Contracts
Terms of Service (AIP Now)
Effective May 23rd 2025
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR PLATFORM (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR PLATFORM.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY, THE NETHERLANDS, SPAIN, AUSTRIA, SWITZERLAND, FRANCE, OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF), CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY, THE NETHERLANDS, SPAIN, AUSTRIA, SWITZERLAND, FRANCE, OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY, THE NETHERLANDS, SPAIN, AUSTRIA, SWITZERLAND, FRANCE, OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”) .
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form (or document expressly incorporating this Agreement by reference) filled out and/or executed by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” unless specified expressly otherwise in an Order Submission Form means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States, Canada, the Federal Republic of Germany, the Netherlands, Spain, Austria, Switzerland, France, or the Republic of India; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Platform” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or such platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal (and/or, if applicable, personal) business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Platform or to any extensions or enhancements to the Palantir Platform developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Platform and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Platform and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Platform is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts.
(a) If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than five (5) accounts to access the Service (“Accounts”) for its (1) employees, (2) contractors, (3) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder, and/or (4) Customer's clients (the "Authorized Third Parties") subject to the additional terms and conditions set forth in Section 3.1 (a)(i)-(vi) herein (collectively, “Users”).
(i) Customer may grant access to the Service to an Authorized Third Party solely for the purpose of using services provided by Customer to the Authorized Third Party in connection with Customer's business purposes; for the avoidance of doubt, an Authorized Third Party may not access the Service for its own business purposes independent of services provided by Customer.
(ii) Authorized Third Party access to the Service shall be strictly limited to Customer front-end applications built by Customer using the Palantir Platform and Authorized Third Party is prohibited from directly ingesting data into the Palantir Platform, provided that Customer may ingest Authorized Third Party's data into the Palantir Platform subject to (i) above.
(iii) Authorized Third Party access shall be governed by and subject to all restrictions and obligations in the Agreement, and Customer shall be responsible and liable for any breach or violation thereof by an Authorized Third Party. Customer may provide an Authorized Third Party with access subject to the unaltered access terms separately provided to Customer by Palantir.
(iv) Usage by an Authorized Third Party shall be subject to the fees set forth herein.
(v) Customer is responsible for providing support to Authorized Third Parties regarding front-end applications built by Customer, and Customer shall maintain a support policy stating that Authorized Third Party shall submit any support inquiries to Customer, provided that Customer may escalate to Palantir the Palantir Platform issues identified by an Authorized Third Party that are unresolvable by Customer and Palantir will provide reasonable support to Customer for such escalations during Palantir's normal business hours in the region(s) designated by Palantir.
(vi) Customer shall not, and shall not permit any Authorized Third Party to, access the Palantir Platform from any country set forth on Palantir's prohibited country list as made available by Palantir to Customer (each a "Prohibited Country").
(b) If Customer is a natural person, Customer may provision no more than five (5) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Platform and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use, access, evaluate, or view the Palantir Platform for the purpose of building or offering a product or service similar to or competitive with the Palantir Platform.
4.3 Export Controls. The Palantir Platform may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Platform in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Platform.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Platform, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Platform any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Platform.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Platform, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Platform, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Platform (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Platform, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Platform (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Platform in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Platform (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, access, evaluate, or view the Palantir Platform for the purpose of building or offering a product or service similar to or competitive with the Palantir Platform; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Platform and any associated media; (p) use the Website or Palantir Platform to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Platform (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice . Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect until terminated as provided herein (the "Term"); provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer sixty (60) days' prior notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Platform shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Platform, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Platform.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Platform in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Platform is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Platform; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Platform that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Platform is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Platform is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Platform, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term, (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14. Agreement Updates.
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Platform within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Platform constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Platform (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
AUSTRIA
1. Acceptable Use. Section 4.1 of the Terms of Service shall be replaced with the following:
“4.1 Applicable Laws. Customer shall ensure that Customer’s access and use of the Service, will not violate applicable laws. In case either of the Parties is a resident of Austria as defined by applicable foreign trade laws of the European Union and Austria, this obligation applies only with regard to laws and regulations enacted by the European Union or Austria and to export control laws and regulations other than those enacted by the European Union or Austria under the condition that economic sanctions have also been imposed by the Security Council of the United Nations, the Council of the European Union or Austria.”
2. Delivery. Section 7 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“7. Delivery; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.”
3. Termination for Convenience. The final sentence of Section 8.1 is hereby deleted in its entirety, and replaced with the following:
“Either Party may terminate this Agreement for convenience, for any or no reason, at any time, upon providing the other Party prior written notice of such termination; for the foregoing termination right to be effective, if the terminating Party is Customer, Customer must provide fourteen (14) days’ prior written notice by emailing such notice to legalnotices@palantir.com, and if the terminating Party is Palantir, Palantir must provide sixty (60) days’ prior written notice.”
4. Customer Indemnification. Section 9.2 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“9.2 Customer Indemnification. To the maximum extent permitted by applicable European Union and Austrian law, Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.”
5. Palantir Warranty and Disclaimer. Section 10.1 of the Terms of Service shall be replaced with the following, and Section 10.2 of the Terms of Service shall renumbered as Section 10.7:
“10. Palantir Warranty.
10.1 Palantir shall ensure the functional and operational performance of the Service in accordance with the terms of this Agreement. In particular, (a) the Service will be provided in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner during the Term. Subject to the subsequent clauses, Customer’s rights to make a warranty claim in case of faults shall be as if the statutory regulations on warranty under applicable laws of the European Union or Austria apply.
10.2 This warranty shall not apply (i) in the case of only insignificant deviation from the agreed quality or only insignificant impairment of the usability of the Service; (ii) if Customer does not report a defect immediately and Palantir was unable to remedy the defect as a result of the failure to report the defect immediately; or (iii) if Customer is aware of the defect at the time of conclusion of the contract and has not reserved his rights.
10.3 Further, this warranty shall not apply to the extent (i) a breach of the warranty is caused by any incorrect use of the Service by Customer, (ii) such breach is caused by Customer’s misuse or unauthorized modification of the Service, (iii) such breach is caused by any use of the Service contrary to any conditions of use provided for the Service and specified in the applicable Documentation, (iv) such breach is caused by any violation of Section 4 (Acceptable Use), and (v) to the extent such breach is caused by any use of Customer-selected hardware or software used in connection with the Service which is not suitable for the use with the Service.
10.4 Insofar as a defect has been reported by the Customer and the Customer's warranty claims are not excluded, Palantir is obliged to remedy the defect within a reasonable period of time - through measures of its own choice. Customer shall give Palantir reasonable time and opportunity to remedy the defect. Palantir's employees and agents shall be granted free access to Customer's systems for this purpose, insofar as this is necessary.
10.5 In the event of impossibility or failure to remedy the defect, culpable or unreasonable delay or serious and final refusal to remedy the defect by Palantir or in other cases in which the remedy of the defect would be unreasonable for the Customer, the Customer shall in particular be entitled to rights and remedies as afforded under applicable laws of the European Union or Austria, including any afforded reductions of fees owed under the foregoing applicable laws.
10.6 In case Palantir has, in the event of a breach of the warranty, not been able to remedy the defect within a reasonable period of time as set out above, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, a pro-rated refund of any fees pre-paid for the Services after the effective date of termination. The Customer’s right to claim damages in accordance with this Agreement remains unaffected.“
6. Limitations of Liability. Section 12 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“12. Limitations of Liability. In all cases of contractual and non-contractual liability, Palantir’s liability shall be limited to damages or replacement of futile expenses only to the following extent:
12.1 In the event of intent or gross negligence, Palantir’s liability shall be in line with and not exceed the limits permitted according to the statutory provisions. The same shall apply in the event of culpably caused damages resulting from an injury to life, body or health, in the event of damages resulting from a guarantee as to quality (“Beschaffenheitsgarantie”), as well as in the event of defaults concealed fraudulently (“arglistig verschwiegende Mängel”).
12.2 In an event of slight negligence, Palantir’s liability shall be limited to breaches of a contractual core duty. A contractual core duty is an obligation whose fulfilment makes the implementation of an agreement possible in the first place and on the fulfilment of which the contractual partner may therefore generally rely. Liability in case of slightly negligent infringement of any such contractual core duty shall be limited to the amount of damage which was foreseeable at the time of conclusion of the agreement and typical taking into account the nature of the contract (“vorhersehbarer und vertragstypischer Schaden”).
12.3 The above liability restrictions shall also apply in favour of the representatives, employees and vicarious agents of Palantir.
12.4 The above liability restrictions shall not apply to applicable mandatory statutory liability provisions which cannot be derogated from by agreement.
12.5 Any liability of Palantir for lost data due to slight negligence shall be limited to compensatory damages in the amount necessary for restoration of the data using electronic backup media. The obligation of Customer to back-up data on a regular basis according to the state of the art shall remain unaffected thereby.
12.6 All other liability shall be excluded. In the event that any portion of this Section 12 is deemed invalid or unenforceable by a tribunal or government organ of competent jurisdiction, that provision shall be limited or eliminated to the minimum extent necessary so that this Section 12 shall otherwise remain in full force and effect and be enforceable.”
7. Dispute Resolution. Section 13 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY RESOLVED AS FOLLOWS. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF NEW YORK (PROVIDED, IF SUCH CHOICE OF LAW IS DEEMED INVALID, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF AUSTRIA), WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF. ALL DISPUTES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT WILL BE RESOLVED BY A COURT OF AUSTRIA OF COMPETENT JURISDICTION OVER CUSTOMER’S PLACE OF DOMICILE IN AUSTRIA (AND IF CUSTOMER DOES NOT HAVE DOMICILE IN SPAIN, THE COURTS OF VIENNA SHALL BE COMPETENT), WITH PROCEEDINGS IN ENGLISH.”
FRANCE
1. Local Language Terms. A copy of these Terms of Service translated into French is available at: https://palantir.pactsafe.io/aip-now-6493.html#fra-aip-now-tos-052325 (the “French Terms”). For the avoidance of doubt, in the event of a conflict or inconsistency between the foregoing French Terms and this English version of the Terms of Service, the French version shall govern and control. A copy of the DPA translated into French is available at https://palantir.pactsafe.io/aip-now-6493.html#fra-aip-now-dpa-252305 (the “French DPA”). For the avoidance of doubt, in the event of a conflict or inconsistency between the foregoing French DPA and the English version of the DPA, the English version of the DPA shall govern and control.
2. Termination for Convenience. The final sentence of Section 8.1 is hereby deleted in its entirety, and replaced with the following:
"Either Party may terminate this Agreement for convenience, for any or no reason, at any time, upon providing the other Party prior written notice of such termination; for the foregoing termination right to be effective, if the terminating Party is Customer, Customer must provide fourteen (14) days’ prior written notice, and if the terminating Party is Palantir, Palantir must provide sixty (60) days’ prior written notice.”
3. Limitations of Liability. Section 12 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
"12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT FOR ANY STATUTORY WARRANTY CLAIMS AFFORDED TO CONSUMERS UNDER APPLICABLE FRENCH LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR ANY STATUTORY WARRANTY CLAIMS AFFORDED TO CONSUMERS UNDER APPLICABLE FRENCH LAW, AND EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR ANY STATUTORY WARRANTY CLAIMS AFFORDED TO CONSUMERS UNDER APPLICABLE FRENCH LAW, AND EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. Section 13 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
"13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON’S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). IF CUSTOMER IS LOCATED IN FRANCE, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF FRANCE, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ANY DISPUTE, CONTROVERSY OR CLAIM ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, INCLUDING THE VALIDITY, INVALIDITY, BREACH OR TERMINATION THEREOF, SHALL, AT THE DISCRETION OF CUSTOMER, BE SETTLED BY STATE COURT PROCEEDINGS AT THE CUSTOMER'S DOMICILE OR PLACE OF HABITUAL RESIDENCE, WITH PROCEEDINGS CONDUCTED IN ENGLISH.”
5. Agreement Updates. Section 14.1 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
"14.1. Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of changes to this Agreement sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective sixty (60) days after Palantir provides such notice unless Customer gives notice to Palantir to terminate the Agreement. In such event, the termination shall take effect sixty (60) days after Palantir's notice to Customer. Customer’s continued use of the Palantir Platform within sixty (60) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Platform constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Platform (or any part thereof).”
GERMANY
1. Acceptable Use. Section 4.1 of the Terms of Service shall be replaced with the following:
“4.1 Applicable Laws. Customer shall ensure that Customer’s access and use of the Service, will not violate applicable laws of the United States or other laws applicable to Customer. In case either of the Parties is a German resident as defined by German foreign trade law, this obligation applies only with regard to export control laws and regulations enacted by the European Union or the Federal Republic of Germany and to export control laws and regulations other than those enacted by the European Union or the Federal Republic of Germany under the condition that economic sanctions have also been imposed by the Security Council of the United Nations, the Council of the European Union or the Federal Republic of Germany.”
2. Palantir Warranty and Disclaimer. Section 10.1 of the Terms of Service shall be replaced with the following, and Section 10.2 of the Terms of Service shall renumbered as Section 10.7:
“10. Palantir Warranty.
10.1 Palantir shall ensure the functional and operational performance of the Service in accordance with the terms of this Agreement. In particular, (a) the Service will be provided in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner during the Term. Subject to the subsequent clauses, Customer’s rights to make a warranty claim in case of faults shall be as if the statutory regulations on warranty (in particular, warranty rules of tenancy law under German law) apply.
10.2 This warranty shall not apply (i) in the case of only insignificant deviation from the agreed quality or only insignificant impairment of the usability of the Service; (ii) if Customer does not report a defect immediately and Palantir was unable to remedy the defect as a result of the failure to report the defect immediately; or (iii) if Customer is aware of the defect at the time of conclusion of the contract and has not reserved his rights.
