Contracts
- Terms of Service
- Data Protection Addendum
- ↳ Standard Contractual Clauses Module 2: Controller to Processor
- ↳ Standard Contractual Clauses Module 3: Processor to Processor
- ↳ Palantir Affiliates
- Business Associate Agreement
- Palantir AIP Addendum
- Use Case Restrictions
- Terms of Service (Self Service)
- Data Protection Addendum (Enterprise Self Service)
- Data Protection Addendum - Consumer
- Use Case Restrictions (Legacy Self-Service)
- Affirmation of Separate Agreement
- Terms of Service (Apollo)
- Terms of Service (AIP Now)
- Data Protection Addendum (AIP Now)
- Terms of Service (AIP Self-Service)
- Palantir Third Party Model Activation Addendum - Anthropic Claude via AWS
- Palantir Third Party Model Activation Addendum - Microsoft Azure OpenAI
- Palantir Third Party Model Activation Addendum - Google Cloud Platform
- Palantir Third Party Model Activation Addendum - OpenAI
- Palantir Third Party Model Activation Addendum - Llama2
- Palantir Third Party Model Activation Addendum - Llama3
- Palantir Third Party Model Activation Addendum - Llama 3.1, 3.2, and 3.3
- Palantir DevCon Fellowship Contest Official Rules
- External Feedback License
- Palantir Fellowship Submission Agreement
- Palantir Third Party Model Activation Addendum - X.AI
Terms of Service
Effective November 14th 2024
DownloadTable of Contents
1. Certain Definitions.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
SINGAPORE
SWITZERLAND
Effective May 29th 2024 to November 14th 2024
DownloadTable of Contents
1. Certain Definitions.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
SINGAPORE
SWITZERLAND
Effective January 10th 2024 to May 29th 2024
DownloadTable of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective December 7th 2023 to January 10th 2024
DownloadTable of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective December 6th 2023 to December 7th 2023
DownloadTable of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective November 29th 2023 to December 6th 2023
DownloadSummary of changes
Table of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective November 22nd 2023 to November 29th 2023
DownloadTable of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective September 1st 2023 to November 22nd 2023
DownloadTable of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective August 16th 2023 to September 1st 2023
DownloadTable of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective July 11th 2023 to August 16th 2023
DownloadTable of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
- Palantir Warranty and Disclaimer. The following Section 10.3 shall be added to the Terms of Service immediately following Section 10.2 therein:
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective June 9th 2023 to July 11th 2023
DownloadTable of Contents
1. Certain Definitions.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
- Palantir Warranty and Disclaimer. The following Section 10.3 shall be added to the Terms of Service immediately following Section 10.2 therein:
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Effective June 8th 2023 to June 9th 2023
DownloadTable of Contents
1. Certain Definitions.
3. Customer Use of Service.
4. Acceptable Use.
5. Proprietary Rights.
COUNTRY-SPECIFIC ADDENDUM
AUSTRALIA
- Palantir Warranty and Disclaimer. The following Section 10.3 shall be added to the Terms of Service immediately following Section 10.2 therein:
CANADA
FRANCE
GERMANY
ITALY AND SPAIN
2. Burdensome Terms. A new Section 16 shall be added to the Terms of Services and contain the following:
SINGAPORE
SWITZERLAND
Data Protection Addendum
Effective January 14th 2025
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and AI services (Microsoft Azure). | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services. | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
X.AI LLC | AI services. | 1450 Page Mill Rd. Palo Alto, CA 94034, United States | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
Oracle America, Inc. | Cloud hosting and infrastructure. | 500 Oracle Parkway, Redwood Shores, CA 94065 | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the AI services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
24 May 2023 | Globalization of our DPA. Amendment of our data transfers provisions to reflect latest regulatory updates. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
18 August 2023 | Addition of AI services to the types of purposes for using Google and AWS AI. Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
15 May 2024 | Addition of Oracle America, Inc. as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
14 January 2025 | Addition of X.AI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional Subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Oracle America, Inc. | Cloud hosting and infrastructure. | 500 Oracle Parkway, Redwood Shores, CA 94065 | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Effective May 22nd 2024 to January 14th 2025
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and AI services (Microsoft Azure). | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services. | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
Oracle America, Inc. | Cloud hosting and infrastructure. | 500 Oracle Parkway, Redwood Shores, CA 94065 | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the AI services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
24 May 2023 | Globalization of our DPA. Amendment of our data transfers provisions to reflect latest regulatory updates. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
18 August 2023 | Addition of AI services to the types of purposes for using Google and AWS AI. Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
15 May 2024 | Addition of Oracle America, Inc. as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Oracle America, Inc. | Cloud hosting and infrastructure. | 500 Oracle Parkway, Redwood Shores, CA 94065 | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Effective May 21st 2024 to May 22nd 2024
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and AI services (Microsoft Azure). | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services. | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
Oracle America, Inc. | Cloud hosting and infrastructure. | 500 Oracle Parkway, Redwood Shores, CA 94065 | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the AI services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
24 May 2023 | Globalization of our DPA. Amendment of our data transfers provisions to reflect latest regulatory updates. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
18 August 2023 | Addition of AI services to the types of purposes for using Google and AWS AI. Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
15 May 2024 | Addition of Oracle America, Inc. as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Oracle America, Inc. | Cloud hosting and infrastructure. | 500 Oracle Parkway, Redwood Shores, CA 94065 | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Effective December 15th 2023 to May 21st 2024
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and AI services (Microsoft Azure). | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the AI services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
24 May 2023 | Globalization of our DPA. Amendment of our data transfers provisions to reflect latest regulatory updates. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
18 August 2023 | Addition of AI services to the types of purposes for using Google and AWS AI. Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Effective November 20th 2023 to December 15th 2023
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and AI services (Microsoft Azure). | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the AI services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
24 May 2023 | Globalization of our DPA. Amendment of our data transfers provisions to reflect latest regulatory updates. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
18 August 2023 | Addition of AI services to the types of purposes for using Google and AWS AI. Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Effective October 30th 2023 to November 20th 2023
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and AI services (Microsoft Azure). | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | United States | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the AI services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
24 May 2023 | Globalization of our DPA. Amendment of our data transfers provisions to reflect latest regulatory updates. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
18 August 2023 | Addition of AI services to the types of purposes for using Google and AWS AI. Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Effective August 18th 2023 to October 30th 2023
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and AI services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the AI services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
24 May 2023 | Globalization of our DPA. Amendment of our data transfers provisions to reflect latest regulatory updates. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
18 August 2023 | Addition of AI services to the types of purposes for using Google and AWS AI. Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Effective May 30th 2023 to August 18th 2023
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and cognitive services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the cognitive service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the cognitive services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
24 May 2023 | Globalization of our DPA. Amendment of our data transfers provisions to reflect latest regulatory updates. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Effective May 2nd 2023 to May 29th 2023
DownloadTable of Contents
PALANTIR DATA PROTECTION ADDENDUM (“DPA”)
- “Adequate Country” means a country or territory outside of the EEA that the European Commission has deemed to provide an adequate level of protection for Personal Data pursuant to a decision made in accordance with Article 45(1) of the EU GDPR, or country or territory having equivalent status under the UK GDPR (as applicable);
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Protection Laws” means all laws and regulations regarding data protection and privacy to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Incident” means any breach of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir.
- “DPA Effective Date” means the Effective Date of the Agreement.
- “EEA” means the European Economic Area.
- “European Data Protection Law” means, as applicable, the GDPR and/or the FDP.
- “GDPR” means, as applicable, the EU GDPR and/or the UK GDPR.
- “International Transfer Solution” means appropriate safeguards established by Palantir in relation to the transfer of Personal Data from the EEA or the UK to a country or territory outside of the EEA or the UK (respectively) that is not an Adequate Country (a “Third Country”) in accordance with Article 46 of the GDPR.
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time.
- “Sell” has the meaning set forth in the CCPA, Cal. Civ. Code § 1798.100 et seq.
- “Subprocessor” means a third party, Third Party Service, or Palantir's Affiliate engaged by or on behalf of Palantir to Process Customer Personal Data in connection with the Agreement.
- “Supervisory Authority” means, as applicable: (a) a “supervisory authority” as defined in the EU GDPR; and/or (b) the “Commissioner” as defined in the UK GDPR.
- “Standard Contractual Clauses” means the standard data protection clauses for the transfer of Personal Data from Controllers (or Processors, as applicable) established inside the EEA or the UK to Processors established in Third Countries, as adopted by the European Commission from time to time (in the case of transfers from the EEA), as adopted by the Swiss Federal Data Protection and Information Commissioner from time to time (in the case of transfers from Switzerland) or approved by the Information Commissioner’s Office from time to time (in the case of transfers from the UK).
- “UK” means the United Kingdom.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure and cognitive services (Microsoft Azure) and | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the cognitive service is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
2 May 2023 | Addition of the cognitive services to the types of purposes of using Azure. Addition of East US, South Central US, West Europe and other Azure regions as the location of the cognitive processing service. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Effective March 24th 2022 to May 1st 2023
DownloadTable of Contents
PALANTIR DATA PROTECTION ADDENDUM (“DPA”)
- “Adequate Country” means a country or territory outside of the EEA that the European Commission has deemed to provide an adequate level of protection for Personal Data pursuant to a decision made in accordance with Article 45(1) of the EU GDPR, or country or territory having equivalent status under the UK GDPR (as applicable);
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Protection Laws” means all laws and regulations regarding data protection and privacy to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Incident” means any breach of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir.
- “DPA Effective Date” means the Effective Date of the Agreement.
- “EEA” means the European Economic Area.
- “European Data Protection Law” means, as applicable, the GDPR and/or the FDP.
- “GDPR” means, as applicable, the EU GDPR and/or the UK GDPR.
- “International Transfer Solution” means appropriate safeguards established by Palantir in relation to the transfer of Personal Data from the EEA or the UK to a country or territory outside of the EEA or the UK (respectively) that is not an Adequate Country (a “Third Country”) in accordance with Article 46 of the GDPR.
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time.
- “Sell” has the meaning set forth in the CCPA, Cal. Civ. Code § 1798.100 et seq.
- “Subprocessor” means a third party, Third Party Service, or Palantir's Affiliate engaged by or on behalf of Palantir to Process Customer Personal Data in connection with the Agreement.
- “Supervisory Authority” means, as applicable: (a) a “supervisory authority” as defined in the EU GDPR; and/or (b) the “Commissioner” as defined in the UK GDPR.
