority which is established by a member state of the European Union, United Kingdom, Iceland, Liechtenstein, Norway, or Switzerland, as applicable.
“UK GDPR” means the UK Data Protection Act 2018 (“DPA”) and the UK General Data Protection Regulation as defined by the DPA as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
“UK SCCs” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0) issued by the UK Information Commissioner, as amended, updated or replaced from time to time.
The parties acknowledge that in the context of the Services, Crunchbase determines the purposes and means of Processing of certain types of Personal Data, in particular but not limited to business contact details of Customer’s and Customer Affiliates’ personnel and contractors in order to allow Crunchbase to administer and perform the Services. When Processing Personal Data in this manner, Crunchbase is a Controller of such Personal Data and the terms of this Addendum shall not apply to such Processing. Depending on the Services, Crunchbase may also Process Protected Data in the capacity of a Processor. The provisions of Article II below shall apply when Crunchbase Processes such Protected Data in a capacity of a Processor. The parties acknowledge that each party Processes Included Data in a capacity as a Controller, and that with respect to such Processing they Process such Included Data as independent controllers, not joint controllers. The provisions of Article III below shall apply to such independent Processing of Included Data.
ARTICLE II – PROCESSING OF PROTECTED DATA
Rights & Obligations.
Customer shall, in its use of the Services, at all times Process Personal Data, and provide instructions for the Processing of Protected Data, in compliance with all Applicable Privacy Laws. Customer shall ensure that its instructions comply with all laws, rules and regulations applicable in relation to the Protected Data, and that the Processing of Protected Data in accordance with such instructions will not cause Crunchbase to be in breach of any Applicable Privacy Laws. Crunchbase shall immediately notify Customer if an instruction, in Crunchbase’s opinion, violates any Applicable Privacy Laws; however, Customer is solely responsible for the accuracy, quality, and legality of (i) the Protected Data provided to Crunchbase by or on behalf of Customer, (ii) the means by which Customer acquired any such Protected Data, and (iii) the instructions it provides to Crunchbase regarding the Processing of such Protected Data. Customer shall not provide or make available to Crunchbase any Protected Data in violation of the Terms or otherwise inappropriate for the nature of the Services and shall indemnify Crunchbase from all claims and losses in connection therewith. Crunchbase shall notify Customer without undue delay if Crunchbase makes a determination that it can no longer meet its obligations under the CCPA. To the extent required by the CCPA, and upon reasonable written notice that Customer reasonably believes Crunchbase is using Protected Data in violation of the CCPA or this Addendum, Customer shall have the right to take reasonable and appropriate steps to help ensure that Crunchbase uses the Protected Data in a manner consistent with Customer’s obligations under the CCPA and stop and remediate any unauthorized use of the Protected Data.
The subject matter, nature, purpose, and duration of Crunchbase’s Processing of Protected Data, as well as the types of Protected Data Processed and categories of Data Subjects, are described in Exhibit A to this Addendum. Crunchbase shall not Process Protected Data: (i) for purposes other than those set forth in the Terms and/or Exhibit A; (ii) in a manner inconsistent with the terms and conditions set forth in this Addendum or any other documented instructions provided by Customer, unless required to do so by a Supervisory Authority to which Crunchbase is subject; or (iii) in violation of Applicable Privacy Laws. Customer hereby instructs Crunchbase to Process Protected Data in accordance with the foregoing and as part of any Processing initiated by Customer in its use of the Services.
In addition, for the purposes of the CCPA, and except to the extent permitted by the CCPA, Crunchbase is prohibited from: (a) selling the Protected Data or sharing the Protected Data for cross-context behavioral advertising purposes; (b) retaining, using, or disclosing the Protected Data outside of the direct business relationship between Crunchbase and Customer and for any purpose other than for the specific purpose of performing the Services; and (c) combining the Protected Data received from, or on behalf of, Customer with any Protected Data that may be collected from Crunchbase’s separate interactions with the individual(s) to whom the Protected Data relates or from any other sources, except to perform a business purpose or as otherwise permitted by law.
Crunchbase may aggregate, anonymize, or de-identify Protected Data and Process such data for its own purposes. To the extent Crunchbase receives de-identified data (as such term is defined under the CCPA) from Customer, Crunchbase shall: (a) take commercially reasonable measures to ensure that the data cannot be associated with an identified or identifiable individual; and (b) publicly commit to maintain and use the data only in a de-identified form and not attempt to re-identify the data.