10.3 Further, this warranty shall not apply to the extent (i) a breach of the warranty is caused by any incorrect use of the Service by Customer, (ii) such breach is caused by Customer’s misuse or unauthorized modification of the Service, (iii) such breach is caused by any use of the Service contrary to any conditions of use provided for the Service and specified in the applicable Documentation, (iv) such breach is caused by any violation of Section 4 (Acceptable Use), and (v) to the extent such breach is caused by any use of Customer-selected hardware or software used in connection with the Service which is not suitable for the use with the Service.
10.4 Insofar as a defect has been reported by the Customer and the Customer's warranty claims are not excluded, Palantir is obliged to remedy the defect within a reasonable period of time - through measures of its own choice. Customer shall give Palantir reasonable time and opportunity to remedy the defect. Palantir's employees and agents shall be granted free access to Customer's systems for this purpose, insofar as this is necessary.
10.5 In the event of impossibility or failure to remedy the defect, culpable or unreasonable delay or serious and final refusal to remedy the defect by Palantir or in other cases in which the remedy of the defect would be unreasonable for the Customer, the Customer shall in particular be entitled to reduce the fee owed in accordance with the extent of the impairment (“Minderung”). The user is not entitled to assert a claim for reduction by independently deducting the amount of the reduction from the fee to be paid on an ongoing basis; the user's right under the law of enrichment (“bereicherungsrechtlicher Anspruch”) to reclaim the overpaid part of the fee remains unaffected by this.
10.6 In case Palantir has, in the event of a breach of the warranty, not been able to remedy the defect within a reasonable period of time as set out above, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, a pro-rated refund of any fees pre-paid for the Services after the effective date of termination. The Customer’s right to claim damages in accordance with this Agreement remains unaffected.“
3. Limitations of Liability. Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. In all cases of contractual and non-contractual liability, Palantir’s liability shall be limited to damages or replacement of futile expenses only to the following extent:
12.1 In the event of intent or gross negligence, Palantir’s liability shall be in line with and not exceed the limits permitted according to the statutory provisions. The same shall apply in the event of culpably caused damages resulting from an injury to life, body or health, in the event of damages resulting from a guarantee as to quality (“Beschaffenheitsgarantie”), as well as in the event of defaults concealed fraudulently (“arglistig verschwiegende Mängel”).
12.2 In an event of slight negligence, Palantir’s liability shall be limited to breaches of a contractual core duty. A contractual core duty is an obligation whose fulfilment makes the implementation of an agreement possible in the first place and on the fulfilment of which the contractual partner may therefore generally rely. Liability in case of slightly negligent infringement of any such contractual core duty shall be limited to the amount of damage which was foreseeable at the time of conclusion of the agreement and typical taking into account the nature of the contract (“vorhersehbarer und vertragstypischer Schaden”).
12.3 The above liability restrictions shall also apply in favour of the representatives, employees and vicarious agents of Palantir.
12.4 The above liability restrictions shall not apply to applicable mandatory statutory liability provisions which cannot be derogated from by agreement.
12.5 Any liability of Palantir for lost data shall be limited to compensatory damages in the amount necessary for restoration of the data using electronic backup media. The obligation of Customer to back-up data on a regular basis according to the state of the art shall remain unaffected thereby.
12.6 All other liability shall be excluded.”
NETHERLANDS
1. Termination for Convenience. The final sentence of Section 8.1 is hereby deleted in its entirety, and replaced with the following:
“Either Party may terminate this Agreement for convenience, for any or no reason, at any time, upon providing the other Party prior written notice of such termination; for the foregoing termination right to be effective, if the terminating Party is Customer, Customer must provide fourteen (14) days’ prior written notice, and if the terminating Party is Palantir, Palantir must provide sixty (60) days’ prior written notice.”
2. Warranty. The final sentence of Section 10.1 of the Terms of Service is hereby deleted in its entirety.
3. Limitations of Liability. Section 12 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, EXCEPT FOR EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL INTENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT, EITHER PARTY’S GROSS NEGLIGENCE OR WILFUL INTENT, AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT, EITHER PARTY’S GROSS NEGLIGENCE OR WILFUL INTENT, AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. Section 13 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY RESOLVED AS FOLLOWS. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE NETHERLANDS, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF. ALL DISPUTES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT WILL BE RESOLVED BY A COURT OF THE NETHERLANDS WITH COMPETENT JURISDICTION, WITH PROCEEDINGS IN ENGLISH.”
SPAIN
1. Local Language Terms. A copy of these Terms of Service translated into Spanish is available at: https://palantir.pactsafe.io/aip-now-6493.html#spa-aip-now-tos-251605 (the “Spanish Terms”). For the avoidance of doubt, in the event of a conflict or inconsistency between the foregoing Spanish Terms and this English version of the Terms of Service, the English version shall govern and control. A copy of the DPA translated into Spanish is available at https://palantir.pactsafe.io/aip-now-6493.html#spa-aip-now-dpa-051625 (the “Spanish DPA”). For the avoidance of doubt, in the event of a conflict or inconsistency between the foregoing Spanish DPA and the English version of the DPA, the English version of the DPA shall govern and control.
2. Dispute Resolution. Section 13 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY RESOLVED AS FOLLOWS. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF SPAIN, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF. ALL DISPUTES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT WILL BE RESOLVED BY A COURT OF SPAIN OF COMPETENT JURISDICTION OVER CUSTOMER’S PLACE OF DOMICILE IN SPAIN (AND IF CUSTOMER DOES NOT HAVE DOMICILE IN SPAIN, THE COURTS OF MADRID SHALL BE COMPETENT), WITH PROCEEDINGS IN ENGLISH.”
SWITZERLAND
1. Applicable Law. Section 4.1 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
"4.1 Applicable Laws. Customer shall ensure that Customer’s access and use of the Services and the Website will not violate applicable laws of the United States or other laws applicable to Customer. In case that either of the Parties is a Swiss resident as defined by Swiss law, this obligation only applies with regard to applicable export-control legislation and regulation enacted by the competent Swiss federal authorities, and, where applicable, under the condition that the United Nations Organization (i.e. UN-Security Council), the Organization for Security and Cooperation in Europe also imposed respective legislation and measures. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.”
2. Palantir Warranty. Section 10.1 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
"10.1 Palantir Warranty. Palantir warrants that during the applicable Order Term, (a) the Service will be provided substantially in accordance with the applicable Documentation and(b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may execute applicable compulsory warranty rights, or give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.”
3. Limitation of Liability. Section 12 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
"12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND SWISS FRANCS (CHF 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND SWISS FRANCS (CHF 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY. NOTWITHSTANDING THE FOREGOING AND ANY OTHER PROVISION OF THIS AGREEMENT, LIMITATION OF LIABILITY IS EXCLUDEDIN THE EVENT OF INTENT OR GROSS NEGLIGENCE, CULPABLY CAUSED DAMAGES RESULTING FROM AN INJURY TO LIFE OR BODY AS WELL AS IN CASE OF DEFAULTS CONCEALED FRAUDULENTY ("ARGLISTIG VERSCHWIEGENE MÄNGEL") AND NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE SUCH LIABILITY.”
4. Dispute Resolution. Section 13 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
"13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON’S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). IF CUSTOMER IS LOCATED IN SWITZERLAND, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF SWITZERLAND, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ANY DISPUTE, CONTROVERSY OR CLAIM ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, INCLUDING THE VALIDITY, INVALIDITY, BREACH OR TERMINATION THEREOF, SHALL, AT THE DISCRETION OF CUSTOMER, BE SETTLED BY STATE COURT PROCEEDINGS AT THE CUSTOMER'S DOMICILE OR PLACE OF HABITUAL RESIDENCE, OR BY ARBITRATION IN ACCORDANCE WITH THE SWISS RULES OF INTERNATIONAL ARBITRATION OF THE SWISS ARBITRATION CENTRE IN FORCE ON THE DATE ON WHICH THE NOTICE OF ARBITRATION IS SUBMITTED IN ACCORDANCE WITH THOSE RULES. THE SEAT OF THE ARBITRATION SHALL BE ZURICH, SWITZERLAND, UNLESS AGREED ON ANOTHER LOCATION, AND THE ARBITRATION PROCEEDINGS SHALL BE CONDUCTED IN ENGLISH.”
5. Agreement Updates. Section 14.1 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
"14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of changes to this Agreement sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective sixty (60) days after Palantir provides such notice unless Customer gives notice to Palantir to terminate the Agreement. In such event, the termination shall take effect sixty (60) days after Palantir's notice to Customer. Customer’s continued use of the Palantir Platform within sixty (60) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Platform constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Platform (or any part thereof).”
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective May 16th 2025 to May 23rd 2025
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR PLATFORM (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR PLATFORM.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY, THE NETHERLANDS, SPAIN, AUSTRIA, OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF), CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY, THE NETHERLANDS, SPAIN, AUSTRIA, OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY, THE NETHERLANDS, SPAIN, AUSTRIA, OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”) .
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form (or document expressly incorporating this Agreement by reference) filled out and/or executed by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” unless specified expressly otherwise in an Order Submission Form means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States, Canada, the Federal Republic of Germany, the Netherlands, Spain, Austria, or the Republic of India; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Platform” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or such platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal (and/or, if applicable, personal) business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Platform or to any extensions or enhancements to the Palantir Platform developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Platform and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Platform and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Platform is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts.
(a) If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than five (5) accounts to access the Service (“Accounts”) for its (1) employees, (2) contractors, (3) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder, and/or (4) Customer's clients (the "Authorized Third Parties") subject to the additional terms and conditions set forth in Section 3.1 (a)(i)-(vi) herein (collectively, “Users”).
(i) Customer may grant access to the Service to an Authorized Third Party solely for the purpose of using services provided by Customer to the Authorized Third Party in connection with Customer's business purposes; for the avoidance of doubt, an Authorized Third Party may not access the Service for its own business purposes independent of services provided by Customer.
(ii) Authorized Third Party access to the Service shall be strictly limited to Customer front-end applications built by Customer using the Palantir Platform and Authorized Third Party is prohibited from directly ingesting data into the Palantir Platform, provided that Customer may ingest Authorized Third Party's data into the Palantir Platform subject to (i) above.
(iii) Authorized Third Party access shall be governed by and subject to all restrictions and obligations in the Agreement, and Customer shall be responsible and liable for any breach or violation thereof by an Authorized Third Party. Customer may provide an Authorized Third Party with access subject to the unaltered access terms separately provided to Customer by Palantir.
(iv) Usage by an Authorized Third Party shall be subject to the fees set forth herein.
(v) Customer is responsible for providing support to Authorized Third Parties regarding front-end applications built by Customer, and Customer shall maintain a support policy stating that Authorized Third Party shall submit any support inquiries to Customer, provided that Customer may escalate to Palantir the Palantir Platform issues identified by an Authorized Third Party that are unresolvable by Customer and Palantir will provide reasonable support to Customer for such escalations during Palantir's normal business hours in the region(s) designated by Palantir.
(vi) Customer shall not, and shall not permit any Authorized Third Party to, access the Palantir Platform from any country set forth on Palantir's prohibited country list as made available by Palantir to Customer (each a "Prohibited Country").
(b) If Customer is a natural person, Customer may provision no more than five (5) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Platform and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use, access, evaluate, or view the Palantir Platform for the purpose of building or offering a product or service similar to or competitive with the Palantir Platform.
4.3 Export Controls. The Palantir Platform may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Platform in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Platform.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Platform, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Platform any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Platform.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Platform, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Platform, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Platform (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Platform, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Platform (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Platform in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Platform (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, access, evaluate, or view the Palantir Platform for the purpose of building or offering a product or service similar to or competitive with the Palantir Platform; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Platform and any associated media; (p) use the Website or Palantir Platform to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Platform (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice . Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect until terminated as provided herein (the "Term"); provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer sixty (60) days' prior notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Platform shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Platform, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Platform.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Platform in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Platform is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Platform; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Platform that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Platform is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Platform is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Platform, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term, (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14. Agreement Updates.
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Platform within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Platform constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Platform (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
AUSTRIA
1. Acceptable Use. Section 4.1 of the Terms of Service shall be replaced with the following:
“4.1 Applicable Laws. Customer shall ensure that Customer’s access and use of the Service, will not violate applicable laws. In case either of the Parties is a resident of Austria as defined by applicable foreign trade laws of the European Union and Austria, this obligation applies only with regard to laws and regulations enacted by the European Union or Austria and to export control laws and regulations other than those enacted by the European Union or Austria under the condition that economic sanctions have also been imposed by the Security Council of the United Nations, the Council of the European Union or Austria.”
2. Delivery. Section 7 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“7. Delivery; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.”
3. Termination for Convenience. The final sentence of Section 8.1 is hereby deleted in its entirety, and replaced with the following:
“Either Party may terminate this Agreement for convenience, for any or no reason, at any time, upon providing the other Party prior written notice of such termination; for the foregoing termination right to be effective, if the terminating Party is Customer, Customer must provide fourteen (14) days’ prior written notice by emailing such notice to legalnotices@palantir.com, and if the terminating Party is Palantir, Palantir must provide sixty (60) days’ prior written notice.”
4. Customer Indemnification. Section 9.2 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“9.2 Customer Indemnification. To the maximum extent permitted by applicable European Union and Austrian law, Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.”
5. Palantir Warranty and Disclaimer. Section 10.1 of the Terms of Service shall be replaced with the following, and Section 10.2 of the Terms of Service shall renumbered as Section 10.7:
“10. Palantir Warranty.
10.1 Palantir shall ensure the functional and operational performance of the Service in accordance with the terms of this Agreement. In particular, (a) the Service will be provided in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner during the Term. Subject to the subsequent clauses, Customer’s rights to make a warranty claim in case of faults shall be as if the statutory regulations on warranty under applicable laws of the European Union or Austria apply.
