Trust Center

The Data Processing Agreement (“DPA”) between Gloo, LLC (“Service Provider”) and you (“Organization”) form part of any agreement which incorporates them as to any offerings by Gloo (the “Offerings”).  This DPA does not extend to the Processing of Personal Information, including the Processing of Personal Information, that is outside of the scope of the Offerings.

1. Definitions.

   For purposes of this DPA, the following terms shall have the meanings set forth below:

   1. “Organization Personal Information” means only the Personal Information described in Section 2.1 which is Processed by Service Provider, or by a Subprocessor, on behalf of Organization as part of the Offerings. 

   2. “Data Protection Laws” means any local or national laws, rules, and regulations related to privacy, security, data protection, and/or the Processing of Personal Information, as amended, replaced, or superseded from time to time.

   3. “Data Subject” means the identified or identifiable person to whom Personal Information relates.

   4. “Consumer” means an individual who is acting only in an individual or household context; and does not include an individual acting in a commercial or employment context, as a job applicant, or as a beneficiary of someone acting in an employment context.

   5. “Deidentified Information” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular Data Subject or Consumer

   6. “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household.

   7. “Personal Information Breach” means the accidental, unauthorized, or unlawful disclosure of, or access to, Organization Personal Information by Service Provider or any Subprocessor.

   8. “Process” means any operation or set of operations that is performed upon Personal Information, whether or not by automatic means, such as access, collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, return or destruction.

   9. “Subprocessor” means any third party engaged by the Service Provider to Process Organization Personal Information.
      
      

2. Processing of Organization Personal Information
   
   

   1. This DPA covers the following:

      1. The subject-matter of the Processing of Organization Personal Information is the performance of the Offerings pursuant to the Agreement.

      2. Organization Personal Information will be Processed as necessary to perform the Offerings pursuant to the Agreement and will be subject to the processing activities described in any Order Form that makes reference to, is incorporated under, or is subject to the Agreement.

      3. The types of Organization Personal Information shall be as is contemplated or related to the Processing described in any Order Form that makes reference to, is incorporated under, or is subject to the Agreement.

   2. Service Provider represents, warrants, agrees, and certifies that in the context of its processing of the Organization Personal information: 

      1. it understands, and will comply with, the obligations and restrictions imposed on it by applicable Data Protection Laws in its role as a service provider and/or processor;

      2. it shall notify Organization immediately if Service Provider determines that it can no longer meet its obligations under applicable Data Protection Laws or this DPA;

      3. it shall Process Organization Personal Information only to the extent, and in such a manner, as is necessary for the purposes of fulfilling its responsibilities under the Agreement and the Organization’s instructions, and for the purposes described in Section 2.1;

      4. it shall take reasonable steps to ensure that access to Organization Personal Information is limited to those employees, agents, and Subprocessors who have a need to know or otherwise access Organization Personal Information to enable Service Provider to perform its obligations or responsibilities under this DPA and the Agreement, and who are bound in writing to protect the confidentiality of the Organization Personal Information (the restrictions set forth in this section shall not restrict Service Provider’s ability to Process Organization Personal Information where required to do so by applicable laws to which Service Provider is subject; provided, however, Service Provider shall promptly notify Organization of such legal requirement before Processing, unless such law prohibits such notification);

      5. to the extent that it deidentifies Organization Personal Information it will (i) take reasonable measures to ensure that the information cannot be associated with an individual, (ii) publicly commit to maintain and use the information in de-identified form and not to attempt to re-identify it, (iii) implement technical safeguards that prohibit reidentification, (iv) implement business processes that specifically prohibit reidentification, (v) implement business processes that prevent inadvertent release of de-identified information, (vi) make no attempt to re-identify the information, and (vii) contractually obligate any recipients of the de-identified information to comply with all provisions in this paragraph.

      6. Notwithstanding any other provision in this Section, Service Provider may use Organization Personal Information to operate, support, and improve the quality of the Offerings it provides to Organization, including product analytics, quality assurance, and de-identified or aggregated benchmarking. Service Provider shall not use Organization Personal Information to train or fine-tune any artificial intelligence or machine learning model, whether developed by Service Provider or by a Subprocessor, without Organization's prior separate written consent.

   3. Service Provider represents, warrants, agrees, and certifies that it shall not:

      1. retain, use, or disclose Organization Personal Information for any purpose other than for the limited and specified purpose of performing its responsibilities under the Agreement;

      2. share, sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means Organization Personal Information to another person or entity for: (a) monetary or other valuable consideration; or (b) cross-context behavioral advertising for the benefit of a business in which no money is exchanged; or

      3. combine Organization Personal Information with Personal Information Service Provider receives from or on behalf of another person or entity or collects from its own interactions with a Data Subject except to perform a business purpose as defined in regulations adopted pursuant applicable Data Protection Laws.

   4. Organization represents, warrants, and agrees that it has obtained all consents, provided all notices, and has a valid legal basis under applicable Data Protection Laws for all Organization Personal Information it submits or makes available to Service Provider in connection with the Offerings.

   5. If Organization Personal Information originating from the European Economic Area, the United Kingdom, or Switzerland is transferred to Service Provider or a Subprocessor outside of that originating jurisdiction, the parties shall execute the European Commission’s Standard Contractual Clauses and/or the UK International Data Transfer Addendum, as applicable, upon Organization’s request, and such clauses shall apply to and supplement this DPA with respect to that transfer.
      