- “Standard Contractual Clauses” means the standard data protection clauses for the transfer of Personal Data from Controllers (or Processors, as applicable) established inside the EEA or the UK to Processors established in Third Countries, as adopted by the European Commission from time to time (in the case of transfers from the EEA), as adopted by the Swiss Federal Data Protection and Information Commissioner from time to time (in the case of transfers from Switzerland) or approved by the Information Commissioner’s Office from time to time (in the case of transfers from the UK).
- “UK” means the United Kingdom.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure (Microsoft Azure) and | One Microsoft Way Redmond, WA 98052, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Exhibit A Updates | |
March 2022 | Addition of Microsoft Corporation and Google LLC as Third-Party Subprocessors. Authorization for subprocessing by these additional subprocessors is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Effective August 26th 2021 to March 23rd 2022
DownloadTable of Contents
- “Adequate Country” means a country or territory outside of the EEA that the European Commission has deemed to provide an adequate level of protection for Personal Data pursuant to a decision made in accordance with Article 45(1) of the EU GDPR, or country or territory having equivalent status under the UK GDPR (as applicable);
- “Affiliates” means any other entity that directly or indirectly controls, is controlled by, or is under common control with a Party;
- “Customer Personal Data” means any Personal Data contained within Content subject to Data Protection Laws that Customer, including Authorized Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Protection Laws” means all laws and regulations regarding data protection and privacy to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Incident” means any breach of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir.
- “DPA Effective Date” means the Effective Date of the Agreement.
- “EEA” means the European Economic Area.
- “European Data Protection Law” means, as applicable, the GDPR and/or the FDP.
- “GDPR” means, as applicable, the EU GDPR and/or the UK GDPR.
- “International Transfer Solution” means appropriate safeguards established by Palantir in relation to the transfer of Personal Data from the EEA or the UK to a country or territory outside of the EEA or the UK (respectively) that is not an Adequate Country (a “Third Country”) in accordance with Article 46 of the GDPR.
- “Security Documentation” means the Documentation describing the security standards that apply to the Products and Services (as applicable) as provided by or on behalf of Palantir from time to time.
- “Sell” has the meaning set forth in the CCPA, Cal. Civ. Code § 1798.100 et seq.
- “Subprocessor” means a third party engaged by or on behalf of Palantir to Process Customer Personal Data in connection with the Agreement.
- “Supervisory Authority” means, as applicable: (a) a “supervisory authority” as defined in the EU GDPR; and/or (b) the “Commissioner” as defined in the UK GDPR.
- “Standard Contractual Clauses” means the standard data protection clauses for the transfer of Personal Data from Controllers (or Processors, as applicable) established inside the EEA or the UK to Processors established in Third Countries, as adopted by the European Commission from time to time and incorporated by reference (in the case of transfers from the EEA) or approved by the Information Commissioner’s Office from time to time and incorporated by reference (in the case of transfers from the UK), in each case with the inclusions specified in Exhibit C made in the specified locations in the clauses approved by European Commission implementing decision 2021/914 (or where alternative clauses are the Standard Contractual Clauses, inclusions in the locations that are most closely equivalent to those listed below, and such other inclusions as are necessary to give effect to the alternative clauses in such manner as is most closely equivalent to the clauses in implementing decision 2021/914).
- “UK” means the United Kingdom.
Name | Registered Address | Description of processing |
Amazon Web Services, Inc. (AWS) | 410 Terry Avenue North, Seattle, WA 98109 | AWS provides the cloud infrastructure for Palantir products. Additional details are provided in the Documentation. |
Proofpoint, Inc. | 892 Ross Drive, Sunnyvale, CA 94089, USA | Proofpoint supports the alerting and encrypted notification service in Palantir products. Additional details are provided in the Documentation. |
↳ Standard Contractual Clauses Module 2: Controller to Processor
Effective May 30th 2023
DownloadTable of Contents
ANNEX 1 to EXHIBIT D
Effective March 24th 2022 to May 29th 2023
DownloadTable of Contents
ANNEX 1 to EXHIBIT C
↳ Standard Contractual Clauses Module 3: Processor to Processor
Effective May 30th 2023
DownloadTable of Contents
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
Effective March 24th 2022 to May 29th 2023
DownloadTable of Contents
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
↳ Palantir Affiliates
Effective January 5th 2024
DownloadTable of Contents
Palantir Affiliates
Effective December 8th 2023 to January 5th 2024
DownloadTable of Contents
Palantir Affiliates
Effective November 30th 2023 to December 8th 2023
DownloadTable of Contents
Palantir Affiliates
Effective November 20th 2023 to November 30th 2023
DownloadTable of Contents
Palantir Affiliates
Effective August 26th 2021 to November 20th 2023
DownloadTable of Contents
Palantir Affiliates
- March 2022: Added Palantir Technologies Lithuania, UAB
- January 2022: Updated name of Palantir Technologies Sweden AB
Business Associate Agreement
Effective October 25th 2024
DownloadTable of Contents
PALANTIR BUSINESS ASSOCIATE AGREEMENT (“BAA”)
The customer agreeing to the terms of this BAA (“Customer”) and Palantir Technologies Inc., a Delaware corporation with its principal place of business located at 1200 17th Street, Floor 15, Denver, CO 80202 (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing Customer’s use of Palantir Technology, including the Service, and the provision of related Professional Services to Customer by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This BAA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and Customer with respect to Palantir’s use, disclosure, reception, access, creation, maintenance, and/or transmission of Protected Health Information on behalf of Customer in connection with Palantir’s performance under the Agreement. Any capitalized terms used but not defined in this BAA shall have the meaning provided in the Agreement.
WHEREAS, Customer is a Covered Entity or Business Associate as those terms are defined in the federal regulations at 45 C.F.R. Parts 160 and 164, Subparts A and E (the “Privacy Rule”);
WHEREAS, pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), the U.S. Department of Health and Human Services (“HHS”) promulgated the Privacy Rule, the security standards at 45 C.F.R. Parts 160 and 164, Subparts A and C (the “Security Rule”) and the breach notification standards at 45 C.F.R. Part 164, Subpart D (the “Breach Notification Rule”) requiring certain individuals and entities subject to these standards to protect the privacy and security of certain individually identifiable health information, including electronic individually identifiable health information;
WHEREAS, the Parties are committed to complying with applicable provisions of the Privacy Rule, Security Rule, and Breach Notification Rule, as they may be revised or amended by HHS from time to time;
NOW THEREFORE, in consideration of the mutual promises set forth in this BAA and the Agreement, and other good and valuable consideration, the sufficiency and receipt of which are hereby acknowledged, the Parties agree as follows:
1. DEFINITIONS
All capitalized terms not otherwise defined in this BAA shall have the meanings set forth in the Agreement or in the regulations promulgated by HHS in accordance with HIPAA and HITECH, including the Privacy Rule and Security Rule (collectively referred to hereinafter as the “Confidentiality Requirements”), as applicable. Specific definitions are as follows:
"Effective Date” shall be the same as the Effective Date of the Agreement.
“Electronic Protected Health Information” or “Electronic PHI” shall have the same meaning as the term “electronic protected health information” at 45 C.F.R. § 160.103. For purposes of this BAA, Electronic Protected Health Information and Electronic PHI shall mean only that electronic protected health information that Palantir uses, discloses, accesses, creates, receives, maintains, or transmits for or on behalf of Customer pursuant to the Agreement.
“Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” at 45 C.F.R. § 160.103. All references to PHI herein shall be construed to include Electronic PHI. For purposes of this BAA, PHI shall mean only that protected health information that Palantir uses, discloses, accesses, creates, receives, maintains, or transmits for or on behalf of Customer pursuant to the Agreement. For the avoidance of doubt, this PHI constitutes Customer Data.
2. GENERAL PROVISIONS
3. SCOPE OF USE AND DISCLOSURE
4. OBLIGATIONS OF PALANTIR
With regard to its use and/or disclosure of PHI:
5. OBLIGATIONS OF CUSTOMER
6. TERM AND TERMINATION OF BAA
(a) the date that the Agreement is terminated or expires, or (b) the date on which PHI is permanently deleted from the Palantir Technology; provided, however, that termination shall not affect the respective obligations or rights of the Parties arising under this BAA prior to the effective date of termination, all of which shall continue in accordance with their terms.
7. LIABILITY
Effective April 9th 2024 to October 25th 2024
DownloadTable of Contents
PALANTIR BUSINESS ASSOCIATE AGREEMENT (“BAA”)
The customer agreeing to the terms of this BAA (“Covered Entity” or “CE”) and Palantir Technologies Inc., a Delaware corporation with its principal place of business located at 1200 17th Street, Floor 15, Denver, CO 80202 (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing CE’s use of Palantir Technology, including the Service, and the provision of related Professional Services to CE by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This BAA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and CE with respect to Palantir’s use, disclosure, reception, access, creation, maintenance, and/or transmission of Protected Health Information on behalf of CE in connection with Palantir’s performance under the Agreement. Any capitalized terms used but not defined in this BAA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this BAA, the terms and conditions in this BAA shall prevail and control.
WHEREAS, CE is a Covered Entity as that term is defined in the federal regulations at 45 C.F.R. Parts 160 and 164, Subparts A and E (the “Privacy Rule”);
WHEREAS, pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), the U.S. Department of Health and Human Services (“HHS”) promulgated the Privacy Rule, the security standards at 45 C.F.R. Parts 160 and 164, Subparts A and C (the “Security Rule”) and the breach notification standards at 45 C.F.R. Part 164, Subpart D (the “Breach Notification Rule”) requiring certain individuals and entities subject to these standards to protect the privacy and security of certain individually identifiable health information, including electronic individually identifiable health information;
WHEREAS, the Parties are committed to complying with applicable provisions of the Privacy Rule, Security Rule, and Breach Notification Rule, as they may be revised or amended by HHS from time to time;
NOW THEREFORE, in consideration of the mutual promises set forth in this BAA and the Agreement, and other good and valuable consideration, the sufficiency and receipt of which are hereby acknowledged, the Parties agree as follows:
1. DEFINITIONS
All capitalized terms not otherwise defined in this BAA shall have the meanings set forth in the Agreement or in the regulations promulgated by HHS in accordance with HIPAA and HITECH, including the Privacy Rule and Security Rule (collectively referred to hereinafter as the “Confidentiality Requirements”), as applicable. Specific definitions are as follows:
"Effective Date” shall be the same as the Effective Date of the Agreement.