10.2 This warranty shall not apply (i) in the case of only insignificant deviation from the agreed quality or only insignificant impairment of the usability of the Service; (ii) if Customer does not report a defect immediately and Palantir was unable to remedy the defect as a result of the failure to report the defect immediately; or (iii) if Customer is aware of the defect at the time of conclusion of the contract and has not reserved his rights.
10.3 Further, this warranty shall not apply to the extent (i) a breach of the warranty is caused by any incorrect use of the Service by Customer, (ii) such breach is caused by Customer’s misuse or unauthorized modification of the Service, (iii) such breach is caused by any use of the Service contrary to any conditions of use provided for the Service and specified in the applicable Documentation, (iv) such breach is caused by any violation of Section 4 (Acceptable Use), and (v) to the extent such breach is caused by any use of Customer-selected hardware or software used in connection with the Service which is not suitable for the use with the Service.
10.4 Insofar as a defect has been reported by the Customer and the Customer's warranty claims are not excluded, Palantir is obliged to remedy the defect within a reasonable period of time - through measures of its own choice. Customer shall give Palantir reasonable time and opportunity to remedy the defect. Palantir's employees and agents shall be granted free access to Customer's systems for this purpose, insofar as this is necessary.
10.5 In the event of impossibility or failure to remedy the defect, culpable or unreasonable delay or serious and final refusal to remedy the defect by Palantir or in other cases in which the remedy of the defect would be unreasonable for the Customer, the Customer shall in particular be entitled to rights and remedies as afforded under applicable laws of the European Union or Austria, including any afforded reductions of fees owed under the foregoing applicable laws.
10.6 In case Palantir has, in the event of a breach of the warranty, not been able to remedy the defect within a reasonable period of time as set out above, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, a pro-rated refund of any fees pre-paid for the Services after the effective date of termination. The Customer’s right to claim damages in accordance with this Agreement remains unaffected.“
6. Limitations of Liability. Section 12 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“12. Limitations of Liability. In all cases of contractual and non-contractual liability, Palantir’s liability shall be limited to damages or replacement of futile expenses only to the following extent:
12.1 In the event of intent or gross negligence, Palantir’s liability shall be in line with and not exceed the limits permitted according to the statutory provisions. The same shall apply in the event of culpably caused damages resulting from an injury to life, body or health, in the event of damages resulting from a guarantee as to quality (“Beschaffenheitsgarantie”), as well as in the event of defaults concealed fraudulently (“arglistig verschwiegende Mängel”).
12.2 In an event of slight negligence, Palantir’s liability shall be limited to breaches of a contractual core duty. A contractual core duty is an obligation whose fulfilment makes the implementation of an agreement possible in the first place and on the fulfilment of which the contractual partner may therefore generally rely. Liability in case of slightly negligent infringement of any such contractual core duty shall be limited to the amount of damage which was foreseeable at the time of conclusion of the agreement and typical taking into account the nature of the contract (“vorhersehbarer und vertragstypischer Schaden”).
12.3 The above liability restrictions shall also apply in favour of the representatives, employees and vicarious agents of Palantir.
12.4 The above liability restrictions shall not apply to applicable mandatory statutory liability provisions which cannot be derogated from by agreement.
12.5 Any liability of Palantir for lost data due to slight negligence shall be limited to compensatory damages in the amount necessary for restoration of the data using electronic backup media. The obligation of Customer to back-up data on a regular basis according to the state of the art shall remain unaffected thereby.
12.6 All other liability shall be excluded. In the event that any portion of this Section 12 is deemed invalid or unenforceable by a tribunal or government organ of competent jurisdiction, that provision shall be limited or eliminated to the minimum extent necessary so that this Section 12 shall otherwise remain in full force and effect and be enforceable.”
7. Dispute Resolution. Section 13 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY RESOLVED AS FOLLOWS. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF NEW YORK (PROVIDED, IF SUCH CHOICE OF LAW IS DEEMED INVALID, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF AUSTRIA), WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF. ALL DISPUTES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT WILL BE RESOLVED BY A COURT OF AUSTRIA OF COMPETENT JURISDICTION OVER CUSTOMER’S PLACE OF DOMICILE IN AUSTRIA (AND IF CUSTOMER DOES NOT HAVE DOMICILE IN SPAIN, THE COURTS OF VIENNA SHALL BE COMPETENT), WITH PROCEEDINGS IN ENGLISH.”
GERMANY
1. Acceptable Use. Section 4.1 of the Terms of Service shall be replaced with the following:
“4.1 Applicable Laws. Customer shall ensure that Customer’s access and use of the Service, will not violate applicable laws of the United States or other laws applicable to Customer. In case either of the Parties is a German resident as defined by German foreign trade law, this obligation applies only with regard to export control laws and regulations enacted by the European Union or the Federal Republic of Germany and to export control laws and regulations other than those enacted by the European Union or the Federal Republic of Germany under the condition that economic sanctions have also been imposed by the Security Council of the United Nations, the Council of the European Union or the Federal Republic of Germany.”
2. Palantir Warranty and Disclaimer. Section 10.1 of the Terms of Service shall be replaced with the following, and Section 10.2 of the Terms of Service shall renumbered as Section 10.7:
“10. Palantir Warranty.
10.1 Palantir shall ensure the functional and operational performance of the Service in accordance with the terms of this Agreement. In particular, (a) the Service will be provided in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner during the Term. Subject to the subsequent clauses, Customer’s rights to make a warranty claim in case of faults shall be as if the statutory regulations on warranty (in particular, warranty rules of tenancy law under German law) apply.
10.2 This warranty shall not apply (i) in the case of only insignificant deviation from the agreed quality or only insignificant impairment of the usability of the Service; (ii) if Customer does not report a defect immediately and Palantir was unable to remedy the defect as a result of the failure to report the defect immediately; or (iii) if Customer is aware of the defect at the time of conclusion of the contract and has not reserved his rights.
10.3 Further, this warranty shall not apply to the extent (i) a breach of the warranty is caused by any incorrect use of the Service by Customer, (ii) such breach is caused by Customer’s misuse or unauthorized modification of the Service, (iii) such breach is caused by any use of the Service contrary to any conditions of use provided for the Service and specified in the applicable Documentation, (iv) such breach is caused by any violation of Section 4 (Acceptable Use), and (v) to the extent such breach is caused by any use of Customer-selected hardware or software used in connection with the Service which is not suitable for the use with the Service.
10.4 Insofar as a defect has been reported by the Customer and the Customer's warranty claims are not excluded, Palantir is obliged to remedy the defect within a reasonable period of time - through measures of its own choice. Customer shall give Palantir reasonable time and opportunity to remedy the defect. Palantir's employees and agents shall be granted free access to Customer's systems for this purpose, insofar as this is necessary.
10.5 In the event of impossibility or failure to remedy the defect, culpable or unreasonable delay or serious and final refusal to remedy the defect by Palantir or in other cases in which the remedy of the defect would be unreasonable for the Customer, the Customer shall in particular be entitled to reduce the fee owed in accordance with the extent of the impairment (“Minderung”). The user is not entitled to assert a claim for reduction by independently deducting the amount of the reduction from the fee to be paid on an ongoing basis; the user's right under the law of enrichment (“bereicherungsrechtlicher Anspruch”) to reclaim the overpaid part of the fee remains unaffected by this.
10.6 In case Palantir has, in the event of a breach of the warranty, not been able to remedy the defect within a reasonable period of time as set out above, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, a pro-rated refund of any fees pre-paid for the Services after the effective date of termination. The Customer’s right to claim damages in accordance with this Agreement remains unaffected.“
3. Limitations of Liability. Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. In all cases of contractual and non-contractual liability, Palantir’s liability shall be limited to damages or replacement of futile expenses only to the following extent:
12.1 In the event of intent or gross negligence, Palantir’s liability shall be in line with and not exceed the limits permitted according to the statutory provisions. The same shall apply in the event of culpably caused damages resulting from an injury to life, body or health, in the event of damages resulting from a guarantee as to quality (“Beschaffenheitsgarantie”), as well as in the event of defaults concealed fraudulently (“arglistig verschwiegende Mängel”).
12.2 In an event of slight negligence, Palantir’s liability shall be limited to breaches of a contractual core duty. A contractual core duty is an obligation whose fulfilment makes the implementation of an agreement possible in the first place and on the fulfilment of which the contractual partner may therefore generally rely. Liability in case of slightly negligent infringement of any such contractual core duty shall be limited to the amount of damage which was foreseeable at the time of conclusion of the agreement and typical taking into account the nature of the contract (“vorhersehbarer und vertragstypischer Schaden”).
12.3 The above liability restrictions shall also apply in favour of the representatives, employees and vicarious agents of Palantir.
12.4 The above liability restrictions shall not apply to applicable mandatory statutory liability provisions which cannot be derogated from by agreement.
12.5 Any liability of Palantir for lost data shall be limited to compensatory damages in the amount necessary for restoration of the data using electronic backup media. The obligation of Customer to back-up data on a regular basis according to the state of the art shall remain unaffected thereby.
12.6 All other liability shall be excluded.”
NETHERLANDS
1. Termination for Convenience. The final sentence of Section 8.1 is hereby deleted in its entirety, and replaced with the following:
“Either Party may terminate this Agreement for convenience, for any or no reason, at any time, upon providing the other Party prior written notice of such termination; for the foregoing termination right to be effective, if the terminating Party is Customer, Customer must provide fourteen (14) days’ prior written notice, and if the terminating Party is Palantir, Palantir must provide sixty (60) days’ prior written notice.”
2. Warranty. The final sentence of Section 10.1 of the Terms of Service is hereby deleted in its entirety.
3. Limitations of Liability. Section 12 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, EXCEPT FOR EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL INTENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT, EITHER PARTY’S GROSS NEGLIGENCE OR WILFUL INTENT, AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT, EITHER PARTY’S GROSS NEGLIGENCE OR WILFUL INTENT, AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. Section 13 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY RESOLVED AS FOLLOWS. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE NETHERLANDS, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF. ALL DISPUTES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT WILL BE RESOLVED BY A COURT OF THE NETHERLANDS WITH COMPETENT JURISDICTION, WITH PROCEEDINGS IN ENGLISH.”
SPAIN
1. Local Language Terms. A copy of these Terms of Service translated into Spanish is available at: https://palantir.pactsafe.io/aip-now-6493.html#spa-aip-now-tos-251605 (the “Spanish Terms”). For the avoidance of doubt, in the event of a conflict or inconsistency between the foregoing Spanish Terms and this English version of the Terms of Service, the English version shall govern and control. A copy of the DPA translated into Spanish is available at https://palantir.pactsafe.io/aip-now-6493.html#spa-aip-now-dpa-051625 (the “Spanish DPA”). For the avoidance of doubt, in the event of a conflict or inconsistency between the foregoing Spanish DPA and the English version of the DPA, the English version of the DPA shall govern and control.
2. Dispute Resolution. Section 13 of the Terms of Service is hereby deleted in its entirety, and replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY RESOLVED AS FOLLOWS. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF SPAIN, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF. ALL DISPUTES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT WILL BE RESOLVED BY A COURT OF SPAIN OF COMPETENT JURISDICTION OVER CUSTOMER’S PLACE OF DOMICILE IN SPAIN (AND IF CUSTOMER DOES NOT HAVE DOMICILE IN SPAIN, THE COURTS OF MADRID SHALL BE COMPETENT), WITH PROCEEDINGS IN ENGLISH.”
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective May 7th 2025 to May 16th 2025
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR PLATFORM (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR PLATFORM.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF), CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”) .
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form (or document expressly incorporating this Agreement by reference) filled out and/or executed by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” unless specified expressly otherwise in an Order Submission Form means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States, Canada, the Federal Republic of Germany, or the Republic of India; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Platform” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or such platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal (and/or, if applicable, personal) business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Platform or to any extensions or enhancements to the Palantir Platform developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Platform and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Platform and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Platform is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts.
(a) If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than five (5) accounts to access the Service (“Accounts”) for its (1) employees, (2) contractors, (3) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder, and/or (4) Customer's clients (the "Authorized Third Parties") subject to the additional terms and conditions set forth in Section 3.1 (a)(i)-(vi) herein (collectively, “Users”).
(i) Customer may grant access to the Service to an Authorized Third Party solely for the purpose of using services provided by Customer to the Authorized Third Party in connection with Customer's business purposes; for the avoidance of doubt, an Authorized Third Party may not access the Service for its own business purposes independent of services provided by Customer.
(ii) Authorized Third Party access to the Service shall be strictly limited to Customer front-end applications built by Customer using the Palantir Platform and Authorized Third Party is prohibited from directly ingesting data into the Palantir Platform, provided that Customer may ingest Authorized Third Party's data into the Palantir Platform subject to (i) above.
(iii) Authorized Third Party access shall be governed by and subject to all restrictions and obligations in the Agreement, and Customer shall be responsible and liable for any breach or violation thereof by an Authorized Third Party. Customer may provide an Authorized Third Party with access subject to the unaltered access terms separately provided to Customer by Palantir.
(iv) Usage by an Authorized Third Party shall be subject to the fees set forth herein.
(v) Customer is responsible for providing support to Authorized Third Parties regarding front-end applications built by Customer, and Customer shall maintain a support policy stating that Authorized Third Party shall submit any support inquiries to Customer, provided that Customer may escalate to Palantir the Palantir Platform issues identified by an Authorized Third Party that are unresolvable by Customer and Palantir will provide reasonable support to Customer for such escalations during Palantir's normal business hours in the region(s) designated by Palantir.
(vi) Customer shall not, and shall not permit any Authorized Third Party to, access the Palantir Platform from any country set forth on Palantir's prohibited country list as made available by Palantir to Customer (each a "Prohibited Country").