Following completion of the Services, at Customer’s choice, Crunchbase shall return or delete the Protected Data, unless further storage of Protected Data is required or authorized by applicable law. If return or destruction is impracticable or prohibited by law, rule or regulation, Crunchbase shall take reasonable measures to block such Protected Data from any further Processing. If Customer and Crunchbase have entered into Standard Contractual Clauses as described below (Transfers of Personal Data), the parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) of the UK SCCs and Clause 8.1(d) and Clause 8.5 of the EU SCCs (as applicable) shall be provided by Crunchbase to Customer only upon Customer’s request.
Authorized Employees and Sub-Processors.
Crunchbase shall take commercially reasonable steps to ensure the reliability and appropriate training of any employee authorized to access Protected Data in connection with this Addendum or the Terms (each, an “Authorized Employee”). Crunchbase shall ensure that all Authorized Employees are made aware of the confidential nature of Protected Data and have executed confidentiality agreements that prevent them from disclosing or otherwise Processing, both during and after their engagement with Crunchbase, any Protected Data except in accordance with their obligations in connection with the Services.
Customer acknowledges and agrees that Crunchbase may (1) engage its Affiliates and the sub-Processors set forth on the list attached as Exhibit B and incorporated herein by this reference (the “List”), as such List may be updated from time to time in accordance with this Section (“Authorized Sub-Processors”) to access and Process Protected Data in connection with the Services and (2) from time to time engage additional third parties for the purpose of providing the Services, including without limitation the Processing of Protected Data. By way of this Addendum, Customer provides general written authorization to Crunchbase to engage sub-Processors as necessary to perform the Services.
The List may be updated by Crunchbase from time to time. At least ten (10) days before enabling any third party other than Authorized Sub-Processors to access or participate in the Processing of Protected Data, Crunchbase will add such third party to the List and provide Customer with notice of this addition. Customer may reasonably object to such an engagement on legitimate grounds by informing Crunchbase in writing within ten (10) days of receipt of the aforementioned notice by Customer. Customer acknowledges that certain sub-Processors are essential to providing the Services and that objecting to the use of a sub-Processor may prevent Crunchbase from offering the Services to Customer. If Customer reasonably objects to an engagement in accordance with this paragraph, and Crunchbase cannot provide a commercially reasonable alternative within a reasonable period of time, Crunchbase may terminate this Addendum. Termination shall not relieve Customer of any fees owed to Crunchbase under the Terms.
Crunchbase will enter into a written agreement with each Authorized Sub-Processor imposing on the Authorized Sub-Processor data protection obligations comparable to those imposed on Crunchbase under this Addendum with respect to the Processing of Protected Data. In case an Authorized Sub-Processor fails to fulfill its data protection obligations under such written agreement with Crunchbase, Crunchbase will remain liable to Customer for the performance of the Authorized Sub-Processor’s obligations under such agreement.
The above authorizations will constitute Customer’s prior written consent to the subcontracting by Crunchbase of the Processing of Protected Data if such consent is required under the Standard Contractual Clauses, and the parties agree that the copies of the agreements with Authorized Sub-Processors that must be provided by Crunchbase to Customer pursuant to the Standard Contractual Clauses may have commercial information, or information unrelated to the Standard Contractual Clauses or their equivalent, removed by Crunchbase beforehand, and that such copies will be provided by Crunchbase only upon request by Customer.
Security of Protected Data.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Crunchbase shall maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of Processing Protected Data. Such measures may include the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services as well as separation, access control and permissions, physical security, and security incident management and processes for testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing.
Transfers of Personal Data.
The parties agree that Crunchbase may transfer Protected Data Processed under this Addendum outside the EEA, the UK, or Switzerland in order to perform its obligations and exercise its rights under this Addendum and the Terms. Customer acknowledges that Crunchbase’s primary Processing operations take place in the United States, and that the transfer of Protected Data to the United States is necessary for the provision of the Services to Customer. If Crunchbase transfers Protected Data to a jurisdiction for which the European Commission has not issued an adequacy decision, Crunchbase will ensure that appropriate safeguards have been implemented for the transfer of Protected Data in accordance with Applicable Privacy Laws.