“Electronic Protected Health Information” or “Electronic PHI” shall have the same meaning as the term “electronic protected health information” at 45 C.F.R. § 160.103. For purposes of this BAA, Electronic Protected Health Information and Electronic PHI shall mean only that electronic protected health information that Palantir uses, discloses, accesses, creates, receives, maintains, or transmits for or on behalf of CE pursuant to the Agreement.
“Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” at 45 C.F.R. § 160.103. All references to PHI herein shall be construed to include Electronic PHI. For purposes of this BAA, PHI shall mean only that protected health information that Palantir uses, discloses, accesses, creates, receives, maintains, or transmits for or on behalf of CE pursuant to the Agreement. For the avoidance of doubt, this PHI constitutes Customer Data.
2. GENERAL PROVISIONS
2.1 Amendment. This BAA may be modified or amended only by a written document executed by the authorized representatives of both Parties. The Parties may, upon mutual written agreement, amend this BAA to maintain consistency or compliance with any applicable state or federal law, policy, directive, regulation, or government-sponsored program requirement.
3. SCOPE OF USE AND DISCLOSURE
3.1 Non-Disclosure & Palantir’s Operations. Palantir shall only use or disclose PHI as permitted by this BAA, to perform services as set forth in the Agreement, or as otherwise Required by Law. Except as limited in this BAA, in addition to any other uses and/or disclosures permitted or required by this BAA, Palantir may:
3.1.1 Use PHI as necessary for the proper management and administration of Palantir or to carry out its legal responsibilities.
3.1.2 Disclose PHI for the proper management and administration of Palantir or to carry out the legal responsibilities of Palantir; provided that: (i) such disclosures are Required by Law; or (ii) Palantir: (a) obtains reasonable assurances from any third party to whom the PHI is disclosed that the PHI will be held confidentially and used and disclosed only as Required by Law or for the purpose for which it was disclosed to the third party; and (b) requires the third party to agree to notify Palantir of any instances of which it is aware that the confidentiality of the information has been breached.
3.1.3 Use and disclose PHI for Data Aggregation services relating to the Health Care Operations of CE, as applicable, in accordance with the Agreement.
4. OBLIGATIONS OF PALANTIR
With regard to its use and/or disclosure of PHI:
4.1 Safeguards. Palantir shall implement and use reasonable and appropriate administrative, physical, and technical safeguards, and comply with the applicable Security Rule with respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA.
4.2 Reporting.
4.2.1 Palantir shall report to CE, within a reasonable time frame and in any event no less than a quarterly basis, any successful Security Incident of which Palantir becomes aware. Notice is hereby deemed provided, and no further notice will be provided, for unsuccessful Security Incidents, including, but not limited to, routine occurrences of pings and other broadcast attacks on a firewall, the loss of control of encrypted media or devices, denial of service attacks, port scans, unsuccessful login attempts, or interception of encrypted information, media or devices where the key is not compromised, or any combination of the above.
4.2.2 Palantir shall, following discovery of a Breach of Unsecured PHI or use or disclosure of Unsecured PHI in a manner not permitted by the Agreement and/or applicable Law, notify CE of such Breach, use or disclosure as required at 45 C.F.R. § 164.410, without unreasonable delay, and in no event more than five (5) business days after Palantir’s discovery of the Breach, use or disclosure, unless Palantir is prevented from doing so by 45 C.F.R. § 164.412 concerning law enforcement investigations. Palantir’s obligation to report or notify under this BAA, including under 4.2.1 and 4.2.2, is not and will not be construed as an acknowledgement by Palantir of any fault or liability with respect to any claims arising from this BAA.
4.3 Mitigation. Palantir shall mitigate to the extent practicable any harmful effect from any access, acquisition, use or disclosure of PHI in violation of this BAA or applicable law.
4.4 Subcontractors. Palantir shall, in accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any Subcontractor that uses, discloses, accesses, creates, receives, maintains or transmits PHI on behalf of Palantir, agrees to restrictions and conditions that apply to Palantir under this BAA with respect to that PHI that are at least as stringent as those set forth herein.
4.5 Access. If Palantir maintains a Designated Record Set on behalf of CE, Palantir shall provide access to and permit inspection and copying of PHI by CE as necessary to satisfy CE’s obligations under 45 C.F.R. § 164.524.
4.6 Accounting for Disclosures. Palantir shall maintain and make available to CE the information about Disclosures made by Palantir that is required to respond to an Individual’s request for an accounting of Disclosures to the CE as necessary to satisfy CE’s obligations under 45 C.F.R. § 164.528.
4.7 Government Access to Records. Palantir shall make its internal practices, books and records relating to the use or disclosure of PHI under this BAA available to the U. S. Secretary of HHS for purposes of determining CE’s compliance with the Privacy Rule, to the extent Required by Law. Nothing in this section shall waive any applicable privilege or protection, including with respect to Confidential Information.
5. OBLIGATIONS OF CE
5.1 Safeguards. CE shall obtain any and all necessary authorizations, consents, and other permissions that may be required under the Confidentiality Requirements and/or other applicable law or regulation prior to providing Palantir any PHI under this BAA. CE is responsible for implementing and using appropriate administrative, physical, and technical safeguards at all times to ensure the confidentiality, privacy, security, and integrity of its PHI in compliance with the Confidentiality Requirements, including in the configuration of systems, applications, and software CE controls and uses in connection with the Palantir Technology and Professional Services.
5.2 No PHI Outside Service. CE will not include PHI in information CE submits to Palantir’s personnel through a technical support request or other channels outside of the Service or Palantir-designated data ingestion process and represents, warrants and covenants that any information submitted through such a request or other channel outside of the Service is not PHI.
5.3 Restrictions on Use or Disclosure. In the event that CE honors a request to restrict the use or disclosure of PHI pursuant to 45 C.F.R. § 164.522(a) or makes revisions to its notice of privacy practices that place additional limitations on uses or disclosures of PHI or agrees to a request by an Individual for confidential communications under 45 C.F.R. § 164.522(b), CE agrees not to provide Palantir with any PHI that is subject to any of those restrictions or limitations to the extent such may limit Palantir’s ability to use and/or disclose PHI as permitted or required under this BAA unless CE notifies Palantir in writing of the restriction or limitation and Palantir agrees in writing to honor the restriction or limitation.
5.4 Amendments. CE acknowledges and agrees that CE is solely responsible for the form and content of PHI maintained by CE within the Palantir Technology and related services, including whether CE maintains such PHI in a Designated Record Set within the Palantir Technology. Palantir will provide CE with access to CE’s PHI via the Palantir Technology so that CE may fulfill its obligations under HIPAA with respect to Individuals’ rights of access and amendment, but will have no other obligations to CE or any Individual with respect to the rights afforded to Individuals by HIPAA with respect to Designated Record Sets, including rights of access or amendment of PHI. CE is responsible for managing its use of the Palantir Technology to appropriately respond to such individual requests.
6. TERM AND TERMINATION OF BAA
6.1 Term. The Term of this BAA shall be effective as of the Effective Date and shall terminate on the latter of (a) the date that the Agreement is terminated or expires, or (b) the date on which PHI is permanently deleted from the Palantir Technology; provided, however, that termination shall not affect the respective obligations or rights of the Parties arising under this BAA prior to the effective date of termination, all of which shall continue in accordance with their terms.
6.2 Obligations Upon Termination. Upon termination of this BAA for any reason, Palantir shall return or destroy (at Palantir’s option) all PHI received from CE in its possession, if it is feasible to do so, and as set forth in the applicable termination provisions of the Agreement. If PHI is destroyed, Palantir agrees to provide CE with certification of such destruction upon request. In the case of PHI for which it is not feasible to return or destroy, Palantir shall extend the protections of this BAA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible and/or as otherwise Required by Law, for so long as Palantir maintains such PHI.
7. LIABILITY
7.1 To the maximum extent permitted by applicable law, each Party agrees that the maximum aggregate liability of either Party and its Affiliates to the other Party and its Affiliates for all claims in aggregate arising out of a breach of applicable HIPAA obligations arising from the Agreement shall not exceed ten million dollars (USD 10,000,000).
Effective February 1st 2024 to April 9th 2024
DownloadTable of Contents
PALANTIR BUSINESS ASSOCIATE AGREEMENT (“BAA”)
The customer agreeing to the terms of this BAA (“Covered Entity” or “CE”) and Palantir Technologies Inc., a Delaware corporation with its principal place of business located at 1200 17th Street, Floor 15, Denver, CO 80202 (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing CE’s use of Palantir Technology, including the Service, and the provision of related Professional Services to CE by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This BAA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and CE with respect to Palantir’s use, disclosure, reception, access, creation, maintenance, and/or transmission of Protected Health Information on behalf of CE in connection with Palantir’s performance under the Agreement. Any capitalized terms used but not defined in this BAA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this BAA, the terms and conditions in this BAA shall prevail and control.
WHEREAS, CE is a Covered Entity as that term is defined in the federal regulations at 45 C.F.R. Parts 160 and 164, Subparts A and E (the “Privacy Rule”);
WHEREAS, pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), the U.S. Department of Health and Human Services (“HHS”) promulgated the Privacy Rule, the security standards at 45 C.F.R. Parts 160 and 164, Subparts A and C (the “Security Rule”) and the breach notification standards at 45 C.F.R. Part 164, Subpart D (the “Breach Notification Rule”) requiring certain individuals and entities subject to these standards to protect the privacy and security of certain individually identifiable health information, including electronic individually identifiable health information;
WHEREAS, the Parties are committed to complying with applicable provisions of the Privacy Rule, Security Rule, and Breach Notification Rule, as they may be revised or amended by HHS from time to time;
NOW THEREFORE, in consideration of the mutual promises set forth in this BAA and the Agreement, and other good and valuable consideration, the sufficiency and receipt of which are hereby acknowledged, the Parties agree as follows:
1. DEFINITIONS
All capitalized terms not otherwise defined in this BAA shall have the meanings set forth in the Agreement or in the regulations promulgated by HHS in accordance with HIPAA and HITECH, including the Privacy Rule and Security Rule (collectively referred to hereinafter as the “Confidentiality Requirements”), as applicable. Specific definitions are as follows:
"Effective Date” shall be the same as the Effective Date of the Agreement.
“Electronic Protected Health Information” or “Electronic PHI” shall have the same meaning as the term “electronic protected health information” at 45 C.F.R. § 160.103. For purposes of this BAA, Electronic Protected Health Information and Electronic PHI shall mean only that electronic protected health information that Palantir uses, discloses, accesses, creates, receives, maintains, or transmits for or on behalf of CE pursuant to the Agreement.
“Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” at 45 C.F.R. § 160.103. All references to PHI herein shall be construed to include Electronic PHI. For purposes of this BAA, PHI shall mean only that protected health information that Palantir uses, discloses, accesses, creates, receives, maintains, or transmits for or on behalf of CE pursuant to the Agreement. For the avoidance of doubt, this PHI constitutes Customer Data.
2. GENERAL PROVISIONS
2.1 Amendment. This BAA may be modified or amended only by a written document executed by the authorized representatives of both Parties. The Parties may, upon mutual written agreement, amend this BAA to maintain consistency or compliance with any applicable state or federal law, policy, directive, regulation, or government-sponsored program requirement.
3. SCOPE OF USE AND DISCLOSURE
3.1 Non-Disclosure & Palantir’s Operations. Palantir shall only use or disclose PHI as permitted by this BAA, to perform services as set forth in the Agreement, or as otherwise Required by Law. Except as limited in this BAA, in addition to any other uses and/or disclosures permitted or required by this BAA, Palantir may:
3.1.1 Use PHI as necessary for the proper management and administration of Palantir or to carry out its legal responsibilities.
3.1.2 Disclose PHI for the proper management and administration of Palantir or to carry out the legal responsibilities of Palantir; provided that: (i) such disclosures are Required by Law; or (ii) Palantir: (a) obtains reasonable assurances from any third party to whom the PHI is disclosed that the PHI will be held confidentially and used and disclosed only as Required by Law or for the purpose for which it was disclosed to the third party; and (b) requires the third party to agree to notify Palantir of any instances of which it is aware that the confidentiality of the information has been breached.
3.1.3 Use and disclose PHI for Data Aggregation services relating to the Health Care Operations of CE, as applicable, in accordance with the Agreement.
4. OBLIGATIONS OF PALANTIR
With regard to its use and/or disclosure of PHI:
4.1 Safeguards. Palantir shall implement and use reasonable and appropriate administrative, physical, and technical safeguards, and comply with the applicable Security Rule with respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA.
4.2 Reporting.
4.2.1 Palantir shall report to CE, within a reasonable time frame and in any event no less than a quarterly basis, any successful Security Incident of which Palantir becomes aware. Notice is hereby deemed provided, and no further notice will be provided, for unsuccessful Security Incidents, including, but not limited to, routine occurrences of pings and other broadcast attacks on a firewall, the loss of control of encrypted media or devices, denial of service attacks, port scans, unsuccessful login attempts, or interception of encrypted information, media or devices where the key is not compromised, or any combination of the above.
4.2.2 Palantir shall, following discovery of a Breach of Unsecured PHI or use or disclosure of Unsecured PHI in a manner not permitted by the Agreement and/or applicable Law, notify CE of such Breach, use or disclosure as required at 45 C.F.R. § 164.410, without unreasonable delay, and in no event more than five (5) business days after Palantir’s discovery of the Breach, use or disclosure, unless Palantir is prevented from doing so by 45 C.F.R. § 164.412 concerning law enforcement investigations. Palantir’s obligation to report or notify under this BAA, including under 4.2.1 and 4.2.2, is not and will not be construed as an acknowledgement by Palantir of any fault or liability with respect to any claims arising from this BAA.
4.3 Mitigation. Palantir shall mitigate to the extent practicable any harmful effect from any access, acquisition, use or disclosure of PHI in violation of this BAA or applicable law.
4.4 Subcontractors. Palantir shall, in accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any Subcontractor that uses, discloses, accesses, creates, receives, maintains or transmits PHI on behalf of Palantir, agrees to restrictions and conditions that apply to Palantir under this BAA with respect to that PHI that are at least as stringent as those set forth herein.
4.5 Access. If Palantir maintains a Designated Record Set on behalf of CE, Palantir shall provide access to and permit inspection and copying of PHI by CE as necessary to satisfy CE’s obligations under 45 C.F.R. § 164.524.
4.6 Accounting for Disclosures. Palantir shall maintain and make available to CE the information about Disclosures made by Palantir that is required to respond to an Individual’s request for an accounting of Disclosures to the CE as necessary to satisfy CE’s obligations under 45 C.F.R. § 164.528.
4.7 Government Access to Records. Palantir shall make its internal practices, books and records relating to the use or disclosure of PHI under this BAA available to the U. S. Secretary of HHS for purposes of determining CE’s compliance with the Privacy Rule, to the extent Required by Law. Nothing in this section shall waive any applicable privilege or protection, including with respect to Confidential Information.
5. OBLIGATIONS OF CE
5.1 Safeguards. CE shall obtain any and all necessary authorizations, consents, and other permissions that may be required under the Confidentiality Requirements and/or other applicable law or regulation prior to providing Palantir any PHI under this BAA. CE is responsible for implementing and using appropriate administrative, physical, and technical safeguards at all times to ensure the confidentiality, privacy, security, and integrity of its PHI in compliance with the Confidentiality Requirements, including in the configuration of systems, applications, and software CE controls and uses in connection with the Palantir Technology and Professional Services.
5.2 No PHI Outside Service. CE will not include PHI in information CE submits to Palantir’s personnel through a technical support request or other channels outside of the Service or Palantir-designated data ingestion process and represents, warrants and covenants that any information submitted through such a request or other channel outside of the Service is not PHI.
5.3 Restrictions on Use or Disclosure. In the event that CE honors a request to restrict the use or disclosure of PHI pursuant to 45 C.F.R. § 164.522(a) or makes revisions to its notice of privacy practices that place additional limitations on uses or disclosures of PHI or agrees to a request by an Individual for confidential communications under 45 C.F.R. § 164.522(b), CE agrees not to provide Palantir with any PHI that is subject to any of those restrictions or limitations to the extent such may limit Palantir’s ability to use and/or disclose PHI as permitted or required under this BAA unless CE notifies Palantir in writing of the restriction or limitation and Palantir agrees in writing to honor the restriction or limitation.
5.4 Amendments. CE acknowledges and agrees that CE is solely responsible for the form and content of PHI maintained by CE within the Palantir Technology and related services, including whether CE maintains such PHI in a Designated Record Set within the Palantir Technology. Palantir will provide CE with access to CE’s PHI via the Palantir Technology so that CE may fulfill its obligations under HIPAA with respect to Individuals’ rights of access and amendment, but will have no other obligations to CE or any Individual with respect to the rights afforded to Individuals by HIPAA with respect to Designated Record Sets, including rights of access or amendment of PHI. CE is responsible for managing its use of the Palantir Technology to appropriately respond to such individual requests.
6. TERM AND TERMINATION OF BAA
6.1 Term. The Term of this BAA shall be effective as of the Effective Date and shall terminate on the latter of (a) the date that the Agreement is terminated or expires, or (b) the date on which PHI is permanently deleted from the Palantir Technology; provided, however, that termination shall not affect the respective obligations or rights of the Parties arising under this BAA prior to the effective date of termination, all of which shall continue in accordance with their terms.
6.2 Obligations Upon Termination. Upon termination of this BAA for any reason, Palantir shall return or destroy (at Palantir’s option) all PHI received from CE in its possession, if it is feasible to do so, and as set forth in the applicable termination provisions of the Agreement. If PHI is destroyed, Palantir agrees to provide CE with certification of such destruction upon request. In the case of PHI for which it is not feasible to return or destroy, Palantir shall extend the protections of this BAA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible and/or as otherwise Required by Law, for so long as Palantir maintains such PHI.
7. LIABILITY
7.1 To the maximum extent permitted by applicable law, each Party agrees that the maximum aggregate liability of either Party and its Affiliates to the other Party and its Affiliates for all claims in aggregate arising out of a breach of applicable HIPAA obligations arising from the Agreement shall not exceed ten million dollars (USD 10,000,000).
Effective January 31st 2024 to February 1st 2024
DownloadTable of Contents
PALANTIR BUSINESS ASSOCIATE AGREEMENT (“BAA”)
The customer agreeing to the terms of this BAA (“Covered Entity” or “CE”) and Palantir Technologies Inc., a Delaware corporation with its principal place of business located at 1200 17th Street, Floor 15, Denver, CO 80202 (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing CE’s use of Palantir Technology, including the Service, and the provision of related Professional Services to CE by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This BAA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and CE with respect to Palantir’s use, disclosure, reception, access, creation, maintenance, and/or transmission of Protected Health Information on behalf of CE in connection with Palantir’s performance under the Agreement. Any capitalized terms used but not defined in this BAA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this BAA, the terms and conditions in this BAA shall prevail and control.
WHEREAS, CE is a Covered Entity as that term is defined in the federal regulations at 45 C.F.R. Parts 160 and 164, Subparts A and E (the “Privacy Rule”);
WHEREAS, pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), the U.S. Department of Health and Human Services (“HHS”) promulgated the Privacy Rule, the security standards at 45 C.F.R. Parts 160 and 164, Subparts A and C (the “Security Rule”) and the breach notification standards at 45 C.F.R. Part 164, Subpart D (the “Breach Notification Rule”) requiring certain individuals and entities subject to these standards to protect the privacy and security of certain individually identifiable health information, including electronic individually identifiable health information;
WHEREAS, the Parties are committed to complying with applicable provisions of the Privacy Rule, Security Rule, and Breach Notification Rule, as they may be revised or amended by HHS from time to time;
NOW THEREFORE, in consideration of the mutual promises set forth in this BAA and the Agreement, and other good and valuable consideration, the sufficiency and receipt of which are hereby acknowledged, the Parties agree as follows:
1. DEFINITIONS
All capitalized terms not otherwise defined in this BAA shall have the meanings set forth in the Agreement or in the regulations promulgated by HHS in accordance with HIPAA and HITECH, including the Privacy Rule and Security Rule (collectively referred to hereinafter as the “Confidentiality Requirements”), as applicable. Specific definitions are as follows:
"Effective Date” shall be the same as the Effective Date of the Agreement.
“Electronic Protected Health Information” or “Electronic PHI” shall have the same meaning as the term “electronic protected health information” at 45 C.F.R. § 160.103. For purposes of this BAA, Electronic Protected Health Information and Electronic PHI shall mean only that electronic protected health information that Palantir uses, discloses, accesses, creates, receives, maintains, or transmits for or on behalf of CE pursuant to the Agreement.
“Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” at 45 C.F.R. § 160.103. All references to PHI herein shall be construed to include Electronic PHI. For purposes of this BAA, PHI shall mean only that protected health information that Palantir uses, discloses, accesses, creates, receives, maintains, or transmits for or on behalf of CE pursuant to the Agreement. For the avoidance of doubt, this PHI constitutes Customer Data.