(b) If Customer is a natural person, Customer may provision no more than five (5) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Platform and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use, access, evaluate, or view the Palantir Platform for the purpose of building or offering a product or similar service to or competitive with the Palantir Platform.
4.3 Export Controls. The Palantir Platform may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Platform in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Platform.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Platform, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Platform any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Platform.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Platform, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Platform, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Platform (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Platform, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Platform (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Platform in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Platform (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, access, evaluate, or view the Palantir Platform for the purpose of building or offering a product or service similar to or competitive with the Palantir Platform; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Platform and any associated media; (p) use the Website or Palantir Platform to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Platform (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice . Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect until terminated as provided herein (the "Term"); provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer sixty (60) days' prior notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Platform shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Platform, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Platform.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Platform in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Platform is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Platform; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Platform that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Platform is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Platform is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Platform, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the applicable Order Term, (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Platform within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Platform constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Platform (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
GERMANY
1. Acceptable Use. Section 4.1 of the Terms of Service shall be replaced with the following:
“4.1 Applicable Laws. Customer shall ensure that Customer’s access and use of the Service, will not violate applicable laws of the United States or other laws applicable to Customer. In case either of the Parties is a German resident as defined by German foreign trade law, this obligation applies only with regard to export control laws and regulations enacted by the European Union or the Federal Republic of Germany and to export control laws and regulations other than those enacted by the European Union or the Federal Republic of Germany under the condition that economic sanctions have also been imposed by the Security Council of the United Nations, the Council of the European Union or the Federal Republic of Germany.”
2. Palantir Warranty and Disclaimer. Section 10.1 of the Terms of Service shall be replaced with the following, and Section 10.2 of the Terms of Service shall renumbered as Section 10.7:
“10. Palantir Warranty.
10.1 Palantir shall ensure the functional and operational performance of the Service in accordance with the terms of this Agreement. In particular, (a) the Service will be provided in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner during the Term. Subject to the subsequent clauses, Customer’s rights to make a warranty claim in case of faults shall be as if the statutory regulations on warranty (in particular, warranty rules of tenancy law under German law) apply.
10.2 This warranty shall not apply (i) in the case of only insignificant deviation from the agreed quality or only insignificant impairment of the usability of the Service; (ii) if Customer does not report a defect immediately and Palantir was unable to remedy the defect as a result of the failure to report the defect immediately; or (iii) if Customer is aware of the defect at the time of conclusion of the contract and has not reserved his rights.
10.3 Further, this warranty shall not apply to the extent (i) a breach of the warranty is caused by any incorrect use of the Service by Customer, (ii) such breach is caused by Customer’s misuse or unauthorized modification of the Service, (iii) such breach is caused by any use of the Service contrary to any conditions of use provided for the Service and specified in the applicable Documentation, (iv) such breach is caused by any violation of Section 4 (Acceptable Use), and (v) to the extent such breach is caused by any use of Customer-selected hardware or software used in connection with the Service which is not suitable for the use with the Service.
10.4 Insofar as a defect has been reported by the Customer and the Customer's warranty claims are not excluded, Palantir is obliged to remedy the defect within a reasonable period of time - through measures of its own choice. Customer shall give Palantir reasonable time and opportunity to remedy the defect. Palantir's employees and agents shall be granted free access to Customer's systems for this purpose, insofar as this is necessary.
10.5 In the event of impossibility or failure to remedy the defect, culpable or unreasonable delay or serious and final refusal to remedy the defect by Palantir or in other cases in which the remedy of the defect would be unreasonable for the Customer, the Customer shall in particular be entitled to reduce the fee owed in accordance with the extent of the impairment (“Minderung”). The user is not entitled to assert a claim for reduction by independently deducting the amount of the reduction from the fee to be paid on an ongoing basis; the user's right under the law of enrichment (“bereicherungsrechtlicher Anspruch”) to reclaim the overpaid part of the fee remains unaffected by this.
10.6 In case Palantir has, in the event of a breach of the warranty, not been able to remedy the defect within a reasonable period of time as set out above, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, a pro-rated refund of any fees pre-paid for the Services after the effective date of termination. The Customer’s right to claim damages in accordance with this Agreement remains unaffected.“
3. Limitations of Liability. Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. In all cases of contractual and non-contractual liability, Palantir’s liability shall be limited to damages or replacement of futile expenses only to the following extent:
12.1 In the event of intent or gross negligence, Palantir’s liability shall be in line with and not exceed the limits permitted according to the statutory provisions. The same shall apply in the event of culpably caused damages resulting from an injury to life, body or health, in the event of damages resulting from a guarantee as to quality (“Beschaffenheitsgarantie”), as well as in the event of defaults concealed fraudulently (“arglistig verschwiegende Mängel”).
12.2 In an event of slight negligence, Palantir’s liability shall be limited to breaches of a contractual core duty. A contractual core duty is an obligation whose fulfilment makes the implementation of an agreement possible in the first place and on the fulfilment of which the contractual partner may therefore generally rely. Liability in case of slightly negligent infringement of any such contractual core duty shall be limited to the amount of damage which was foreseeable at the time of conclusion of the agreement and typical taking into account the nature of the contract (“vorhersehbarer und vertragstypischer Schaden”).
12.3 The above liability restrictions shall also apply in favour of the representatives, employees and vicarious agents of Palantir.
12.4 The above liability restrictions shall not apply to applicable mandatory statutory liability provisions which cannot be derogated from by agreement.
12.5 Any liability of Palantir for lost data shall be limited to compensatory damages in the amount necessary for restoration of the data using electronic backup media. The obligation of Customer to back-up data on a regular basis according to the state of the art shall remain unaffected thereby.
12.6 All other liability shall be excluded.”
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR PLATFORM AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR PLATFORM, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective April 9th 2025 to May 7th 2025
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF), CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”) .
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form (or document expressly incorporating this Agreement by reference) filled out and/or executed by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” unless specified expressly otherwise in an Order Submission Form means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States, Canada, the Federal Republic of Germany, or the Republic of India; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or such platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal (and/or, if applicable, personal) business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts.
(a) If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than five (5) accounts to access the Service (“Accounts”) for its (1) employees, (2) contractors, (3) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder, and/or (4) Customer's clients (the "Authorized Third Parties") subject to the additional terms and conditions set forth in Section 3.1 (a)(i)-(vi) herein (collectively, “Users”).
(i) Customer may grant access to the Service to an Authorized Third Party solely for the purpose of using services provided by Customer to the Authorized Third Party in connection with Customer's business purposes; for the avoidance of doubt, an Authorized Third Party may not access the Service for its own business purposes independent of services provided by Customer.
(ii) Authorized Third Party access to the Service shall be strictly limited to Customer front-end applications built by Customer using the Palantir Technology and Authorized Third Party is prohibited from directly ingesting data into the Palantir Technology, provided that Customer may ingest Authorized Third Party's data into the Palantir Technology subject to (i) above.
(iii) Authorized Third Party access shall be governed by and subject to all restrictions and obligations in the Agreement, and Customer shall be responsible and liable for any breach or violation thereof by an Authorized Third Party. Customer may provide an Authorized Third Party with access subject to the unaltered access terms separately provided to Customer by Palantir.
(iv) Usage by an Authorized Third Party shall be subject to the fees set forth herein.
(v) Customer is responsible for providing support to Authorized Third Parties regarding front-end applications built by Customer, and Customer shall maintain a support policy stating that Authorized Third Party shall submit any support inquiries to Customer, provided that Customer may escalate to Palantir the Palantir Technology issues identified by an Authorized Third Party that are unresolvable by Customer and Palantir will provide reasonable support to Customer for such escalations during Palantir's normal business hours in the region(s) designated by Palantir.
(vi) Customer shall not, and shall not permit any Authorized Third Party to, access the Palantir Technology from any country set forth on Palantir's prohibited country list as made available by Palantir to Customer (each a "Prohibited Country").
(b) If Customer is a natural person, Customer may provision no more than five (5) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice . Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect until terminated as provided herein (the "Term"); provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer sixty (60) days' prior notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the applicable Order Term, (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Technology within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
GERMANY
1. Acceptable Use. Section 4.1 of the Terms of Service shall be replaced with the following:
“4.1 Applicable Laws. Customer shall ensure that Customer’s access and use of the Service, will not violate applicable laws of the United States or other laws applicable to Customer. In case either of the Parties is a German resident as defined by German foreign trade law, this obligation applies only with regard to export control laws and regulations enacted by the European Union or the Federal Republic of Germany and to export control laws and regulations other than those enacted by the European Union or the Federal Republic of Germany under the condition that economic sanctions have also been imposed by the Security Council of the United Nations, the Council of the European Union or the Federal Republic of Germany.”
2. Palantir Warranty and Disclaimer. Section 10.1 of the Terms of Service shall be replaced with the following, and Section 10.2 of the Terms of Service shall renumbered as Section 10.7:
“10. Palantir Warranty.
10.1 Palantir shall ensure the functional and operational performance of the Service in accordance with the terms of this Agreement. In particular, (a) the Service will be provided in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner during the Term. Subject to the subsequent clauses, Customer’s rights to make a warranty claim in case of faults shall be as if the statutory regulations on warranty (in particular, warranty rules of tenancy law under German law) apply.
10.2 This warranty shall not apply (i) in the case of only insignificant deviation from the agreed quality or only insignificant impairment of the usability of the Service; (ii) if Customer does not report a defect immediately and Palantir was unable to remedy the defect as a result of the failure to report the defect immediately; or (iii) if Customer is aware of the defect at the time of conclusion of the contract and has not reserved his rights.
10.3 Further, this warranty shall not apply to the extent (i) a breach of the warranty is caused by any incorrect use of the Service by Customer, (ii) such breach is caused by Customer’s misuse or unauthorized modification of the Service, (iii) such breach is caused by any use of the Service contrary to any conditions of use provided for the Service and specified in the applicable Documentation, (iv) such breach is caused by any violation of Section 4 (Acceptable Use), and (v) to the extent such breach is caused by any use of Customer-selected hardware or software used in connection with the Service which is not suitable for the use with the Service.
10.4 Insofar as a defect has been reported by the Customer and the Customer's warranty claims are not excluded, Palantir is obliged to remedy the defect within a reasonable period of time - through measures of its own choice. Customer shall give Palantir reasonable time and opportunity to remedy the defect. Palantir's employees and agents shall be granted free access to Customer's systems for this purpose, insofar as this is necessary.
10.5 In the event of impossibility or failure to remedy the defect, culpable or unreasonable delay or serious and final refusal to remedy the defect by Palantir or in other cases in which the remedy of the defect would be unreasonable for the Customer, the Customer shall in particular be entitled to reduce the fee owed in accordance with the extent of the impairment (“Minderung”). The user is not entitled to assert a claim for reduction by independently deducting the amount of the reduction from the fee to be paid on an ongoing basis; the user's right under the law of enrichment (“bereicherungsrechtlicher Anspruch”) to reclaim the overpaid part of the fee remains unaffected by this.
10.6 In case Palantir has, in the event of a breach of the warranty, not been able to remedy the defect within a reasonable period of time as set out above, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, a pro-rated refund of any fees pre-paid for the Services after the effective date of termination. The Customer’s right to claim damages in accordance with this Agreement remains unaffected.“
3. Limitations of Liability. Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. In all cases of contractual and non-contractual liability, Palantir’s liability shall be limited to damages or replacement of futile expenses only to the following extent:
12.1 In the event of intent or gross negligence, Palantir’s liability shall be in line with and not exceed the limits permitted according to the statutory provisions. The same shall apply in the event of culpably caused damages resulting from an injury to life, body or health, in the event of damages resulting from a guarantee as to quality (“Beschaffenheitsgarantie”), as well as in the event of defaults concealed fraudulently (“arglistig verschwiegende Mängel”).
12.2 In an event of slight negligence, Palantir’s liability shall be limited to breaches of a contractual core duty. A contractual core duty is an obligation whose fulfilment makes the implementation of an agreement possible in the first place and on the fulfilment of which the contractual partner may therefore generally rely. Liability in case of slightly negligent infringement of any such contractual core duty shall be limited to the amount of damage which was foreseeable at the time of conclusion of the agreement and typical taking into account the nature of the contract (“vorhersehbarer und vertragstypischer Schaden”).
12.3 The above liability restrictions shall also apply in favour of the representatives, employees and vicarious agents of Palantir.
12.4 The above liability restrictions shall not apply to applicable mandatory statutory liability provisions which cannot be derogated from by agreement.
12.5 Any liability of Palantir for lost data shall be limited to compensatory damages in the amount necessary for restoration of the data using electronic backup media. The obligation of Customer to back-up data on a regular basis according to the state of the art shall remain unaffected thereby.
12.6 All other liability shall be excluded.”
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective March 25th 2025 to April 9th 2025
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF), CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, THE FEDERAL REPUBLIC OF GERMANY OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”) .
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form (or document expressly incorporating this Agreement by reference) filled out and/or executed by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” unless specified expressly otherwise in an Order Submission Form means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States, Canada, the Federal Republic of Germany, or the Republic of India; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or such platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal (and/or, if applicable, personal) business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts.
(a) If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than five (5) accounts to access the Service (“Accounts”) for its (1) employees, (2) contractors, (3) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder, and/or (4) Customer's clients (the "Authorized Third Parties") subject to the additional terms and conditions set forth in Section 3.1 (a)(i)-(vi) herein (collectively, “Users”).
(i) Customer may grant access to the Service to an Authorized Third Party solely for the purpose of using services provided by Customer to the Authorized Third Party in connection with Customer's business purposes; for the avoidance of doubt, an Authorized Third Party may not access the Service for its own business purposes independent of services provided by Customer.