Ex-EEA Transfers.
The parties agree that ex-EEA Transfers are made pursuant to the EU SCCs, which are deemed entered into (and incorporated into this Addendum by this reference) and completed as follows:
Module Two (Controller to Processor) of the EU SCCs apply when Customer is a Controller and Crunchbase is Processing Protected Data for Customer as a Processor pursuant to Article II of this Addendum.
Module Three (Processor to Sub-Processor) of the EU SCCs apply when Customer is a Processor and Crunchbase is processing Protected Data on behalf of Customer as a sub-Processor.
For each module, where applicable the following applies:
In Clause 7, the optional docking clause does not apply;
In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-Processor changes shall be as set forth in Article II of this Addendum;
In Clause 11, the optional language does not apply;
In Clause 13, all square brackets are hereby removed, and the competent supervisory authority shall be the Irish Data Protection Commission;
In Clause 17 (Option 1), the EU SCCs will be governed by Irish law; and
In Clause 18(b), disputes will be resolved before the courts of Ireland.
The parties acknowledge and agree that if any of the EU SCCs are replaced or superseded by new standard contractual clauses (“New EU SCCs”), the Data Importer may give notice to the Data Exporter and, with effect from the date set forth in such notice, the application of the EU SCCs set forth in this Addendum shall be amended so that the EU SCCs cease to apply to ex-EEA Transfers, and the New EU SCCs specified in such notice shall apply going forward. To the extent that the use of the New EU SCCs require the parties to complete additional information, the parties shall reasonably and promptly work together to complete such additional information.
Ex-UK Transfers.
The parties agree that ex-UK Transfers are made pursuant to the UK SCCs, which are deemed entered into and incorporated into this Addendum by reference, and completed as set forth in Exhibit C. The parties shall reasonably and promptly work together to complete additional information required to be included in the UK SCCs as required by applicable law.
Ex-Switzerland Transfers.
The parties agree that ex-Switzerland Transfers are made pursuant to the EU SCCs, which are deemed entered into and incorporated into this Addendum by reference, and completed as follows:
The terms “General Data Protection Regulation” or “Regulation (EU) 2016/679” as utilized in the EU SCCs shall be interpreted to include the FADP with respect to data transfers subject to the FADP.
Clause 13 of the EU SCCs is modified to provide that the Federal Data Protection and Information Commissioner (“FDPIC”) of Switzerland shall have authority over data transfers governed by the FADP and the appropriate EU supervisory authority shall have authority over data transfers governed by the GDPR. Subject to the foregoing, all other requirements of Section 13 shall be observed; and
The term “EU Member State” as utilized in the EU SCCs shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs.
Module Two (Controller to Processor) of the EU SCCs apply when Customer is a controller and Crunchbase is Processing Protected Data for Customer as a Processor pursuant to Article II of this Addendum.
Module Three (Processor to Sub-Processor) of the EU SCCs apply when Customer is a Processor and Crunchbase is processing Protected Data on behalf of Customer as a sub-Processor.
For each module, where applicable the following applies:
In Clause 7, the optional docking clause does not apply;
In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-Processor changes shall be as set forth in Article II of this Addendum;
In Clause 11, the optional language does not apply;
In Clause 13 all square brackets are hereby removed;
In Clause 17 (Option 1), the EU SCCs will be governed by Swiss law for ex-Switzerland Transfers, and governed by Irish law for ex-EEA Transfers; and
In Clause 18(b), disputes will be resolved before the courts of Switzerland for ex-Switzerland Transfers, and resolved by the courts of Ireland for ex-EEA Transfers.
Supplementary Measures.