2. GENERAL PROVISIONS
2.1 Amendment. This BAA may be modified or amended only by a written document executed by the authorized representatives of both Parties. The Parties may, upon mutual written agreement, amend this BAA to maintain consistency or compliance with any applicable state or federal law, policy, directive, regulation, or government-sponsored program requirement.
3. SCOPE OF USE AND DISCLOSURE
3.1 Non-Disclosure & Palantir’s Operations. Palantir shall only use or disclose PHI as permitted by this BAA, to perform services as set forth in the Agreement, or as otherwise Required by Law. Except as limited in this BAA, in addition to any other uses and/or disclosures permitted or required by this BAA, Palantir may:
3.1.1 Use PHI as necessary for the proper management and administration of Palantir or to carry out its legal responsibilities.
3.1.2 Disclose PHI for the proper management and administration of Palantir or to carry out the legal responsibilities of Palantir; provided that: (i) such disclosures are Required by Law; or (ii) Palantir: (a) obtains reasonable assurances from any third party to whom the PHI is disclosed that the PHI will be held confidentially and used and disclosed only as Required by Law or for the purpose for which it was disclosed to the third party; and (b) requires the third party to agree to notify Palantir of any instances of which it is aware that the confidentiality of the information has been breached.
3.1.3 Use and disclose PHI for Data Aggregation services relating to the Health Care Operations of CE, as applicable, in accordance with the Agreement.
4. OBLIGATIONS OF PALANTIR
With regard to its use and/or disclosure of PHI:
4.1 Safeguards. Palantir shall implement and use reasonable and appropriate administrative, physical, and technical safeguards, and comply with the applicable Security Rule with respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA.
4.2 Reporting.
4.2.1 Palantir shall report to CE, within a reasonable time frame and in any event no less than a quarterly basis, any successful Security Incident of which Palantir becomes aware. Notice is hereby deemed provided, and no further notice will be provided, for unsuccessful Security Incidents, including, but not limited to, routine occurrences of pings and other broadcast attacks on a firewall, the loss of control of encrypted media or devices, denial of service attacks, port scans, unsuccessful login attempts, or interception of encrypted information, media or devices where the key is not compromised, or any combination of the above.
4.2.2 Palantir shall, following discovery of a Breach of Unsecured PHI or use or disclosure of Unsecured PHI in a manner not permitted by the Agreement and/or applicable Law, notify CE of such Breach, use or disclosure as required at 45 C.F.R. § 164.410, without unreasonable delay, and in no event more than five (5) business days after Palantir’s discovery of the Breach, use or disclosure, unless Palantir is prevented from doing so by 45 C.F.R. § 164.412 concerning law enforcement investigations. Palantir’s obligation to report or notify under this BAA, including under 4.2.1 and 4.2.2, is not and will not be construed as an acknowledgement by Palantir of any fault or liability with respect to any claims arising from this BAA.
4.3 Mitigation. Palantir shall mitigate to the extent practicable any harmful effect from any access, acquisition, use or disclosure of PHI in violation of this BAA or applicable law.
4.4 Subcontractors. Palantir shall, in accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any Subcontractor that uses, discloses, accesses, creates, receives, maintains or transmits PHI on behalf of Palantir, agrees to restrictions and conditions that apply to Palantir under this BAA with respect to that PHI that are at least as stringent as those set forth herein.
4.5 Access. If Palantir maintains a Designated Record Set on behalf of CE, Palantir shall provide access to and permit inspection and copying of PHI by CE as necessary to satisfy CE’s obligations under 45 C.F.R. § 164.524.
4.6 Accounting for Disclosures. Palantir shall maintain and make available to CE the information about Disclosures made by Palantir that is required to respond to an Individual’s request for an accounting of Disclosures to the CE as necessary to satisfy CE’s obligations under 45 C.F.R. § 164.528.
4.7 Government Access to Records. Palantir shall make its internal practices, books and records relating to the use or disclosure of PHI under this BAA available to the U. S. Secretary of HHS for purposes of determining CE’s compliance with the Privacy Rule, to the extent Required by Law. Nothing in this section shall waive any applicable privilege or protection, including with respect to Confidential Information.
5. OBLIGATIONS OF CE
5.1 Safeguards. CE shall obtain any and all necessary authorizations, consents, and other permissions that may be required under the Confidentiality Requirements and/or other applicable law or regulation prior to providing Palantir any PHI under this BAA. CE is responsible for implementing and using appropriate administrative, physical, and technical safeguards at all times to ensure the confidentiality, privacy, security, and integrity of its PHI in compliance with the Confidentiality Requirements, including in the configuration of systems, applications, and software CE controls and uses in connection with the Palantir Technology and Professional Services.
5.2 No PHI Outside Service. CE will not include PHI in information CE submits to Palantir’s personnel through a technical support request or other channels outside of the Service or Palantir-designated data ingestion process and represents, warrants and covenants that any information submitted through such a request or other channel outside of the Service is not PHI.
5.3 Restrictions on Use or Disclosure. In the event that CE honors a request to restrict the use or disclosure of PHI pursuant to 45 C.F.R. § 164.522(a) or makes revisions to its notice of privacy practices that place additional limitations on uses or disclosures of PHI or agrees to a request by an Individual for confidential communications under 45 C.F.R. § 164.522(b), CE agrees not to provide Palantir with any PHI that is subject to any of those restrictions or limitations to the extent such may limit Palantir’s ability to use and/or disclose PHI as permitted or required under this BAA unless CE notifies Palantir in writing of the restriction or limitation and Palantir agrees in writing to honor the restriction or limitation.
5.4 Amendments. CE acknowledges and agrees that CE is solely responsible for the form and content of PHI maintained by CE within the Palantir Technology and related services, including whether CE maintains such PHI in a Designated Record Set within the Palantir Technology. Palantir will provide CE with access to CE’s PHI via the Palantir Technology so that CE may fulfill its obligations under HIPAA with respect to Individuals’ rights of access and amendment, but will have no other obligations to CE or any Individual with respect to the rights afforded to Individuals by HIPAA with respect to Designated Record Sets, including rights of access or amendment of PHI. CE is responsible for managing its use of the Palantir Technology to appropriately respond to such individual requests.
6. TERM AND TERMINATION OF BAA
6.1 Term. The Term of this BAA shall be effective as of the Effective Date and shall terminate on the latter of (a) the date that the Agreement is terminated or expires, or (b) the date on which PHI is permanently deleted from the Palantir Technology; provided, however, that termination shall not affect the respective obligations or rights of the Parties arising under this BAA prior to the effective date of termination, all of which shall continue in accordance with their terms.
6.2 Obligations Upon Termination. Upon termination of this BAA for any reason, Palantir shall return or destroy (at Palantir’s option) all PHI received from CE in its possession, if it is feasible to do so, and as set forth in the applicable termination provisions of the Agreement. If PHI is destroyed, Palantir agrees to provide CE with certification of such destruction upon request. In the case of PHI for which it is not feasible to return or destroy, Palantir shall extend the protections of this BAA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible and/or as otherwise Required by Law, for so long as Palantir maintains such PHI.
7. LIABILITY
7.1 To the maximum extent permitted by applicable law, each Party agrees that the maximum aggregate liability of either Party and its Affiliates to the other Party and its Affiliates for all claims in aggregate arising out of a breach of applicable HIPAA obligations arising from the Agreement shall not exceed (b) ten million dollars (USD 10,000,000).