(ii) Authorized Third Party access to the Service shall be strictly limited to Customer front-end applications built by Customer using the Palantir Technology and Authorized Third Party is prohibited from directly ingesting data into the Palantir Technology, provided that Customer may ingest Authorized Third Party's data into the Palantir Technology subject to (i) above.
(iii) Authorized Third Party access shall be governed by and subject to all restrictions and obligations in the Agreement, and Customer shall be responsible and liable for any breach or violation thereof by an Authorized Third Party. Customer may provide an Authorized Third Party with access subject to the unaltered access terms separately provided to Customer by Palantir.
(iv) Usage by an Authorized Third Party shall be subject to the fees set forth herein.
(v) Customer is responsible for providing support to Authorized Third Parties regarding front-end applications built by Customer, and Customer shall maintain a support policy stating that Authorized Third Party shall submit any support inquiries to Customer, provided that Customer may escalate to Palantir the Palantir Technology issues identified by an Authorized Third Party that are unresolvable by Customer and Palantir will provide reasonable support to Customer for such escalations during Palantir's normal business hours in the region(s) designated by Palantir.
(vi) Customer shall not, and shall not permit any Authorized Third Party to, access the Palantir Technology from any country set forth on Palantir's prohibited country list as made available by Palantir to Customer (each a "Prohibited Country").
(b) If Customer is a natural person, Customer may provision no more than five (5) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice . Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect until terminated as provided herein (the "Term"); provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer sixty (60) days' prior notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Technology within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
GERMANY
1. Acceptable Use. Section 4.1 of the Terms of Service shall be replaced with the following:
“4.1 Applicable Laws. Customer shall ensure that Customer’s access and use of the Service, will not violate applicable laws of the United States or other laws applicable to Customer. In case either of the Parties is a German resident as defined by German foreign trade law, this obligation applies only with regard to export control laws and regulations enacted by the European Union or the Federal Republic of Germany and to export control laws and regulations other than those enacted by the European Union or the Federal Republic of Germany under the condition that economic sanctions have also been imposed by the Security Council of the United Nations, the Council of the European Union or the Federal Republic of Germany.”
2. Palantir Warranty and Disclaimer. Section 10.1 of the Terms of Service shall be replaced with the following, and Section 10.2 of the Terms of Service shall renumbered as Section 10.7:
“10. Palantir Warranty.
10.1 Palantir shall ensure the functional and operational performance of the Service in accordance with the terms of this Agreement. In particular, (a) the Service will be provided in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner during the Term. Subject to the subsequent clauses, Customer’s rights to make a warranty claim in case of faults shall be as if the statutory regulations on warranty (in particular, warranty rules of tenancy law under German law) apply.
10.2 This warranty shall not apply (i) in the case of only insignificant deviation from the agreed quality or only insignificant impairment of the usability of the Service; (ii) if Customer does not report a defect immediately and Palantir was unable to remedy the defect as a result of the failure to report the defect immediately; or (iii) if Customer is aware of the defect at the time of conclusion of the contract and has not reserved his rights.
10.3 Further, this warranty shall not apply to the extent (i) a breach of the warranty is caused by any incorrect use of the Service by Customer, (ii) such breach is caused by Customer’s misuse or unauthorized modification of the Service, (iii) such breach is caused by any use of the Service contrary to any conditions of use provided for the Service and specified in the applicable Documentation, (iv) such breach is caused by any violation of Section 4 (Acceptable Use), and (v) to the extent such breach is caused by any use of Customer-selected hardware or software used in connection with the Service which is not suitable for the use with the Service.
10.4 Insofar as a defect has been reported by the Customer and the Customer's warranty claims are not excluded, Palantir is obliged to remedy the defect within a reasonable period of time - through measures of its own choice. Customer shall give Palantir reasonable time and opportunity to remedy the defect. Palantir's employees and agents shall be granted free access to Customer's systems for this purpose, insofar as this is necessary.
10.5 In the event of impossibility or failure to remedy the defect, culpable or unreasonable delay or serious and final refusal to remedy the defect by Palantir or in other cases in which the remedy of the defect would be unreasonable for the Customer, the Customer shall in particular be entitled to reduce the fee owed in accordance with the extent of the impairment (“Minderung”). The user is not entitled to assert a claim for reduction by independently deducting the amount of the reduction from the fee to be paid on an ongoing basis; the user's right under the law of enrichment (“bereicherungsrechtlicher Anspruch”) to reclaim the overpaid part of the fee remains unaffected by this.
10.6 In case Palantir has, in the event of a breach of the warranty, not been able to remedy the defect within a reasonable period of time as set out above, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, a pro-rated refund of any fees pre-paid for the Services after the effective date of termination. The Customer’s right to claim damages in accordance with this Agreement remains unaffected.“
3. Limitations of Liability. Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. In all cases of contractual and non-contractual liability, Palantir’s liability shall be limited to damages or replacement of futile expenses only to the following extent:
12.1 In the event of intent or gross negligence, Palantir’s liability shall be in line with and not exceed the limits permitted according to the statutory provisions. The same shall apply in the event of culpably caused damages resulting from an injury to life, body or health, in the event of damages resulting from a guarantee as to quality (“Beschaffenheitsgarantie”), as well as in the event of defaults concealed fraudulently (“arglistig verschwiegende Mängel”).
12.2 In an event of slight negligence, Palantir’s liability shall be limited to breaches of a contractual core duty. A contractual core duty is an obligation whose fulfilment makes the implementation of an agreement possible in the first place and on the fulfilment of which the contractual partner may therefore generally rely. Liability in case of slightly negligent infringement of any such contractual core duty shall be limited to the amount of damage which was foreseeable at the time of conclusion of the agreement and typical taking into account the nature of the contract (“vorhersehbarer und vertragstypischer Schaden”).
12.3 The above liability restrictions shall also apply in favour of the representatives, employees and vicarious agents of Palantir.
12.4 The above liability restrictions shall not apply to applicable mandatory statutory liability provisions which cannot be derogated from by agreement.
12.5 Any liability of Palantir for lost data shall be limited to compensatory damages in the amount necessary for restoration of the data using electronic backup media. The obligation of Customer to back-up data on a regular basis according to the state of the art shall remain unaffected thereby.
12.6 All other liability shall be excluded.”
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective October 2nd 2024 to March 25th 2025
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF), CANADA, THE REPUBLIC OF INDIA, OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”) .
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form (or document expressly incorporating this Agreement by reference) filled out and/or executed by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” unless specified expressly otherwise in an Order Submission Form means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States, Canada, or the Republic of India; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or such platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal (and/or, if applicable, personal) business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts.
(a) If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than five (5) accounts to access the Service (“Accounts”) for its (1) employees, (2) contractors, (3) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder, and/or (4) Customer's clients (the "Authorized Third Parties") subject to the additional terms and conditions set forth in Section 3.1 (a)(i)-(vi) herein (collectively, “Users”).
(i) Customer may grant access to the Service to an Authorized Third Party solely for the purpose of using services provided by Customer to the Authorized Third Party in connection with Customer's business purposes; for the avoidance of doubt, an Authorized Third Party may not access the Service for its own business purposes independent of services provided by Customer.
(ii) Authorized Third Party access to the Service shall be strictly limited to Customer front-end applications built by Customer using the Palantir Technology and Authorized Third Party is prohibited from directly ingesting data into the Palantir Technology, provided that Customer may ingest Authorized Third Party's data into the Palantir Technology subject to (i) above.
(iii) Authorized Third Party access shall be governed by and subject to all restrictions and obligations in the Agreement, and Customer shall be responsible and liable for any breach or violation thereof by an Authorized Third Party. Customer may provide an Authorized Third Party with access subject to the unaltered access terms separately provided to Customer by Palantir.
(iv) Usage by an Authorized Third Party shall be subject to the fees set forth herein.
(v) Customer is responsible for providing support to Authorized Third Parties regarding front-end applications built by Customer, and Customer shall maintain a support policy stating that Authorized Third Party shall submit any support inquiries to Customer, provided that Customer may escalate to Palantir the Palantir Technology issues identified by an Authorized Third Party that are unresolvable by Customer and Palantir will provide reasonable support to Customer for such escalations during Palantir's normal business hours in the region(s) designated by Palantir.
(vi) Customer shall not, and shall not permit any Authorized Third Party to, access the Palantir Technology from any country set forth on Palantir's prohibited country list as made available by Palantir to Customer (each a "Prohibited Country").
(b) If Customer is a natural person, Customer may provision no more than five (5) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice . Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect until terminated as provided herein (the "Term"); provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer sixty (60) days' prior notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Technology within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective June 25th 2024 to October 2nd 2024
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF), CANADA, THE REPUBLIC OF INDIA, OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”).
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form (or document expressly incorporating this Agreement by reference) filled out and/or executed by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” unless specified expressly otherwise in an Order Submission Form means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States, Canada, or the Republic of India; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or such platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal (and/or, if applicable, personal) business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts. If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than five (5) accounts to access the Service (“Accounts”) for its (a) employees, (b) contractors, (c) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder (collectively, “Users”). If Customer is a natural person, Customer may provision no more than five (5) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice. Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect until terminated as provided herein (the "Term"); provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer sixty (60) days' prior notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITRAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Technology within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective June 20th 2024 to June 25th 2024
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES, CANADA, THE REPUBLIC OF INDIA, OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF), CANADA, THE REPUBLIC OF INDIA, OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”).
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form (or document expressly incorporating this Agreement by reference) filled out and/or executed by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” unless specified expressly otherwise in an Order Submission Form means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States, Canada, or the Republic of India; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or such platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts. If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than twenty-five (25) accounts to access the Service (“Accounts”) for its (a) employees, (b) contractors, (c) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder (collectively, “Users”). If Customer is a natural person, Customer may provision no more than twenty-five (25) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice. Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect for thirty (30) days from the Effective Date (the “Term”), unless otherwise terminated as provided herein; provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). THE PARTIES AGREE TO ARBITRATE SOLELY ON AN INDIVIDUAL BASIS, AND THIS AGREEMENT DOES NOT PERMIT CLASS ARBITRATION OR ANY CLAIMS BROUGHT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, REPRESENTATIVE, PAGA, JOINT, OR REPRESENTATIVE ARBITRATION PROCEEDING. THE ARBITAL TRIBUNAL MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISEPRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Technology within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective May 20th 2024 to June 20th 2024
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF) OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”).
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form filled out by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or any additional platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts. If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than twenty-five (25) accounts to access the Service (“Accounts”) for its (a) employees, (b) contractors, (c) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder (collectively, “Users”). If Customer is a natural person, Customer may provision no more than twenty-five (25) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice. Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term; Termination for Convenience. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect for thirty (30) days from the Effective Date (the “Term”), unless otherwise terminated as provided herein; provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form. Palantir may terminate this Agreement for convenience, for any or no reason, at any time, upon providing Customer notice of such termination.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Technology within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective May 6th 2024 to May 20th 2024
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
PALANTIR AIP NOW IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF) OR UNITED KINGDOM TO RECEIVE ACCESS TO PALANTIR AIP NOW, AND MAY NOT ACCESS OR USE PALANTIR AIP NOW IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”).
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form filled out by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now (or any additional platform(s) that may be specified in an Order Submission Form).
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts. If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than twenty-five (25) accounts to access the Service (“Accounts”) for its (a) employees, (b) contractors, (c) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder (collectively, “Users”). If Customer is a natural person, Customer may provision no more than twenty-five (25) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form) (such other Palantir customer, a “Primary User”), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice. Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect for thirty (30) days from the Effective Date (the “Term”), unless otherwise terminated as provided herein; provided, if Customer is a natural person accessing a Primary User’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), the Term shall continue in effect until the Primary User’s access to the Service expires or is terminated. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective thirty (30) days after Palantir provides such notice. Customer’s continued use of the Palantir Technology within thirty (30) days after Palantir provides the foregoing notice constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof).
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective May 3rd 2024 to May 6th 2024
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
THE SERVICE (DEFINED BELOW) IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF) OR UNITED KINGDOM TO RECEIVING ACCESS TO THE SERVICE, AND MAY NOT ACCESS OR USE THE SERVICE IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”).
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form filled out by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now.
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Palantir will make available to Customer upon written request (no more frequently than once per calendar year) Palantir’s: (a) ISAE 3000/SSAE18 SOC2 TYPE II Report, (b) Penetration Test Attestation Letter, and (c) ISO 27001 Certificate. Palantir shall provide the above audit reports relating to Palantir’s operating practices and procedures to the extent relevant to the Service. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts. If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than twenty-five (25) accounts to access the Service (“Accounts”) for its (a) employees, (b) contractors, (c) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder (collectively, “Users”). If Customer is a natural person, Customer may provision no more than twenty-five (25) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice. Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect for thirty (30) days from the Effective Date (the “Term”), unless otherwise terminated as provided herein. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term (or, Initial Term or Renewal Term, if and as applicable) active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term (or, Initial Term or Renewal Term, if and as applicable) active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement at least sixty (60) days prior to the expiration of the then-active Term by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective at the beginning of the Renewal Term immediately following the then-active Term. Customer’s continued use of the Palantir Technology within thirty (30) days of the expiration of the then-active Term constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof) with or without notice.
14.2 Pricing Updates. In the event of a price modification, Palantir will notify Customer in writing of such price increase at least sixty (60) days prior to the expiration of the then-active Term, and the price modification will only take effect at the beginning of the Renewal Term immediately following the then-active Term.
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective May 1st 2024 to May 3rd 2024
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
THE SERVICE (DEFINED BELOW) IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF) OR UNITED KINGDOM TO RECEIVING ACCESS TO THE SERVICE, AND MAY NOT ACCESS OR USE THE SERVICE IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”).
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form filled out by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now.