In respect of any ex-EEA Transfer, ex-UK Transfer or Ex-Switzerland Transfer, the following supplementary measures shall apply:
If, after the date of this Addendum, the Data Importer receives any government agency requests (“Government Agency Requests”) relating to Protected Data, Crunchbase shall attempt to redirect the law enforcement or government agency to request that data directly from Customer. As part of this effort, Crunchbase may provide Customer’s basic contact information to the government agency. If compelled to disclose Protected Data to a law enforcement or government agency, Crunchbase shall give Customer reasonable notice of the demand and reasonably cooperate to allow Customer to seek a protective order or other appropriate remedy unless Crunchbase is legally prohibited from doing so. Crunchbase shall not voluntarily disclose Protected Data to any law enforcement or government agency. In the event of such Governmental Agency Requests, Data Exporter and Data Importer shall (as soon as reasonably practicable) discuss and determine whether all or any transfers of Protected Data pursuant to this Addendum should be suspended;
Data Importer warrants that (i) it has not purposefully created back doors or similar programing that could be used to access Protected Data; (ii) it has not purposefully created or changed its business processes in a manner that facilitates unauthorized access to Protected Data; (iii) no law or government policy to which Data Importer is subject requires the Data Importer to create or maintain back doors to use or access Protected Data; and (iv) it will notify Data Exporter if, at any time, it is unable to continue complying with this commitment;
Data Exporter shall use strong encryption before transmitting any Protected Data to Data Importer. Such encryption will be based on an algorithm and parameters (including without limitation its key length) that conform with industry best practices and that are considered robust against cryptanalysis that may be performed by law enforcement or other public authorities. The keys for such encryption will be reliably managed by both Data Exporter and Data Importer; and
The Data Exporter and Data Importer will meet regularly, upon their mutual agreement, to consider whether:
The protection afforded by the laws of the country of the Data Importer to data subjects whose Personal Data is being transferred is sufficient to provide broadly equivalent protection to that afforded in the EEA, the UK or Switzerland, whichever the case may be;
New data transfer mechanisms apply to the transfer of Personal Data from the EEA, UK or Switzerland as it relates to the relationship between Data Exporter and Data Importer;
Additional measures are reasonably necessary to enable the transfer to be compliant with the Applicable Privacy Laws; and
It is still appropriate for Protected Data to be transferred to the relevant Data Importer, taking into account all relevant information available to the parties, together with guidance provided by the Supervisory Authorities.
If Applicable Privacy Laws require the Data Exporter to execute the Standard Contractual Clauses applicable to a particular transfer of Protected Data to a Data Importer as a separate agreement, the Data Importer shall, on request of the Data Exporter, promptly execute such Standard Contractual Clauses incorporating such amendments as may reasonably be required by the Data Exporter to reflect the applicable appendices and annexes, the details of the transfer and the requirements of the relevant Applicable Privacy Laws.
If either (i) any of the means of legitimizing transfers of Protected Data outside of the EEA, the UK, or Switzerland set forth in this Addendum cease to be valid or (ii) any Supervisory Authority requires transfers of Protected Data pursuant to those means to be suspended, then Data Importer may by notice to the Data Exporter, with effect from the date set out in such notice, amend or put in place alternative arrangements in respect of such transfers, as required by Applicable Privacy Laws.
Rights of Data Subjects.
Crunchbase shall, to the extent permitted by law, notify Customer upon receipt of a request by a Data Subject to exercise the Data Subject’s right of: access, rectification, erasure, data portability, restriction or cessation of Processing, withdrawal of consent to Processing, and/or objection to being subject to Processing that constitutes automated decision-making, in each case, with respect to Protected Data (such requests individually and collectively “Data Subject Request(s)”). If Crunchbase receives a Data Subject Request in relation to Protected Data, Crunchbase will advise the Data Subject to submit their request to Customer and Customer will be responsible for responding to such request, including, where necessary, by using the functionality of the Services. Customer is solely responsible for ensuring that Data Subject Requests for erasure, restriction or cessation of Processing, rectification, or withdrawal of consent to Processing of any Protected Data are communicated to Crunchbase, and, if applicable, for ensuring that a record of consent to Processing is maintained with respect to each Data Subject.
Crunchbase shall, at the request of Customer, and taking into account the nature of the Processing applicable to any Data Subject Request, apply appropriate technical and organizational measures to assist Customer in complying with Customer’s obligation to respond to such Data Subject Request and/or in demonstrating such compliance, where possible, provided that (i) Customer is itself unable to respond without Crunchbase’s assistance and (ii) Crunchbase is able to do so in accordance with all applicable laws, rules, and regulations. Customer shall be responsible to the extent legally permitted for any costs and expenses arising from any such assistance by Crunchbase.
Actions and Access Requests.