Palantir AIP Addendum
Effective February 3rd 2025
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), (b) shall comply with the Anthropic Bedrock AI Services Agreement (available at https://s3.amazonaws.com/EULA/Anthropic-EULA-1023.pdf), and (c) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry; and (d) shall, with respect to Customer’s use of applicable models that meet the definition of “Pre-GA Offerings” in the Google Model Service Pre-GA Offerings Terms (defined below) made available via the Google Model Service, comply with Google’s “Pre-GA Offerings Terms” subsection in the “General Service Terms” section of the Google Cloud Platform Service Specific Terms, available at https://cloud.google.com/terms/service-terms (the “Google Model Service Pre-GA Offerings Terms”). Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Meta’s Llama 3.3 Model, Meta's Llama 3.2 Model, and Meta’s Llama 3.1 Model (and Meta’s Llama Models now existing or released in the future) hosted in Palantir’s model hub environment(s) (“Llama Model Service”) | Customer’s use of AIP leveraging the Llama Model Service shall comply with (a) the Llama 3.3 Community License Agreement (https://www.llama.com/llama3_3/license/), which includes the Llama 3.3 Acceptable Use Policy incorporated by reference (https://www.llama.com/llama3_3/use-policy/); (b) the Llama 3.2 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_2/LICENSE), which includes the Llama 3.2 Acceptable Use Policy (https://www.llama.com/llama3_2/use-policy/); (c) the Llama 3.1 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_1/LICENSE), which includes the Llama 3.1 Acceptable Use Policy (https://llama.meta.com/llama3_1/use-policy/); and (d) any license terms and/or acceptable use policies applicable to any other Llama Model(s) (now existing or released in the future) made available as part of the Llama Model Service. |
X.AI LLC’s Grok Models hosted by X.AI LLC (“xAI Model Service”) | Customer’s use of AIP leveraging the xAI Model Service shall (a) comply with applicable law (this includes not taking unlawful action on behalf of others); (b) not promote or engage in (i) the sexualization or exploitation of children, (ii) violating copyright, trademark, or other intellectual property law, (iii) compromising others’ privacy (iv) violating a person’s right to publicity, (v) operating in a regulated industry without complying with those regulations, or (vi) defrauding, defaming, scamming, or spamming; (c) not harm people or property (this includes but is not limited to not perpetrating hacking, doxing, phishing or other malicious attacks, and not developing any kind of weapon); (d) not mislead or circumvent technical safeguards or other technical guardrails; (e) not represent that output of the xAI Model Service is human generated; and (f) not use output of the xAI Model Service to train generative artificial intelligence models similar to or competitive with the xAI Model Service. |
Effective January 14th 2025 to February 3rd 2025
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), and (b) shall comply with the Anthropic Bedrock AI Services Agreement (available at https://s3.amazonaws.com/EULA/Anthropic-EULA-1023.pdf), and (c) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry; and (d) shall, with respect to Customer’s use of applicable models that meet the definition of “Pre-GA Offerings” in the Google Model Service Pre-GA Offerings Terms (defined below) made available via the Google Model Service, comply with Google’s “Pre-GA Offerings Terms” subsection in the “General Service Terms” section of the Google Cloud Platform Service Specific Terms, available at https://cloud.google.com/terms/service-terms (the “Google Model Service Pre-GA Offerings Terms”). Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Meta’s Llama 3.2 Model and Meta’s Llama 3.1 Model (and Meta’s Llama Models now existing or released in the future) hosted in Palantir’s model hub environment(s) (“Llama Model Service”) | Customer’s use of AIP leveraging the Llama Model Service shall comply with (a) the Llama 3.2 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_2/LICENSE), which includes the Llama 3.2 Acceptable Use Policy (https://www.llama.com/llama3_2/use-policy/); (b) the Llama 3.1 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_1/LICENSE), which includes the Llama 3.1 Acceptable Use Policy (https://llama.meta.com/llama3_1/use-policy/); and (c) any license terms and/or acceptable use policies applicable to any other Llama Model(s) (now existing or released in the future) made available as part of the Llama Model Service. |
X.AI LLC’s Grok Models hosted by X.AI LLC (“xAI Model Service”) | Customer’s use of AIP leveraging the xAI Model Service shall (a) comply with applicable law (this includes not taking unlawful action on behalf of others); (b) not promote or engage in (i) the sexualization or exploitation of children, (ii) violating copyright, trademark, or other intellectual property law, (iii) compromising others’ privacy (iv) violating a person’s right to publicity, (v) operating in a regulated industry without complying with those regulations, or (vi) defrauding, defaming, scamming, or spamming; (c) not harm people or property (this includes but is not limited to not perpetrating hacking, doxing, phishing or other malicious attacks, and not developing any kind of weapon); (d) not mislead or circumvent technical safeguards or other technical guardrails; (e) not represent that output of the xAI Model Service is human generated; and (f) not use output of the xAI Model Service to train generative artificial intelligence models similar to or competitive with the xAI Model Service. |
Effective December 6th 2024 to January 14th 2025
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), and (b) shall comply with the Anthropic Bedrock AI Services Agreement (available at https://s3.amazonaws.com/EULA/Anthropic-EULA-1023.pdf), and (c) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry; and (d) shall, with respect to Customer’s use of applicable models that meet the definition of “Pre-GA Offerings” in the Google Model Service Pre-GA Offerings Terms (defined below) made available via the Google Model Service, comply with Google’s “Pre-GA Offerings Terms” subsection in the “General Service Terms” section of the Google Cloud Platform Service Specific Terms, available at https://cloud.google.com/terms/service-terms (the “Google Model Service Pre-GA Offerings Terms”). Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Meta’s Llama 3.2 Model and Meta’s Llama 3.1 Model (and Meta’s Llama Models now existing or released in the future) hosted in Palantir’s model hub environment(s) (“Llama Model Service”) | Customer’s use of AIP leveraging the Llama Model Service shall comply with (a) the Llama 3.2 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_2/LICENSE), which includes the Llama 3.2 Acceptable Use Policy (https://www.llama.com/llama3_2/use-policy/); (b) the Llama 3.1 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_1/LICENSE), which includes the Llama 3.1 Acceptable Use Policy (https://llama.meta.com/llama3_1/use-policy/); and (c) any license terms and/or acceptable use policies applicable to any other Llama Model(s) (now existing or released in the future) made available as part of the Llama Model Service. |
Effective August 27th 2024 to December 6th 2024
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), and (b) shall comply with the Anthropic Bedrock AI Services Agreement (available at https://s3.amazonaws.com/EULA/Anthropic-EULA-1023.pdf), and (c) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry; and (d) shall, with respect to Customer’s use of applicable models that meet the definition of “Pre-GA Offerings” in the Google Model Service Pre-GA Offerings Terms (defined below) made available via the Google Model Service, comply with Google’s “Pre-GA Offerings Terms” subsection in the “General Service Terms” section of the Google Cloud Platform Service Specific Terms, available at https://cloud.google.com/terms/service-terms (the “Google Model Service Pre-GA Offerings Terms”). Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Meta's Llama 3.1 Model (and Meta’s Llama Models now existing or released in the future) hosted in Palantir's model hub environment(s) (“Llama Model Service”) | Customer’s use of AIP leveraging the Llama Model Service shall comply with the Llama 3.1 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_1/LICENSE), which includes the Llama 3.1 Acceptable Use Policy (https://llama.meta.com/llama3_1/use-policy/), and any license terms and/or acceptable use policies applicable to any other Llama Model(s) (now existing or released in the future) made available as part of the Llama Model Service.. |
Effective August 10th 2024 to August 27th 2024
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), and (b) shall comply with the Anthropic Bedrock AI Services Agreement (available at https://s3.amazonaws.com/EULA/Anthropic-EULA-1023.pdf), and (c) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry; and (d) shall, with respect to Customer’s use of applicable models that meet the definition of “Pre-GA Offerings” in the Google Model Service Pre-GA Offerings Terms (defined below) made available via the Google Model Service, comply with Google’s “Pre-GA Offerings Terms” subsection in the “General Service Terms” section of the Google Cloud Platform Service Specific Terms, available at https://cloud.google.com/terms/service-terms (the “Google Model Service Pre-GA Offerings Terms”). Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Meta's Llama 3.1 Model hosted in Palantir's model hub environment(s) (“Llama 3.1 Model Service”) | Customer’s use of AIP leveraging the Llama 3.1 Model Service shall comply with the Llama 3.1 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_1/LICENSE), which includes the Llama 3.1 Acceptable Use Policy (https://llama.meta.com/llama3_1/use-policy/). |
Effective August 10th 2024 to August 10th 2024
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), and (b) shall comply with the Anthropic Bedrock AI Services Agreement (available at https://s3.amazonaws.com/EULA/Anthropic-EULA-1023.pdf), and (c) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry; and (d) shall, with respect to Customer’s use of applicable models that meet the definition of “Pre-GA Offerings” in the Google Model Service Pre-GA Offerings Terms (defined below) made available via the Google Model Service, comply with Google’s “Pre-GA Offerings Terms” subsection in the “General Service Terms” section of the Google Cloud Platform Service Specific Terms, available at https://cloud.google.com/terms/service-terms (the “Google Model Service Pre-GA Offerings Terms”). Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Meta's Llama 3.1 Model hosted in Palantir's model hun envoronment(s) (“Llama 3.1 Model Service”) | Customer’s use of AIP leveraging the Llama 3.1 Model Service shall comply with the Llama 3.1 Community License Agreement (https://github.com/meta-llama/llama-models/blob/main/models/llama3_1/LICENSE), which includes the Llama 3.1 Acceptable Use Policy (https://llama.meta.com/llama3_1/use-policy/). |
Effective June 7th 2024 to August 10th 2024
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), and (b) shall comply with the Anthropic Bedrock AI Services Agreement (available at https://s3.amazonaws.com/EULA/Anthropic-EULA-1023.pdf), and (c) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry; and (d) shall, with respect to Customer’s use of applicable models that meet the definition of “Pre-GA Offerings” in the Google Model Service Pre-GA Offerings Terms (defined below) made available via the Google Model Service, comply with Google’s “Pre-GA Offerings Terms” subsection in the “General Service Terms” section of the Google Cloud Platform Service Specific Terms, available at https://cloud.google.com/terms/service-terms (the “Google Model Service Pre-GA Offerings Terms”). Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Effective May 6th 2024 to June 7th 2024
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), and (b) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry; and (d) shall, with respect to Customer’s use of applicable models that meet the definition of “Pre-GA Offerings” in the Google Model Service Pre-GA Offerings Terms (defined below) made available via the Google Model Service, comply with Google’s “Pre-GA Offerings Terms” subsection in the “General Service Terms” section of the Google Cloud Platform Service Specific Terms, available at https://cloud.google.com/terms/service-terms (the “Google Model Service Pre-GA Offerings Terms”). Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Effective December 15th 2023 to May 6th 2024
DownloadTable of Contents
Customer’s use of AIP may leverage the following Models hosted in a third party environment (each a “Third Party Model Service”).