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Palantir will make available to Customer upon written request (no more frequently than once per calendar year) Palantir’s: (a) ISAE 3000/SSAE18 SOC2 TYPE II Report, (b) Penetration Test Attestation Letter, and (c) ISO 27001 Certificate. Palantir shall provide the above audit reports relating to Palantir’s operating practices and procedures to the extent relevant to the Service. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts. If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than twenty-five (25) accounts to access the Service (“Accounts”) for its (a) employees, (b) contractors, (c) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder (collectively, “Users”). If Customer is a natural person, Customer may provision no more than twenty-five (25) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at https://palantir.pactsafe.io/aip-now-6493.html#template-kuaug4bax. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at http://www.palantir.com/aip-now-statement shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/aip-now-6493.html#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice. Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect for thirty (30) days from the Effective Date (the “Term”), unless otherwise terminated as provided herein. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term (or, Initial Term or Renewal Term, if and as applicable) active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term (or, Initial Term or Renewal Term, if and as applicable) active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement at least sixty (60) days prior to the expiration of the then-active Term by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective at the beginning of the Renewal Term immediately following the then-active Term. Customer’s continued use of the Palantir Technology within thirty (30) days of the expiration of the then-active Term constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof) with or without notice.
14.2 Pricing Updates. In the event of a price modification, Palantir will notify Customer in writing of such price increase at least sixty (60) days prior to the expiration of the then-active Term, and the price modification will only take effect at the beginning of the Renewal Term immediately following the then-active Term.
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Effective May 1st 2024 to May 1st 2024
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED BELOW), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS AGREEMENT (AS DEFINED BELOW), THAT YOU UNDERSTAND THE TERMS OF THE AGREEMENT, AND THAT YOU AND (IF APPLICABLE) THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT, WHICH FOR THE AVOIDANCE OF DOUBT CONTAINS SECTION 13 REGARDING MANDATORY, BINDING ARBITRATION OF DISPUTES, SECTION 4 REGARDING ACCEPTABLE USE, AND SECTION 9.2 REGARDING CUSTOMER INDEMNITIES. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS AGREEMENT ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, DO NOT SELECT "I AGREE” WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
THE SERVICE (DEFINED BELOW) IS CURRENTLY ONLY AVAILABLE TO CUSTOMERS AND USERS LOCATED IN THE UNITED STATES OR THE UNITED KINGDOM. ACCORDINGLY, YOU MUST PRESENT IDENTIFICATION (ON THE ORDER SUBMISSION FORM, AS DEFINED BELOW) ISSUED BY EITHER THE UNITED STATES (OR STATE THEREOF) OR UNITED KINGDOM TO RECEIVING ACCESS TO THE SERVICE, AND MAY NOT ACCESS OR USE THE SERVICE IF YOU ARE LOCATED OUTSIDE OF THE UNITED STATES OR THE UNITED KINGDOM.
This Agreement is between Customer (as defined below) and Palantir (each a “Party” and collectively the “Parties”) and is effective as of the date on which You select “I AGREE” (or equivalent) on the Order Submission Form where such option is made available by Palantir (the “Effective Date”).
1.1 “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party as of the Effective Date and for as long as such entity remains directly or indirectly owned or controlled by the Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity.
1.2 “Agreement” means, collectively, these Palantir AIP Now Terms of Service and any attachments, addenda, conditions, notices, operating rules, policies (including the Palantir Privacy Policy), exhibits, schedules or documents incorporated by reference or hyperlinked herein (as may be updated from time to time pursuant to Section 13 herein) or which we may publish from time to time on the Website or Customer’s Accounts and any order documents entered into between Palantir and Customer that reference this Agreement, including the Order Submission Form.
1.3 “Customer” means the customer identified on the Order Submission Form who is Party to this Agreement, on behalf of which You are accepting the terms of this Agreement as its legal representative.
1.4 “Customer Data” means any data (including aggregated or transformed versions thereof and analytical outputs), models, algorithms, analyses, transformation code or other content that is provided by, whether directly or indirectly from a third party, or created by Customer, or Users using the Service or Website, for integration, use, or other processing in or through the Service. Customer Data excludes Usage Data.
1.5 “Data Connection Software” means Palantir software provided for installation locally for Customer to connect Customer Data to the Service.
1.6 “Documentation” means any technical documentation for the Service made available in connection with the Service, including the technical documentation relevant to the Service available at https://www.palantir.com/docs/, updated from time to time at Palantir’s sole discretion.
1.7 “Intellectual Property Rights” means all rights, title, and interest in and to any trade secrets, patents, copyrights, service marks, trademarks, know-how, trade names, rights in trade dress and packaging, moral rights, rights of privacy, rights of publicity, and any similar rights, including any applications, continuations, or registrations with respect to the foregoing, under the laws or regulations of any governmental, regulatory, or judicial authority.
1.8 “Order Submission Form” means the web-based form filled out by You to include Customer’s information and specifying the Service and/or Professional Services (if applicable) to be provided hereunder and that is submitted by You on Customer’s behalf to Palantir.
1.9 “Palantir” means (a) Palantir Technologies Inc. if Customer’s primary location of use is the United States; or (b) Palantir Technologies UK, Ltd. If Customer’s primary location of use is the United Kingdom. Notwithstanding the foregoing, (x) if the headquarters (i.e., principal place of business) of Customer’s ultimate parent entity is located in the Republic of Korea, “Palantir” means Palantir Korea LLC. If neither (a), (b), nor (x) applies, then “Palantir” means Palantir Technologies Inc.
1.10 “Palantir Technology” means the Service, Documentation, Data Connection Software, Sample Materials, Website, models, and application programming interfaces (APIs), provided or made available to Customer as a service in connection with this Agreement, and any improvements, modifications, derivative works, patches, upgrades, and updates thereto.
1.11 “Palantir Privacy Policy” means any privacy-specific policies available on the Website and/or accessible through the Order Submission Form.
1.12 “Sample Materials” means any technology and materials provided or made available by Palantir to Customer for use with the Service, including sample code, software libraries, command line tools, data integration code, templates, and configuration files.
1.13 “Service” means software-as-a-service access to Palantir AIP Now.
1.14 “Taxes” means any applicable sales, use, transaction, value added, goods and services tax, harmonized sales tax, withholding tax, excise or similar taxes, and any foreign, provincial, federal, state or local fees or charges, (including but not limited to, environmental or similar fees) duties, costs of compliance with export and import controls and regulations, and other governmental assessments , including any penalties and interest in respect thereof, imposed on, in respect of or otherwise associated with any transaction hereunder.
1.15 “Third Party Content” means any third party data, services, or applications that interoperate with the Service which Palantir may, at Customer’s sole discretion, facilitate the use of in connection with the Service and subject to an independent agreement between Customer and such third party.
1.16 “Third Party Services” means third party services that Palantir may utilize in the provision of the Service as set forth in the Documentation (or as otherwise agreed by the Parties).
1.17 “Website” means WWW.PALANTIR.COM or any other Palantir-owned domains, including any subdomains of the foregoing, and all software, applications, products, content, and services provided by Palantir at or through the Website.
2.1 Service Access. Palantir shall make available the Service to Customer, subject to the condition subsequent set forth in Section 2.8, during the applicable Term solely for use by Customer and its Users in accordance with the terms and conditions of this Agreement and the Documentation for Customer’s internal business purposes, or (if applicable) as provided explicitly otherwise in an Order Submission Form.
2.2 Data Connection Software License. If applicable for use of the Service, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license to use the Data Connection Software for the sole purposes of using and connecting to the Service. Customer shall allow Palantir to access the Data Connection Software remotely as necessary to provide the Service.
2.3 Sample Materials License. Palantir may make available Sample Materials for use by Customer during the Term. If applicable, and subject to the condition subsequent set forth in Section 2.8, Palantir grants to Customer during the Term a non-exclusive, nontransferable, non-sublicensable, limited license, to copy, modify, and use the Sample Materials solely to the extent necessary for Customer’s use of the Service.
2.4 Usage Data. Palantir may collect and use metrics, analytics, statistics, or other data related to Customer’s use of the Service (a) to secure the Service for the benefit of Customer; (b) to provide, analyze, maintain, support, and improve the Service; and (c) for any other purpose for which Customer provides authorization via the Service, where such option is made available (collectively “Usage Data”).
2.5 Security. Palantir has established an Information Security Program (“ISP”) designed to ensure strong practical security controls, and compliance with industry best practice standards and frameworks. A comprehensive list of Palantir’s certifications can be found at https://www.palantir.com/information-security/ under “Compliance and Accreditation.” The Palantir ISP additionally is aligned with NIST 800-53, TSC (Trust Service Criteria), and CIS (Center for Internet Security) frameworks and management systems. Palantir will make available to Customer upon written request (no more frequently than once per calendar year) Palantir’s: (a) ISAE 3000/SSAE18 SOC2 TYPE II Report, (b) Penetration Test Attestation Letter, and (c) ISO 27001 Certificate. Palantir shall provide the above audit reports relating to Palantir’s operating practices and procedures to the extent relevant to the Service. Customer acknowledges that Palantir’s documentation noted in this Section and other related information are Palantir’s Confidential Information hereunder.
2.6 Service Levels and Support. During the Term, Palantir has no obligation to provide any support services under this Agreement. This Agreement does not give You or Customer any rights to any updates or upgrades to the Palantir Technology or to any extensions or enhancements to the Palantir Technology developed by Palantir at any time in the future. Palantir may offer support services separately. Any supplemental software code or related materials that Palantir provides to You or Customer as part of any support services are to be considered part of the Palantir Technology and are subject to the terms and conditions of this Agreement.
2.7 Professional Services. Palantir shall provide Customer with implementation, enablement, training, or other professional services as specified in the Order Submission Form, and subject to any fees thereunder (“Professional Services”). If the Order Submission Form specifies no Professional Services, Palantir may at its discretion (without an obligation to do so absent a separate agreement providing otherwise) provide Customer Professional Services. The performance of any Professional Services shall not affect ownership of the Palantir Technology and other materials provided by Palantir under this Agreement.
2.8 Palantir Compliance Requirements. If Palantir determines at its sole discretion that Customer has not satisfied the Palantir Compliance Requirements, Palantir’s obligations under Section 2.1, 2.2, and 2.3 (including providing the rights of access and license grants provided therein) shall immediately terminate upon Palantir determining that Customer has not satisfied the Palantir Compliance Requirements. Palantir may evaluate (and re-evaluate) Customer’s satisfaction of the Palantir Compliance Requirements at any time, including after the Customer has accessed the Service. Additionally, Customer’s continued access to the Service and/or any Palantir Technology is conditioned upon Palantir’s determining, in its sole discretion, that Customer satisfies the Palantir Compliance Requirements. The “Palantir Compliance Requirements” is comprised of (but not limited to) Palantir determining (at its sole discretion) that performance under this Agreement with Customer would not likely (i) violate Palantir’s obligations under trade control regulations of the United States, including the U.S. Export Administration regulations, or other applicable export control laws in other jurisdictions, (ii) violate or otherwise breach Palantir’s contractual obligations with third parties, (iii) render Palantir in violation of laws prohibiting providing goods, support, or services to Specially Designated Nationals as defined by the United States Department of the Treasury, or persons subject to similar blocking or denied party prohibitions administered by a U.S. government agency, (iv) violate Palantir’s obligations under the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control, or (v) otherwise violate Palantir’s policies or values. Palantir reserves the right to amend the definition of Palantir Compliance Requirements at any time, as needed, and at its sole discretion.
3. Customer Use of Service.
3.1 Accounts. If Customer is an entity other than a natural person, such as a business, organization, or educational institution, Customer may provision no more than twenty-five (25) accounts to access the Service (“Accounts”) for its (a) employees, (b) contractors, (c) other users (including its Affiliates’ employees or contractors) specified in the Order Submission Form for the purposes authorized hereunder (collectively, “Users”). If Customer is a natural person, Customer may provision no more than twenty-five (25) Accounts, each only to other natural persons (each of which natural persons shall be considered Users) who have provided Customer with all consents, authorizations, approvals, and/or agreements necessary to permit Customer to use and/or process such Users’ data under applicable law, regulation, or agreement(s) with such Users, and who have executed Terms of Service with Palantir substantially similar to the terms of this Agreement; provided, if Customer is a natural person accessing another Palantir customer’s instance of the Service as an authorized User (or equivalent, as identified on the Order Submission Form), such Customer is not permitted to provision any Accounts. Customer shall be responsible for (i) administering Accounts; (ii) using industry standard security measures to protect Accounts (including, without limitation, using multi-factor authentication); (iii) any activity on Accounts and the monitoring of such activity on Accounts (only to the extent that such monitoring does not violate any other term of this Agreement or applicable law); and (iv) the actions and omissions of its Users in connection with the Palantir Technology and/or Accounts. Customer shall immediately de-activate any Account upon becoming aware of the compromise or unauthorized use thereof (and in such case promptly notify Palantir of such compromise or unauthorized use), or upon Palantir’s reasonable request.
3.2 Data Protection. The Parties shall comply with the Palantir Data Protection Addendum (“DPA”) available at [INSERT LINK]. Customer shall be solely responsible for the accuracy, content, and legality of Customer Data and shall ensure that any integration of Customer Data into the Service complies with applicable laws and regulations, including but not limited to data localization requirements. In Palantir’s role as a Controller (as defined in the DPA) with respect to Customer, the AIP Now Privacy Policy available at [INSERT LINK] shall apply and be incorporated herein by reference.
4. Acceptable Use.
4.1 Applicable Laws. Your and Customer’s access and use of the Service and Website, will not violate applicable laws of the United States or other laws applicable in the jurisdiction in which You or Customer are located, in which any natural persons who can be identified (directly or indirectly) by reference to the Customer Data (each, a “Data Subject”) is located, or in which Customer Data is stored and it is solely Your and Customer’s responsibility for ensuring such compliance. Palantir may from time to time make available acceptable use policies, community guidelines, or similar policies, which shall become part of this Agreement pursuant to the updates policy set forth in Section 14.