      

3. Security
   
   

   1. Service Provider represents and warrants that it shall implement and maintain appropriate technical and organizational safeguards to protect Organization Personal Information that are no less rigorous than accepted industry standards for information security and shall ensure that all such safeguards comply with applicable Data Protection Laws.

   2. In assessing the appropriate level of security, Service Provider shall take into account the risks that are presented by Processing, in particular from accidental, unauthorized, or unlawful destruction, loss, alteration, damage, or disclosure of, or access to, Organization Personal Information transmitted, stored, or otherwise Processed.
      
      
      

4. Personal Information Breach

   In the event of a Personal Information Breach impacting Organization Personal Information, Service Provider shall (a) notify Organization as soon as practicable under the circumstances after Service Provider or any Subprocessor becomes aware of such Personal Information Breach (and in any event within the time period required by Data Protection Laws); (b) provide Organization with sufficient details of the Personal Information Breach to allow Organization to meet any obligations under Data Protection Laws to report or inform Data Subjects or relevant Regulators of the Personal Information Breach; and (c) cooperate, and require any Subprocessor to cooperate, with Organization in the investigation, mitigation, and remediation of any such Personal Information Breach.

   
   

5. Subprocessors

   Service Provider shall enter into a written agreement with each Subprocessor containing the same obligations imposed on Service Provider under this DPA and applicable Data Protection Laws with respect to Organization Personal Information. Service Provider has general written authorization to engage Subprocessors and maintains a current list of Subprocessors, which is available to Organization upon request.

   
   

6. Data Subject Rights
   
   

   1. Where a Data Subject or Consumer contacts Service Provider directly to exercise any right under Data Protection Laws, Service Provider shall direct that person to submit the request to Organization and shall not itself respond to or take action on the request except as instructed by Organization.

   2. Service Provider shall assist Organization in fulfilling Organization’s obligations to respond to such requests, including at minimum, maintaining the ability to access, modify, remove from Processing, or irrevocably delete or destroy the Personal Information of an individual Data Subject when requested by Organization.

   
   

7. Deletion or Return of Organization Personal Information

   Service Provider shall promptly return or destroy (at Organization’s election) all copies of Organization Personal Information in its possession, or in the possession of its Subprocessor (a) any time requested by the Organization, or (b) within sixty (60) calendar days of the effective date of termination. Organization Personal Information contained in encrypted backup or disaster-recovery media may be retained until the next scheduled overwrite or deletion cycle, not to exceed twelve (12) months following termination, provided such copies remain subject to the confidentiality and security obligations of this DPA and are not otherwise Processed. Notwithstanding the requirements in this paragraph, Service Provider may retain Organization Personal Information if required by applicable Data Protection Laws, but only to the extent and for such period as required by such legal requirement. Service Provider shall notify Organization in writing if it believes that such a legal requirement exists. If required by law to retain Organization Personal Information, Service Provider shall continue to ensure the security and confidentiality of such Organization Personal Information and only Process such Organization Personal Information as necessary for the purpose specified in the applicable Data Protection Laws requiring such storage.

   
   

8. Compliance and Audits
   
   

   1. Upon Organization’s request and at Organization’s expense, Service Provider shall provide such assistance as Organization reasonably requires to ensure compliance with Organization’s obligations under applicable Data Protection Laws, including, but not limited to, Organization completion of data protection impact assessments.

   2. In addition to any audit rights Organization may have under any other agreement between Organization and Service Provider, Service Provider shall make available to Organization all information necessary to demonstrate Service Provider’s compliance with this DPA, as well as any applicable Data Protection Laws, and shall allow for and contribute to audits, including inspections, by Organization, or a third-party auditor mandated by Organization, in order to assess Service Provider's compliance. Service Provider may satisfy this obligation by providing a copy of its most recent third-party audit report (such as a SOC 2 Type II report) and completed security questionnaire in lieu of an on-site audit. Any on-site audit shall be conducted no more than once per calendar year, upon at least thirty (30) days' prior written notice, during normal business hours, subject to Service Provider's confidentiality and security requirements, and at Organization's expense unless the audit identifies a material breach of this DPA.

   
   

9. Termination and Remediation

   In the event that Service Provider fails to comply with any of the provisions of this DPA, Organization may, without penalty to Organization, take steps to stop and remediate any unauthorized Processing of Organization Personal Information. Upon expiration or termination of the Agreement for any reason, Service Provider’s obligations under this DPA in relation to the Processing of Personal Information shall continue for as long as Service Provider has access to Organization Personal Information.

   
   

10. General Terms

    This DPA supersedes any prior data processing agreements, addenda, or similar terms between the parties. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA will remain valid and in force. The invalid or unenforceable provision shall be either: (a) amended as necessary to ensure its validity and enforceability, while preserving the intent of the provision as closely as possible or, if this is not possible, (b) construed in a manner as if the invalid or unenforceable part had never been contained therein. In the event of any conflict between the Agreement and this DPA, this DPA will govern. If any variation is required to this DPA as a result of a change in applicable Data Protection Laws, the parties agree to discuss and negotiate in good faith any necessary variation to this DPA. Notwithstanding anything in this DPA to the contrary, each party's liability arising out of or relating to this DPA, including all Processing of Organization Personal Information under it, shall be subject to the limitations and exclusions of liability set forth in the Agreement, and this DPA does not expand either party's liability beyond what is provided in the Agreement.