Third Party Model Service | Additional Terms |
OpenAI Models hosted in Palantir’s Microsoft Azure Environment (“Azure OpenAI Model Service”) | (a) Customer’s use of AIP leveraging the Azure OpenAI Model Service shall comply with the Azure OpenAI Code of Conduct (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=%2Fazure%2Fcognitive- services%2Fopenai%2Fcontext%2Fcontext); (b) Customer shall only use AIP leveraging the Azure OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); and (c) Customer shall not use AIP leveraging the Azure OpenAI Model Service (i) to generate, distribute, or modify any output from the Azure OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by Azure or Palantir applicable to the Azure OpenAI Model Service. |
Models hosted in Palantir’s Amazon Web Services Environment (“AWS Model Service”) | Customer’s use of AIP leveraging Anthropic Models through the AWS Model Service (a) shall comply with the Anthropic Code of Conduct (https://console.anthropic.com/legal/aup), and (b) shall not facilitate or engage in the following: (i) design, market, help distribute or utilize weapons, explosives, dangerous materials or other systems designed to cause harm to or loss of human life; (ii) covertly tracking, targeting, or surveilling individuals, i.e., searching for or gathering information on an individual or group in order to track, target or report on their identity, including using the product for facial recognition, covert tracking, battlefield management applications or predictive policing; (iii) automated determination of financing eligibility of individuals, i.e., making automated decisions about the eligibility of individuals for financial products and creditworthiness; (iv) automated determination of employment and housing decisions, i.e., making automated decisions about the employability of individuals or other employment determinations or decisions regarding eligibility for housing, including leases and home loans; (v) any law enforcement application, except for the following permitted applications by U.S. law enforcement organizations: back office uses including call center support, document summarization, and accounting; or (vi) analysis of data for the location of missing persons and other applications, provided that such applications do not otherwise violate or impair the liberty, civil liberties, or human rights of natural persons. Customer hereby agrees that its use of AIP leveraging Models (other than Anthropic Models) through the AWS Model Service shall comply with any acceptable use policies or codes of conduct applicable to such Models, as made available to Customer through AIP or the Documentation. Customer acknowledges that Amazon Web Services, Inc. may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the AWS Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the AWS Model Service). |
Google Models hosted in Palantir’s Google Cloud Services Environment (“Google Model Service”) | Customer’s use of AIP leveraging the Google Model Service (a) shall comply with the Google Generative AI Prohibited Use Policy (https://policies.google.com/terms/generative-ai/use-policy); (b) shall comply with the Google Cloud Platform Acceptable Use Policy (https://cloud.google.com/terms/aup); and (c) shall not reasonably be expected to lead to death, personal injury, or environmental damage, including operation of nuclear facilities, air traffic control, life support systems, or weaponry. Customer acknowledges that Google LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the Google Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the Google Model Service). |
OpenAI Models hosted by OpenAI (“OpenAI Model Service”) | Customer’s use of AIP leveraging the OpenAI Model Service (a) shall comply with the OpenAI Usage Policies (https://openai.com/policies/usage-policies); (b) if and only as applicable, shall comply with the applicable OpenAI Service Terms (https://openai.com/policies/service-terms); (c) Customer shall only use AIP leveraging the OpenAI Model Service to (i) submit content to be summarized for pre-defined topics built into AIP and cannot use AIP as an open-ended summarizer (examples of such permitted use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (ii) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (iii) search trusted source documents such as internal Customer documentation; (iv) ask questions and receive answers from trusted source documents such as internal Customer documentation; (v) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL); or (vi) fine-tune Models as provided as part of AIP and the OpenAI Model Service; and (d) Customer shall not use AIP leveraging the OpenAI Model Service (i) to generate, distribute, or modify any output from the OpenAI Model Service that the Customer knew or should have known was infringing or likely to infringe a third party’s intellectual property or other proprietary rights (including if such infringement is caused by Customer’s combination of such output with third party products or services); or (ii) while disabling, ignoring, or otherwise circumventing, without authorization, any relevant citation, filtering, or safety features or restrictions provided by OpenAI applicable to the OpenAI Model Service. Customer acknowledges that OpenAI, LLC may collect and temporarily retain pseudonymized security classifier metadata related to Customer’s use of AIP leveraging the OpenAI Model Service (which metadata, for the avoidance of doubt, shall not include the contents of Customer’s prompts provided to or output received from the OpenAI Model Service). |
Effective June 27th 2023 to December 15th 2023
DownloadSummary of changes
Table of Contents
Effective June 23rd 2023 to June 27th 2023
DownloadTable of Contents
Effective May 17th 2023 to June 23rd 2023
DownloadTable of Contents
Palantir’s proprietary software-as-a-service offering(s) leveraging artificial intelligence (including but not limited to language models and other modeling services) (“Models”), including OpenAI’s Models hosted in Palantir’s Microsoft Azure environment, as set forth in the Documentation and/or the Agreement.
Effective May 17th 2023 to May 17th 2023
DownloadTable of Contents
Palantir’s proprietary software-as-a-service offering(s) leveraging artificial intelligence (including but not limited to language models and other modeling services) (“Models”), including OpenAI’s Models hosted in Palantir’s Microsoft Azure environment, as set forth in the Documentation and/or the Agreement.
Effective May 2nd 2023 to May 17th 2023
DownloadTable of Contents
Effective May 1st 2023 to May 2nd 2023
DownloadTable of Contents
PALANTIR COGNITIVE SERVICES ADDENDUM
The customer (“Customer”) agreeing to the terms of this Palantir Cognitive Services Addendum (the “Addendum”) and the Palantir Technologies entity that is the signatory to the Agreement (“Palantir”; each a “Party” and collectively the “Parties”), have entered into an agreement governing Customer’s use of the Service (the “Agreement”). This Addendum is incorporated into the Agreement. Any capitalized terms used but not defined in this Addendum shall have the meaning provided in the Agreement. If there is a conflict in meaning between the Agreement and this Addendum, this Addendum shall prevail and control. This Addendum will remain in effect until any expiration or termination of the Agreement pursuant thereto.
Certain Definitions.
“Azure OpenAI Cognitive Service” means any Cognitive Service leveraging OpenAI’s Models hosted in Palantir’s Microsoft Azure environment.
“Documentation” means any technical documentation for the Service made available in connection with the Service.
“Service” means Palantir’s proprietary software-as-a-service offering(s) set forth in the Agreement.
“Cognitive Service(s)” means any parts of the Service that leverage cognitive modelling services (including but not limited to language models) (“Models”), including but not limited to the Azure OpenAI Cognitive Service, as set forth in the Documentation and/or the Agreement.
Customer use of Cognitive Services.
Cognitive Services Use. The Cognitive Services employ artificial intelligence and machine learning techniques, including use of Models. Because of the statistical methods underlying the foregoing techniques, output of the Cognitive Services may be incorrect, incomplete, or biased. Accordingly, Customer’s use of the Cognitive Services is at its own risk and Customer shall be solely responsible for any actions it takes on the basis of any Cognitive Services output. Customer further agrees to evaluate (including through review by a natural person) any Cognitive Services output prior to taking any actions or making any decisions on its basis. Access to the Cognitive Services forms part of the Service and is subject to relevant terms and conditions of the Agreement applicable to the Service, and Customer’s right and/or license (as applicable) to use the Cognitive Services is determined by its right and/or license to use and/or access the Service as provided in the Agreement. Customer may only use data in connection with the Cognitive Services for which Customer and/or its user has received all consents, authorizations, approvals, and/or agreements necessary to permit such use and/or processing under applicable law, regulation, or agreement(s). Customer shall not use the Cognitive Services to attempt to obtain any information that may violate third party rights or applicable laws or regulations, including classified information. Customer’s access and use of the Cognitive Services shall comply with all applicable laws and regulations. Customer shall be fully responsible and liable for its users’ use and access of the Cognitive Services.
Azure OpenAI Cognitive Service Use. Customer’s use of the Azure OpenAI Cognitive Service shall comply with the Azure OpenAI Code of Conduct(https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct?context=/azure/cognitive-services/openai/context/context). Customer shall only use the Azure OpenAI Cognitive Service to: (a) submit content to be summarized for pre-defined topics built into the Azure OpenAI Cognitive Service and cannot use the Azure OpenAI Cognitive Service as an open-ended summarizer (examples of such prohibited use include but are not limited to summarization of call center transcripts, technical reports, and product reviews); (b) analyze inputs using classification, sentiment analysis of text, or entity extraction (examples of such permitted use include but are not limited to analyzing product feedback sentiment, analyzing support calls and transcripts, and refining text-based search with embeddings; (c) search trusted source documents such as internal Customer documentation; (d) ask questions and receive answers from trusted source documents such as internal Customer documentation; or (e) code generation or transformation scenarios (examples of such permitted use include but are not limited to converting one programming language to another, generating docstrings for functions, or converting natural language to SQL).
Restrictions. Customer will not (and will not allow any third party to): (a) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code, algorithms, weights of the underlying models, or underlying ideas of any Cognitive Service; (b) use any Cognitive Service in attempt to train or develop another Model; or (c) represent that any output from the Cognitive Services was generated by a natural person when it was not.
Fees. Customer’s use of Cognitive Services shall accrue fees on the same terms as Customer’s use of the Service pursuant to the Agreement. Notwithstanding the foregoing, if the Agreement does not include separate fees for use of Cognitive Services, Palantir reserves the right to begin charging for use of any Cognitive Service upon providing Customer thirty (30) days’ notice to opt in or otherwise lose access to the Cognitive Services.
Suspension of Services. If Palantir reasonably determines that: (a) Customer’s access or use of any Model violates applicable law, regulation, or any material term of the Agreement, including this Addendum; (b) Palantir providing any part of any Cognitive Service would violate applicable (in force or forthcoming) law, regulation, or agreements; or (c) Palantir’s provision of any part of any Cognitive Service poses undue security risk to Palantir or its customers, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Cognitive Services. Palantir will notify Customer prior to exercising the foregoing right concurrent or prior to such exercise.
Disclaimer. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THE AGREEMENT, THE COGNITIVE SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR HEREBY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, SATISFACTORY QUALITY, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE COGNITIVE SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY QUALITY, RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE COGNITIVE SERVICES WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE FOR ANY DECISIONS OR ACTIONS CUSTOMER TAKES BASED UPON OR INFORMED BY OUTPUT FROM ANY COGNITIVE SERVICE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES PROVIDED IN THE COURSE OF DELIVERING ANY COGNITIVE SERVICES, INCLUDING MICROSOFT AZURE WITH RESPECT TO THE AZURE OPENAI COGNITIVE SERVICE (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, FAILURES, OR ANY OTHER GUARANTEES IN ANY SERVICE LEVEL AGREEMENT BETWEEN THE PARTIES), CUSTOMER’S INPUT TO THE COGNITIVE SERVICES, OR OUTPUT FROM THE COGNITIVE SERVICES (INCLUDING BUT NOT LIMITED TO COMPLETENESS, OR ACCURACY OF OUTPUT FROM COGNITIVE SERVICES, OR WHETHER THE OUTPUT FROM ANY COGNITIVE SERVICE INFRINGES OR VIOLATES ANY THIRD PARTY’S RIGHTS, INCLUDING INTELLECTUAL PROPERTY AND CONTRACTUAL RIGHTS).
Miscellaneous. This Addendum and any dispute or claim (including any non-contractual disputes or claims) arising out of or in connection with it, or its subject matter or formation, shall be governed by and construed in accordance with the laws that govern the Agreement and the dispute resolution provisions therein. If any provision of this Agreement shall be adjudged by any court of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach.
Use Case Restrictions
Effective January 23rd 2025
DownloadTable of Contents
PALANTIR USE CASE RESTRICTIONS
By using the Palantir Foundry Platform or Palantir’s AI Platform (“AIP”) (including any other technology made available by Palantir to Customer “Palantir Technology”, which term if otherwise defined in the Agreement shall for purposes of these Palantir Use Case Restrictions have the definition provided in the Agreement), Customer agrees to abide by the following use case restrictions. Any capitalized terms not defined in these Use Case Restrictions will have the meaning provided to them in the Palantir Terms of Service, or any applicable agreement governing Customer’s use of the Palantir Technology (the “Agreement”).
In accordance with the Agreement, you and the Customer you represent (including such Customer’s users) will not use the Palantir Technology for any Prohibited Use Case. Customer must obtain Palantir’s prior written approval to use or permit any of Customer’s users to use the Palantir Technology for any Use Cases Requiring Pre-Approval.
Prohibited Use Cases:
- Political parties, committees, campaigns, or organizations workflows
- Offensive cyber workflows
- Predictive policing efforts
- Influencing union organizing efforts
- Facial recognition for surveillance workflows
- Predatory targeting workflows
- Clinical judgment or decision making, medical advice, diagnostic or therapeutic purposes, and/or as a medical device or accessory (as defined by the applicable law).