4.2 Competitive Use. Customer will not use or access the Palantir Technology to directly or indirectly develop, create, improve, or inform a product or service similar to or competitive with any product or service offered by Palantir now or in the future.
4.3 Export Controls. The Palantir Technology may be subject to trade control regulations of the United States, such as the U.S. Export Administration Regulations, or other export control laws applicable in other jurisdictions, including the export and sanctions laws and regulations referenced in Section 15 of this Agreement. Customer may not use the Palantir Technology in violation of export control or other trade controls of the United States or any other applicable jurisdiction. This includes, without limitation, the following prohibitions:
(a) Customer may not use or access the Service if Customer is or are working on behalf of a Specially Designated National as defined by the United States Department of the Treasury or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency; and
(b) Customer may not use or access the Service to perform any activities subject to the International Traffic in Arms Regulations (ITAR) maintained by the United States Department of State, including without limitation, ingesting ITAR-controlled data.
4.4 Use of PII and/or PHI. If Customer uses or anticipates to use Personally Identifiable Information (“PII”), Personal Data, Personal Information, or Protected Health Information (“PHI”), as defined under applicable law, in connection with the Service, Customer (a) must indicate such (anticipated) use where such option is made available in the Order Submission Form, and execute a Business Associate Agreement prior to accessing or using the Service; and (b) will follow the relevant guidance and best practices for protecting sensitive data set out in documentation available at https://www.palantir.com/docs/foundry/security/overview/. For the avoidance of doubt, this Section does not grant Customer permission to use the foregoing information in connection with the Service if an Order Submission Form does not expressly permit such use.
4.5 Use Case Limitations. Customer shall comply with the Palantir Use Case Restrictions available at https://palantir.pactsafe.io/#ucr-985315, which is hereby incorporated by reference into the Agreement, including in connection with any use of the Palantir Technology.
4.6 Audit Rights. Customer agrees that Palantir may audit Customer’s use of the Service in order to verify Customer’s compliance with this Agreement, including but not limited to compliance with Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment). If Palantir becomes aware of or reasonably suspects any violation of this Agreement by Customer, upon provision of prior reasonable notice, Palantir may audit Customer’s compliance with this Agreement, Customer’s use of the Palantir Technology, and Customer’s software monitoring system(s) and records, provided such audit is conducted during Customer’s regular business hours. If Palantir reasonably believes such audit reveals that Customer has violated this Agreement, Palantir may exercise its termination rights pursuant to Section 8.2, and/or suspension of services rights pursuant to Section 8.4, as applicable, and Customer will be liable for the reasonable costs of the audit in addition to any other fees, damages, penalties, or remedies to which Palantir may be entitled under this Agreement and/or applicable law. For the avoidance of doubt, Palantir’s initiation of an audit is not necessarily a precondition of its exercise of termination rights pursuant to Section 8.2 or its exercise of its suspension of services rights pursuant to Section 8.4, if the conditions permitting exercise of the foregoing rights are met; Palantir’s decision to initiate an audit does not preclude its ability to exercise its rights pursuant to Section 8.2 or Section 8.4, if the conditions permitting exercise of the foregoing rights are met.
5. Proprietary Rights.
5.1 Customer Ownership. As between the Parties, Customer owns all rights, title, and interest, including all Intellectual Property Rights, in and to Customer Data and any modifications made thereto. Subject to the Agreement, Customer grants to Palantir a non-exclusive, worldwide, royalty-free right and license during the Term to use and process Customer Data solely to provide the Service and/or Professional Services, and as may be required by applicable law. Customer further grants to Palantir a worldwide, perpetual, irrevocable, royalty-free right and license to use, distribute, disclose, and make and incorporate into the Palantir Technology any suggestions, enhancement request, recommendation, or other feedback provided by Customer or Users relating to the Palantir Technology.
5.2 Palantir Ownership. As between the Parties, Palantir owns all rights, title, and interest, including all Intellectual Property Rights, in and to the Palantir Technology, and any other related documentation or materials provided by Palantir and any derivative works, modifications, or improvements of any of the foregoing (including without limitation all Intellectual Property Rights embodied in any of the foregoing). Except for the express rights granted herein, Palantir does not grant any other licenses or access, whether express or implied, or any ownership rights to any Palantir Technology, software, services, or Intellectual Property Rights.
5.3 Restrictions. Customer will not (and will not allow any third party to): (a) gain or attempt to gain unauthorized access to the Service or Website or infrastructure, or any element thereof, or circumvent or interfere with any authentication or security measures of the Service or Website; (b) interfere with or disrupt the integrity or performance of the Service or Website; (c) access or attempt to gain access to another customer’s data; (d) adversely impact the ability of other customers to use the Service; (e) transmit material containing software viruses or other harmful or deleterious computer code, files, scripts, agents, or programs through the Service or Website; (f) decompile, disassemble, scan, reverse engineer, or attempt to discover any source code or underlying ideas or algorithms of any Palantir Technology (except to the extent that applicable law expressly prohibits such a reverse engineering restriction, and in such case only upon prior written notice to Palantir); (g) provide, lease, lend, use for timesharing or service bureau purposes, or otherwise use or allow others to use the Service for the benefit of any third party; (h) use the Service or Website for any purpose that is not expressly permitted by this Agreement; (i) list or otherwise display or copy any code of any Palantir Technology, except for Sample Materials to the extent necessary for Customer’s use of the Service; (j) copy any Palantir Technology (or component thereof) or develop any improvement, modification, or derivative work thereof, except for Sample Materials to the extent necessary for Customer’s use of the Service; (k) include any portion of any Palantir Technology in any other service, equipment, or item; (l) allow the transfer, transmission (including without limitation making available on-line, electronically transmitting, or otherwise communicating, to the public), export, or re-export of any Palantir Technology (or any portion thereof) or any Palantir technical data; (m) perform penetration tests on the Service unless authorized by Palantir; (n) use, evaluate, or view the Palantir Technology for the purpose of designing, modifying, or otherwise creating any environment, software, models, algorithms, products, program, or infrastructure or any portion thereof, which performs functions similar to the functions of the Palantir Technology; (o) remove, obscure, or alter, or otherwise violate the terms of any copyright notice, trademarks, logos, and trade names and any other notices (including third party open source or similar licenses) or identifications that appear on or in any Palantir Technology and any associated media; (p) use the Website or Palantir Technology to engage in or advance any fraud or misrepresentation (including but not limited to providing fraudulent or misleading information in response to the Order Submission Form); or (q) use or access the Service for the purposes of engaging in or supporting spamming activities or communications, or marketing activities or communications in violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act (15 U.S.C. § 7701 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and all other applicable laws prohibiting spam or otherwise governing transmission of marketing materials and/or communications. Notwithstanding the foregoing, or any statement to the contrary herein, Third Party Content may be made available with notices and open source or similar licenses from such communities and third parties that govern the use of those portions, and Customer hereby agrees to be bound by and fully comply with all such licenses; however, the disclaimer of warranty and limitation of liability provisions in this Agreement will apply to all such Third Party Content.
6. Confidentiality. Each Party (the “Receiving Party”) shall keep strictly confidential all Confidential Information of the other Party (the “Disclosing Party”), and shall not use such Confidential Information except for the purposes of this Agreement, and shall not disclose such Confidential Information to any third party other than disclosure on a need-to-know basis to the Receiving Party’s directors, employees, agents, attorneys, accountants, subcontractors, or other representatives who are each subject to obligations of confidentiality at least as restrictive as those herein (“Authorized Representatives”). The Receiving Party shall use at least the same degree of care as it uses to prevent disclosure of its own confidential information, but in no event less than reasonable care. The Receiving Party may, without violating the obligations of the Agreement, disclose Confidential Information to the extent required by a valid court or government order, or as required by applicable law, provided that the Receiving Party: (a) provides the Disclosing Party with reasonable prior written notice of such disclosure and (b) uses reasonable efforts to limit disclosure and to obtain, or to assist the Disclosing Party in obtaining, confidential treatment or a protective order preventing or limiting the disclosure, while allowing the Disclosing Party to participate in the proceeding. “Confidential Information” means (i) in the case of Palantir, Palantir Technology (including any information relating thereto); (ii) in the case of Customer, Customer Data; and (iii) any other information which by the nature of the information disclosed or the manner of its disclosure would be understood by a reasonable person to be confidential, in each case, in any form (including without limitation electronic or oral) and whether furnished before, on, or after the Effective Date; provided, however, that Confidential Information shall not include any information that (1) is or becomes part of the public domain through no act or omission of the Receiving Party or its Authorized Representatives; (2) is known to the Receiving Party at the earlier of the Effective Date or the time of disclosure by the Disclosing Party (as evidenced by written records) without an obligation to keep it confidential; (3) was rightfully disclosed to the Receiving Party prior to the Effective Date from another source without any breach of confidentiality by the third party discloser and without restriction on disclosure or use; or (4) the Receiving Party can document by written evidence that such information was independently developed without any use of or reference to Confidential Information. The Receiving Party shall be liable for any breaches of this Section by any person or entity to which the Receiving Party is permitted to disclose Confidential Information pursuant to this Section. The Receiving Party’s obligations with respect to Confidential Information shall survive termination of this Agreement for five (5) years; provided, that the Receiving Party’s obligations hereunder shall survive termination and continue in perpetuity, or as long as permitted by applicable law, with respect to any Confidential Information that is a trade secret under applicable law.
7. Fees and Payment; Taxes. The Service is deemed delivered upon the provision of access to Customer or for Customer’s benefit. If there are fixed fees set forth in the Order Submission Form, such fees will be invoiced and payable on an upfront basis, or as otherwise set forth in the Order Submission Form. Any usage-based fees set forth in the Order Submission Form, including if payable in excess of any applicable included usage specified in the Order Submission Form, will be calculated in accordance with the usage rates set forth in the Order Submission Form (as applicable) and invoiced and payable quarterly in arrears, or as otherwise set forth in the Order Submission Form. All payments shall be made via wire transfer to an account designated by Palantir in the currency set forth on the corresponding invoice, or any other payment method agreed upon by the Parties (including as specified in the Order Submission Form) and as set forth on the corresponding invoice, within thirty (30) days after the date of issuance of Palantir’s invoice. Any late payments shall be subject to a service charge equal to the lesser of 1.5% per month of the amount due or the maximum amount of interest allowed by applicable law. Unless otherwise stated in the Order Submission Form, fees are exclusive of applicable Taxes (except taxes on or measured by the net income of Palantir). Customer shall be responsible for all Taxes arising under this Agreement so that after payment of such Taxes the amount Palantir receives is not less than the fees set forth in the Order Submission Form. In the event a double taxation treaty applies, which provides a zero or reduced withholding tax rate, Customer agrees (a) not to withhold taxes in case of a zero withholding tax rate or (b) to withhold at the reduced tax rate in accordance with the double taxation treaty.
8. Term and Termination; Suspension.
8.1 Term. Unless specified otherwise in the Order Submission Form, this Agreement is effective as of the Effective Date and shall continue in effect for thirty (30) days from the Effective Date (the “Term”), unless otherwise terminated as provided herein. Notwithstanding the foregoing, if specified otherwise in the Order Submission Form, “Term” shall mean the period from the Effective Date until the expiration of the term as specified in the Order Submission Form.
8.2 Termination for Cause. Without limiting either Party’s other rights, either Party may terminate this Agreement for cause (a) in the event of any material breach by the other Party of any provision of this Agreement and failure to remedy the breach (and provide reasonable written notice of such remedy to the non-breaching Party) within thirty (30) days following written notice of such breach from the non-breaching Party or (b) if the other Party seeks protection under any bankruptcy, receivership or similar proceeding or such proceeding is instituted against that Party and not dismissed within ninety (90) days. Except where an exclusive remedy is specified in this Agreement, the exercise by either Party of the right to terminate under this provision shall be without prejudice to any other remedies it may have under this Agreement or by law. In the event of termination of this Agreement by Customer for cause pursuant to Section 8.2(a) or by Palantir for Customer’s failure to satisfy the Palantir Compliance Requirements as set forth in Section 8.4(c) (Suspension of Services), Palantir shall provide a pro-rated refund of any fees pre-paid for Services not utilized as of the effective date of termination.
8.3 Effect of Termination. Upon any termination or expiration of this Agreement, except as specifically set forth below, all Customer’s rights, access, and licenses granted to Palantir Technology shall immediately cease and Customer shall promptly return or destroy all Data Connection Software, Sample Materials, and Documentation, and all other Palantir Confidential Information, and, upon written request, certify its compliance with the foregoing to Palantir in writing within ten (10) days of such request. Upon termination or expiration of this Agreement, if requested by Customer, Customer shall, subject to the terms of this Agreement, have access to the Service for thirty (30) days solely for the purpose of retrieving Customer Data. Palantir shall thereafter delete all Customer Data. Notwithstanding the foregoing, Palantir shall retain, subject to the other terms of this Agreement, and solely for security purposes, usage information and metadata related to the security of the Service, excluding Customer Data (except for security-related information such as IP addresses, usernames, log-in attempts, and search queries), for a period of two (2) years following the last event logged. No termination or expiration of this Agreement shall limit or affect rights or obligations that accrued prior to the effective date of termination or expiration (including without limitation payment obligations). Sections 1, 4 (excluding Section 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14, and 15 shall survive any termination or expiration of this Agreement.