Crunchbase shall, taking into account the nature of the Processing and the information available to Crunchbase, provide Customer with reasonable cooperation and assistance where necessary for Customer to comply with its obligations under the GDPR to conduct a data protection impact assessment relating to Crunchbase’s Processing of Protected Data and/or to demonstrate such compliance, provided that Customer does not otherwise have access to the relevant information. Customer shall be responsible to the extent legally permitted for any costs and expenses arising from any such assistance by Crunchbase.
Crunchbase shall, taking into account the nature of the Processing and the information available to Crunchbase, provide Customer with reasonable cooperation and assistance with respect to Customer’s cooperation and/or prior consultation with any Supervisory Authority, where necessary and where required by the GDPR in relation to Crunchbase’s Processing of Protected Data. Customer shall be responsible to the extent legally permitted for any costs and expenses arising from any such assistance by Crunchbase.
Crunchbase shall maintain records sufficient to demonstrate its compliance with its obligations under this Addendum, and retain such records for a period of three (3) years after the termination of the Terms. Customer shall, with reasonable notice to Crunchbase, have the right to review, audit and copy such records at Crunchbase’s offices during regular business hours.
Upon Customer’s request, Crunchbase shall, no more than once per calendar year, either (i) make available for Customer’s review copies of certifications or reports demonstrating Crunchbase’s compliance with prevailing data security standards applicable to the Processing of Protected Data, or (ii) if the provision of reports or certifications pursuant to (i) is not reasonably sufficient under Applicable Privacy Laws, allow Customer or its authorized representative, upon reasonable notice and at a mutually agreeable date and time, to conduct an audit or inspection of Crunchbase’s data security infrastructure and procedures that is sufficient to demonstrate Crunchbase’s compliance with its obligations under this Addendum, provided that Customer shall provide reasonable prior notice of any such request for an audit and such inspection shall not be unreasonably disruptive to Crunchbase’s business. Customer shall be responsible for the costs of any such audits or inspections, including without limitation a reimbursement to Crunchbase for any time expended for on-site audits. If Customer and Crunchbase have entered into the Standard Contractual Clauses, the parties agree that the audits described in the Standard Contractual Clauses shall be carried out in accordance with this Section.
In the event of a Personal Data Breach of Protected Data, Crunchbase shall (a) without undue delay, inform Customer of the Personal Data Breach and take reasonable steps to remediate such violation (to the extent that remediation is within Crunchbase’s reasonable control); and (b) taking into account the nature of the Processing and the information available to Crunchbase, provide Customer with reasonable cooperation and assistance necessary for Customer to comply with its obligations under Applicable Privacy Laws, including with respect to any notification obligations, as required.
ARTICLE III – PROCESSING OF INCLUDED DATA
For purposes of Applicable Privacy Laws, the parties acknowledge that they are each a separate and independent Controller of any Included Data. The parties do not and will not Process Included Data as joint Controllers. Each party shall comply with the obligations that apply to it as a Controller under Applicable Privacy Laws, and each party shall be individually and separately responsible for its own compliance.
Customer shall Process Included Data only for the purposes set forth in the Terms or as otherwise agreed in writing by the parties, provided such Processing strictly complies with all Applicable Privacy Laws and Customer’s obligations under this Addendum. To the extent legally required, Customer shall maintain a publicly-accessible privacy policy on any applicable mobile applications and/or websites that satisfies all transparency and notice requirements set forth in any Applicable Privacy Laws with respect to Customer’s Processing of Included Data. Notwithstanding anything to the contrary in the Terms, Customer shall immediately delete or destroy all Included Data in its possession upon the conclusion of Customer’s purpose for Processing such Included Data.
In the event that Customer receives a request from a Data Subject relating to the Processing of Personal Data by Crunchbase, Customer will (i) promptly notify Crunchbase of such request, (ii) direct the Data Subject to Crunchbase in order to enable Crunchbase to respond directly to the request, and (iii) reasonably cooperate with Crunchbase in responding to such request. Without limiting the foregoing, Customer agrees that it will promptly notify Crunchbase of any request pursuant to Article 16 (Right to rectification), Article 17 (Right to erasure), or Article 18 (Right to restriction of processing) of the GDPR that relates in any way to the Content.