Use Cases Requiring Pre-Approval:
- Any use of non-public government data
- Law enforcement workflows (including, but not limited to, investigative watchlists)
- Immigration enforcement, monitoring, or surveillance workflows
- Mobility collecting, monitoring, or tracking workflows
- Video analysis workflows (e.g., CCTV)
- Tobacco, controlled substances, or illicit drugs related workflows
- Gambling related workflows.
- Employee monitoring workflows
- Biometric identity verification workflows
- Social media data use
Effective April 25th 2024 to January 23rd 2025
DownloadTable of Contents
PALANTIR USE CASE RESTRICTIONS
By using the Palantir Foundry Platform or Palantir’s AI Platform (“AIP”) (including any other technology made available by Palantir to Customer “Palantir Technology”, which term if otherwise defined in the Agreement shall for purposes of these Palantir Use Case Restrictions have the definition provided in the Agreement), Customer agrees to abide by the following use case restrictions. Any capitalized terms not defined in these Use Case Restrictions will have the meaning provided to them in the Palantir Terms of Service, or any applicable agreement governing Customer’s use of the Palantir Technology (the “Agreement”).
In accordance with the Agreement, you and the Customer you represent (including such Customer’s users) will not use the Palantir Technology for any Prohibited Use Case. Customer must obtain Palantir’s prior written approval to use or permit any of Customer’s users to use the Palantir Technology for any Use Cases Requiring Pre-Approval.
Prohibited Use Cases:
- Political parties, committees, campaigns, or organizations workflows
- Offensive cyber workflows
- Predictive policing efforts
- Influencing union organizing efforts
- Facial recognition for surveillance workflows
- Predatory targeting workflows
- Clinical judgment or decision making, medical advice, diagnostic or therapeutic purposes, and/or as a medical device or accessory (as defined by the applicable law).
Use Cases Requiring Pre-Approval:
- Any use of government data
- Law enforcement workflows (including, but not limited to, investigative watchlists)
- Immigration enforcement, monitoring, or surveillance workflows
- Mobility collecting, monitoring, or tracking workflows
- Video analysis workflows (e.g., CCTV)
- Tobacco, controlled substances, or illicit drugs related workflows
- Gambling related workflows.
- Employee monitoring workflows
- Biometric identity verification workflows
- Social media data use
Effective February 1st 2024 to April 25th 2024
DownloadTable of Contents
PALANTIR USE CASE RESTRICTIONS
By using the Palantir Foundry Platform or Palantir’s AI Platform (“AIP”) (including any other technology made available by Palantir to Customer “Palantir Technology”, which term if otherwise defined in the Agreement shall for purposes of these Palantir Use Case Restrictions have the definition provided in the Agreement), Customer agrees to abide by the following use case restrictions. Any capitalized terms not defined in these Use Case Restrictions will have the meaning provided to them in the Palantir Terms of Service, or any applicable agreement governing Customer’s use of the Palantir Technology (the “Agreement”).
In accordance with the Agreement, you and the Customer you represent (including such Customer’s users) will not use the Palantir Technology for any Prohibited Use Case. Customer must obtain Palantir’s prior written approval to use or permit any of Customer’s users to use the Palantir Technology for any Use Cases Requiring Pre-Approval.
Prohibited Use Cases:
- Political parties, committees, campaigns, or organizations workflows
- Offensive cyber workflows
- Predictive policing efforts
- Influencing union organizing efforts
- Facial recognition for surveillance workflows
- Predatory targeting workflows
- Clinical judgment or decision making, medical advice, diagnostic or therapeutic purposes, and/or as a medical device or accessory (as defined by the applicable law).
Use Cases Requiring Pre-Approval:
- Law enforcement workflows (including, but not limited to, investigative watchlists)
- Immigration enforcement, monitoring, or surveillance workflows
- Mobility collecting, monitoring, or tracking workflows
- Video analysis workflows (e.g., CCTV)
- Tobacco, controlled substances, or illicit drugs related workflows
- Gambling related workflows.
- Employee monitoring workflows
- Biometric identity verification workflows
- Social media data use
Terms of Service (Self Service)
Effective May 24th 2024
DownloadTable of Contents
PALANTIR TERMS OF SERVICE
COUNTRY-SPECIFIC ADDENDUM
Effective April 22nd 2024 to May 24th 2024
DownloadTable of Contents
PALANTIR TERMS OF SERVICE
COUNTRY-SPECIFIC ADDENDUM
Effective December 15th 2023 to April 22nd 2024
DownloadTable of Contents
PALANTIR TERMS OF SERVICE
COUNTRY-SPECIFIC ADDENDUM
Effective September 22nd 2023 to December 15th 2023
DownloadTable of Contents
Effective May 24th 2023 to September 22nd 2023
DownloadTable of Contents
Effective May 10th 2023 to May 24th 2023
DownloadTable of Contents
Effective March 2nd 2023 to May 10th 2023
DownloadTable of Contents
Data Protection Addendum (Enterprise Self Service)
Effective January 14th 2025
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information” or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure, and AI services (Microsoft Azure) | One Microsoft Way, Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway, Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way, Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
X.AI LLC | AI services | 1450 Page Mill Rd. Palo Alto, CA 94034, United States | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
29 August 2023 | Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
12 December 2023 | General update to align this DPA with our global DPA terms, including edits to the Data Subject Rights and Data Transfers sections. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
14 January 2025 | Addition of X.AI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional Subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
- [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority. - The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
Effective May 2nd 2024 to January 14th 2025
DownloadTable of Contents
PALANTIR DATA PROTECTION ADDENDUM (“DPA”)
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information” or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure, and AI services (Microsoft Azure) | One Microsoft Way, Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway, Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way, Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
29 August 2023 | Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
12 December 2023 | General update to align this DPA with our global DPA terms, including edits to the Data Subject Rights and Data Transfers sections. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
- [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority. - The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
Effective January 11th 2024 to May 2nd 2024
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information” or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure, and AI services (Microsoft Azure) | One Microsoft Way, Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway, Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way, Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
29 August 2023 | Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
12 December 2023 | General update to align this DPA with our global DPA terms, including edits to the Data Subject Rights and Data Transfers sections. This update is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
Effective November 20th 2023 to January 11th 2024
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting Country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means in respect of Customer, any of Customer’s affiliate(s) from time to time which are subject to Data Protection Laws and are permitted to use the Services pursuant to the Terms of Service between Customer and Palantir, but are not a party to the Terms of Service and shall include, without being limited to, all entities listed in Exhibit A, Part II, of the present DPA, and, in respect of Palantir, any Palantir’s affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit C of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “business” under applicable Data Protection Laws;
- “Country” means a country, state, province, territory or economic union that have implemented applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized use, disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means, an independent public authority responsible for monitoring the application of Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement;
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates;
- “Europe” means the European Union, the European Economic Area, Switzerland and the United Kingdom (“UK”) and “European” shall have the equivalent related meaning;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “GDPR” means, as applicable, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“EU GDPR”) and/or the EU GDPR as implemented or amended in the United Kingdom (“UK GDPR”);
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated as personal data, personal information, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the term “service provider” and any equivalent or similar terms that address the same responsibilities under applicable Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a Country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) in the absence of the Standard Contractual Clauses to be established under Section 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration;
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising;
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting Country from time to time to legitimise exports of Personal Data from that Country, including the EU SCCs in relation to exports of personal data from the EEA (and where more than one set of such clauses has been approved, those that most closely approximate the EU SCCs); or (b) where the applicable exporting Country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs, in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular Country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers;
- “Sub-Processor” means a provider of third party Services, or Palantir's Affiliate engaged by or on behalf of Palantir to Process Customer Personal Data in connection with the Agreement; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under Data Protection Laws.
Authorized Third-Party Sub-Processors | ||||
Sub-Processor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting, infrastructure, AI services and alerting and encrypted notification | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting, infrastructure and AI services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and/or other Microsoft Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting, infrastructure and AI services (Google Cloud Platform) | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer) | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI services can be the United States and other regions as they become available. | Standard Contractual Clauses |
29 August 2023 | Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective or Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
Effective October 30th 2023 to November 20th 2023
DownloadTable of Contents
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting Country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means in respect of Customer, any of Customer’s affiliate(s) from time to time which are subject to Data Protection Laws and are permitted to use the Services pursuant to the Terms of Service between Customer and Palantir, but are not a party to the Terms of Service and shall include, without being limited to, all entities listed in Exhibit A, Part II, of the present DPA, and, in respect of Palantir, any Palantir’s affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit C of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “business” under applicable Data Protection Laws;
- “Country” means a country, state, province, territory or economic union that have implemented applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Palantir in connection with the Agreement;
- “Data Incident” means any breach of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized use, disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means, an independent public authority responsible for monitoring the application of Data Protection Laws;
- “Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement;
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates;
- “Europe” means the European Union, the European Economic Area, Switzerland and the United Kingdom (“UK”) and “European” shall have the equivalent related meaning;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “GDPR” means, as applicable, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“EU GDPR”) and/or the EU GDPR as implemented or amended in the United Kingdom (“UK GDPR”);
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated as personal data, personal information, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
- “Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the term “service provider” and any equivalent or similar terms that address the same responsibilities under applicable Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a Country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) in the absence of the Standard Contractual Clauses to be established under Section 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration;
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising;
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting Country from time to time to legitimise exports of Personal Data from that Country, including the EU SCCs in relation to exports of personal data from the EEA (and where more than one set of such clauses has been approved, those that most closely approximate the EU SCCs); or (b) where the applicable exporting Country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs, in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular Country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers;
- “Sub-Processor” means a provider of third party Services, or Palantir's Affiliate engaged by or on behalf of Palantir to Process Customer Personal Data in connection with the Agreement; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under Data Protection Laws.
Authorized Third-Party Sub-Processors | ||||
Sub-Processor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting, infrastructure, AI services and alerting and encrypted notification | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting, infrastructure and AI services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI service is East US, South Central US, West Europe and/or other Microsoft Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting, infrastructure and AI services (Google Cloud Platform) | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer) | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | United States | Standard Contractual Clauses |
29 August 2023 | Addition of alerting and encrypted notification services for the purpose of using AWS. This update is considered effective or Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |
30 October 2023 | Addition of OpenAI LLC as a Third-Party Subprocessor. Authorization for subprocessing by this additional subprocessor is considered effective for Agreements entered on or after the date of this update, unless subject to separate written agreement between Palantir and Customer. |