Customer acknowledges that, from time to time, Included Data may be updated, modified, augmented, or removed from the Content. Customer shall regularly check such Content and ensure that it is using the most up-to-date version of the Included Data. Without limiting the foregoing, Customer agrees to promptly delete and, if applicable, cease all sales of, any Included Data for which Crunchbase notifies Customer (including by updating the Content) that Crunchbase has received a deletion, opt-out, or similar request, and will indemnify Crunchbase for any claims relating to Customer’s breach of the foregoing.
Each party shall implement appropriate technical and organisational measures to protect the Included Data.
In the event that Customer suffers any actual or suspected Personal Data Breach with respect to the Included Data, Customer shall notify Crunchbase without undue delay and the parties shall reasonably cooperate with each other in taking such measures as may be necessary to notify Supervisory Authorities and/or affected individuals (as applicable), comply with each party’s obligations under Applicable Privacy Laws, and mitigate or remedy the effects of such Personal Data Breach.
If and to the extent Customer transfers any Included Data to any third party, Customer shall first enter into contractual arrangements with such third party obligating such third party to Process the Included Data in accordance with the requirements of Applicable Privacy Laws. Customer shall comply with Applicable Privacy Laws in connection with its transfer (including any sale) of Included Data to third parties.
EXHIBIT A
Details of Processing
Nature and Purpose of Processing: See Terms
Duration of Processing: Duration of Customer’s use of the Services
Categories of Data Subjects may include: Customer employees and representatives of Customer’s clients
Type of Personal Data may include: name, surname, email address, phone number, job title, employer
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Continuous
Technical and organizational measures to ensure the security of the data: Please see section titled Security of Protected Data
EXHIBIT B
Authorized Sub-Processors
Customer acknowledges and agrees that the following types of entities shall be deemed Authorized Sub-Processors that may Process Personal Data pursuant to this Addendum:
Fundamental infrastructure (including AWS, Snowflake, Google Tag Manager, Sendgrid, Split, Zuora, Hightouch)
Web analytics (including Google Analytics, Heap, FullStory)
Communication (including Marketo, Iterable, Slack, Zoom, Pendo, Gong, Outreach)
Support (including Drift, Zendesk, Aha, Airtable, Google Suites, JIRA, Notion, DataGrail)
Retargeting/Advertising (including Facebook Ads, Comscore, Google Ads)
Product Analytics (including Delighted, Periscope, Pendo)
Account Management (including Salesforce)
EXHIBIT C
UK SCC Addendum
PART 1: Tables
Table 1: Parties and Signatures
| Start Date | The effective date of the Addendum to which this Exhibit is attached. | The effective date of the Addendum to which this Exhibit is attached. |
| Parties | Data Exporter | Data Importer |
| Parties’ Details | Customer and its affiliates, as applicable | Crunchbase, Inc. 564 Market Street, Suite 500, San Francisco, CA 94104 |
| Key Contact | privacy@crunchbase.com | |
| Signatures | By transferring personal data from the UK (as applicable) to the Data Importer, the Data Exporter will be deemed to have signed this Exhibit C. | By processing personal data from the UK received from the Data Exporter, the Data Importer will be deemed to have signed this Exhibit C. |
Table 2: Selected SCCs, Modules, and Selected Clauses
| Addendum EU SCCs | the Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum: |
| Module | Module in operation | Clause 7 (Docking Clause) | Clause 11 (option) | Clause 9a (Prior authorisation or general authorisation) | Clause 9a (time period) | Is personal data received from the importer combined with the personal data collected by the exporter? |
| 1 | ||||||
| 2 | X | N/A | N/A | General authorisation | 10 days | N/A |
| 3 | X | N/A | N/A | General authorisation | 10 days | N/A |
| 4 |
Table 3: Appendix Information
Annex 1A: List of Parties: Please see Table 1.
Annex 1B: Description of Transfer: Please see Exhibit A. Annex II: Technical and organizational measures including technical and organizational measures to ensure the security of the data: Please see section titled Security of Protected Data
Annex III: List of Sub Processors: Please see Exhibit B.
Table 4: Ending this Addendum when the Approved Addendum Changes:
Which parties may end this Addendum as set out in Section 19: Importer
PART 2: Extra Protection Clauses
Please see section titled Supplementary Measures
PART 3: Commercial Clauses
None