8.4 Suspension of Services. If Palantir reasonably determines that: (a) You do not have authorization to bind Customer to this Agreement on Customer’s behalf (in violation of the express representation and warranty in the preamble of this Agreement); (b) Customer’s use of the Service, Palantir Technology, or Website violates applicable law or otherwise violates a material term of this Agreement (including Section 3.2 (Data Protection), Section 4 (Acceptable Use), Section 5.3 (Restrictions), Section 6 (Confidentiality), and Section 7 (Fees and Payment)); (c) Customer does not satisfy the Palantir Compliance Requirements; or (d) Customer has breached any of the warranties set forth in Section 11, Palantir reserves the right to disable, suspend, or terminate Customer’s access to all or any part of the Website and/or the Palantir Technology.
9. Indemnification.
9.1 Palantir Indemnification. Palantir shall defend Customer against any claim of infringement or violation of any Intellectual Property Rights asserted against Customer by a third party based upon Customer’s use of Palantir Technology in accordance with the terms of this Agreement and indemnify and hold harmless Customer from and against reasonable costs, attorneys’ fees, and damages, if any, finally awarded against Customer pursuant to a non-appealable order by a court of competent jurisdiction in such claim or settlement entered into by Palantir. If Customer’s use of any of the Palantir Technology is, or in Palantir’s opinion is likely to be, enjoined by a court of competent jurisdiction due to the type of infringement specified above, or if required by settlement approved by Palantir in writing, Palantir may, in its sole discretion: (a) substitute substantially functionally similar products or services; (b) procure for Customer the right to continue using the Palantir Technology; or (c) if Palantir reasonably determines that options (a) and (b) are commercially impracticable, terminate this Agreement and refund to Customer a pro-rated portion of the fees paid hereunder for the terminated Palantir Technology that reflects the remaining portion of the Term (or, Initial Term or Renewal Term, if and as applicable) active at the time of termination. The foregoing indemnification obligations of Palantir shall not apply: (i) if Palantir Technology is modified by or at the direction of Customer or Users, but only to the extent the alleged infringement would not have occurred but for such modification; (ii) if Palantir Technology is combined with non-Palantir products not authorized by Palantir, but only to the extent the alleged infringement would not have occurred but for such combination; (iii) to any unauthorized use of Palantir Technology, any use that is not consistent with the Documentation, any use that violates Section 4 (Acceptable Use), or use during any period of suspension (as set forth in Section 8.4); (iv) to any Customer Data; or (v) to any non-Palantir products or services.
9.2 Customer Indemnification. Customer shall defend Palantir against any third party claim asserted against Palantir arising from or relating to (a) Customer’s violation of applicable law, (b) Customer Data, (c) Customer’s breach of the DPA, (d) Customer’s breach of Section 4 (Acceptable Use), (e) Customer’s breach of Section 5.3 (Restrictions), or (f) any Customer-offered product or service (except if such claim is attributable to the Service as offered by Palantir) and indemnify and hold harmless Palantir from and against related costs, attorneys’ fees, and damages, if any, issued by a competent authority or finally awarded pursuant to a non-appealable order.
9.3 Indemnification Procedure. The obligations of the indemnifying Party shall be conditioned upon the indemnified Party providing the indemnifying Party with: (a) prompt written notice (in no event to exceed twenty (20) days) of any claim, suit, or demand of which it becomes aware; (b) the right to assume the exclusive defense and control of any matter that is subject to indemnification (provided that the indemnifying Party will not settle any claim unless it unconditionally releases the indemnified Party of all liability and does not admit fault or wrongdoing by the indemnified Party); and (c) cooperation with any reasonable requests assisting the indemnifying Party’s defense and settlement (at the indemnifying Party’s expense). This Section sets forth each Party’s sole liability and obligation and the sole and exclusive remedy with respect to any claim of Intellectual Property Rights infringement.
10.1 Palantir Warranty. Palantir warrants that during the Term (a) the Service will be provided substantially in accordance with the applicable Documentation and (b) the Professional Services will be provided in a professional and workmanlike manner. In the event of a breach of an above warranty, Customer may give Palantir written notice of termination of this Agreement, which termination will be effective thirty (30) days after Palantir’s receipt of the notice, unless Palantir is able to remedy the breach prior to the effective date of termination. This warranty shall not apply to the extent such breach is caused by Customer Data or misuse or unauthorized modification of the Service (including but not limited to Customer’s violation of Section 4 (Acceptable Use)) or any Customer selected hardware used in connection with the Service. In the event of termination of this Agreement pursuant to Customer’s exercise of its right under this Section, Customer shall be entitled to receive from Palantir, as its sole and exclusive remedy, a refund of a pro-rated portion of the fees paid hereunder that reflects the remaining portion of the Term (or, Initial Term or Renewal Term, if and as applicable) active at the time of termination.
10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETTABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN, AND ONLY TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED “AS-IS” WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
11. Customer Warranty. Customer warrants that (a) Customer has provided all necessary notifications and obtained all necessary consents, authorizations, approvals, and/or agreements as required by any applicable laws or policies, and has informed Palantir of any obligations applicable to Palantir’s processing of Customer Data, in order to enable Palantir to process Customer Data, including personal data, according to the scope, purpose, and instructions specified by Customer and that Customer will not direct the processing of Customer Data by Palantir in violation any laws or regulations (including localization requirements) or rights of third parties; (b) it will not use the Service for any unauthorized or illegal purposes; and (c) it will not upload or import Customer Data to the Service requiring additional documentation without first executing such documentation. All Customer Data that Customer integrates, uses, or otherwise makes available in or through use of the Service and the conclusions drawn therefrom are done at Customer’s own risk and Customer will be solely liable and responsible for any damage or losses to any party resulting therefrom.
12. Limitations of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.
13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S).
14.1 Updates to this Agreement. Palantir reserves the right to amend this Agreement at any time and will update this Agreement in the event of any such amendments. Palantir will notify Customer of ex-post changes to this Agreement at least sixty (60) days prior to the expiration of the then-active Term by posting a notice on the Website and/or sending an email to the primary email address specified in an applicable Order Submission Form or on Customer’s Account. Any amendments to this Agreement will become effective at the beginning of the Renewal Term immediately following the then-active Term. Customer’s continued use of the Palantir Technology within thirty (30) days of the expiration of the then-active Term constitutes agreement to those revisions of this Agreement. For any other modifications, Customer’s continued use of the Palantir Technology constitutes agreement to our revisions of this Agreement. Palantir reserves the right at any time and from time to time to modify (including the deprecation of functionality or tools), temporarily or permanently, the Palantir Technology (or any part thereof) with or without notice.
14.2 Pricing Updates. In the event of a price modification, Palantir will notify Customer in writing of such price increase at least sixty (60) days prior to the expiration of the then-active Term, and the price modification will only take effect at the beginning of the Renewal Term immediately following the then-active Term.
15. Miscellaneous. Palantir shall provide the Service and Professional Services consistent with laws and regulations applicable to Palantir’s provision of such Service and Professional Services generally, including but not limited to, regarding data protection and international transfers of personal data, without regard to Customer’s specific utilization of the Service except to the extent set forth in the Order Submission Form, and subject to Customer’s compliance with this Agreement. The Parties shall comply with the Palantir AIP Addendum available at https://palantir.pactsafe.io/aip-legal-3791.html, which is hereby incorporated by reference. Except with Palantir’s prior written consent, neither this Agreement nor the access or licenses granted hereunder may be assigned, transferred, or sublicensed by Customer, including, without limitation, pursuant to a change of control of Customer or sale of all or substantially all of the assets of Customer; any attempt to do so shall be void. Palantir may assign or delegate this Agreement, in whole or in part, to any person or entity at any time with or without Customer’s consent. Palantir may terminate this Agreement in the event of a change of control of Customer or sale of all or substantially all of the assets of Customer. Palantir may subcontract this Agreement or portions thereof. Any notice required or permitted hereunder shall be in writing to Customer at the address(es) set forth in the Order Submission Form and if by email, notifications to Palantir shall be sent to legalnotices@palantir.com or 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). If any provision of this Agreement shall be adjudged by any court or tribunal of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect and be enforceable. No waiver of any breach shall be deemed a waiver of any subsequent breach. The Service and Professional Services are subject to control under U.S. export and sanctions laws and regulations, including the U.S. Export Administration Regulations (“EAR”) administered by the Department of Commerce’s Bureau of Industry and Security (“BIS”) and embargo and sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”). The Service controlled under 5D002.c.1, ENC. Customer shall ensure that all exports, reexports, transfers, end-uses, and Users of the Service comply with the export and sanctions laws and regulations of the United States and other applicable jurisdictions, including without limitation those of the U.S. Bureau of Industry & Security and the Office of Foreign Assets Control. Customer represents that it is not subject to restrictions under any U.S. government restricted end user lists, and that it is not 50% or more, directly or indirectly, owned or controlled by any individuals or entities identified on such lists. Customer will immediately notify Palantir if Customer becomes subject to any such restrictions. Customer shall refrain from taking any action that causes Palantir to violate applicable export and sanctions laws and regulations. Except for the obligation to pay money, neither Party will be liable for any failure or delay under this Agreement due to any cause beyond its reasonable control, including without limitation acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor shortage or dispute, governmental act, or failure of the Internet, telecommunications, or hosting service provider, computer attacks, or malicious acts; provided that the delayed Party: (a) gives the other Party prompt notice of such cause; and (b) uses commercially reasonable efforts promptly to correct such failure or delay in performance. Palantir has the right to immediately suspend access to the Service: (a) if Customer is in material breach of this Agreement; (b) to prevent a security incident impacting Customer, Customer Content, or the Service; or (c) if continued access would violate applicable laws or if required to do so pursuant to applicable law or regulation or requests or orders of governmental, regulatory, or judicial authorities. There are no third party beneficiaries under this Agreement, whether express or implied. For the avoidance of doubt, nothing in this Agreement shall be construed to create a joint venture, employment, partnership, strategic alliance, formal alliance, or strategic partnership relationship between the Parties. This Agreement is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this Agreement. In the event of a conflict between these Terms of Service and any Order Submission Forms or exhibit, the terms of such Order Submission Form or exhibit will prevail. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.
COUNTRY-SPECIFIC ADDENDUM
For Customers located in any of the countries identified in this Country-Specific Addendum (the “Addendum”) and for whom the Palantir Terms of Service (“Terms of Service”) will not be governed by New York law (for example, because the choice of law provision in Section 13 of the Terms of Service will be ineffective under applicable law), the following country-specific provisions below will replace or supplement the equivalent provisions in the Terms of Service as noted. Capitalized terms used in this Addendum not defined herein shall have the same meaning provided to them in the Terms of Service.
UNITED KINGDOM
1. Termination. If Customer is a natural person, the following new subsection shall be added to the Terms of Service as Section 8.5, immediately following Section 8.4:
“8.5 Cancellation Period Required by Law. If Customer is a natural person, Customer has the right to terminate this Agreement no later than fourteen (14) calendar days after the Effective Date (the “Cancellation Period”), for any or no reason. To exercise the foregoing termination right, Customer must notify Palantir of its decision to exercise this right upon sending an email to legalnotices@palantir.com within the Cancellation Period clearly stating Customer’s intention to exercise the termination right provided in this Section 8.5. Palantir will reimburse to Customer any payments received from Customer prior to the effective date of termination pursuant to this Section 8.5, no later than thirty (30) days after the effective date of termination using the same means of payment as Customer used, unless Customer has expressly agreed otherwise.
2. Disclaimer. If Customer is a natural person, Section 10.2 of the Terms of Service shall be replaced with the following:
“10.2 Disclaimer. NO AMOUNTS PAID HEREUNDER ARE REFUNDABLE OR OFFSETABLE EXCEPT AS OTHERWISE EXPLICITLY SET FORTH HEREIN. EXCEPT AS EXPRESSLY SET FORTH HEREIN , THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES ARE PROVIDED "AS-IS" WITHOUT ANY OTHER WARRANTIES OF ANY KIND AND PALANTIR AND ITS SUPPLIERS AND SERVICE PROVIDERS HEREBY DISCLAIM ALL CONDITIONS, WARRANTIES AND OTHER TERMS OF ANY KIND, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, RELATING TO THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES PROVIDED HEREUNDER OR OTHERWISE THAT ARE NOT EXPRESSLY SET OUT IN THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF NON-INFRINGEMENT, SATISFACTORY QUALITY, MERCHANTABILITY, TITLE, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE FOREGOING LIMITATION, PALANTIR DOES NOT WARRANT THAT THE PALANTIR TECHNOLOGY AND PROFESSIONAL SERVICES WILL MEET CUSTOMER REQUIREMENTS OR GUARANTEE ANY RESULTS, OUTCOMES, OR CONCLUSIONS OR THAT OPERATION OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. PALANTIR IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY SERVICES (INCLUDING WITHOUT LIMITATION, UPTIME GUARANTEES, OUTAGES, OR FAILURES), CUSTOMER DATA, OR ANY THIRD PARTY CONTENT. PALANTIR DOES NOT CONTROL THE TRANSFER OF INFORMATION OR CUSTOMER DATA OVER COMMUNICATIONS FACILITIES, THE INTERNET, OR THIRD PARTY SERVICES, AND THE SERVICE MAY BE SUBJECT TO DELAYS AND OTHER PROBLEMS INHERENT IN THE USE OF SUCH COMMUNICATIONS FACILITIES. PALANTIR IS NOT RESPONSIBLE FOR ANY DELAYS, FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS. THIS SECTION APPLIES ONLY TO THE EXTENT PERMITTED BY LAW.”
3. Limitation of Liability. If Customer is a natural person, Section 12 of the Terms of Service shall be replaced with the following:
“12. Limitations of Liability. NOTHING IN THIS AGREEMENT SHALL LIMIT OR EXCLUDE LIABILITY FOR PERSONAL INJURY OR DEATH CAUSED BY NEGLIGENCE, FOR FRAUD OR FRAUDULENT MISREPRESENTATION OR FOR LIABILITY WHICH MAY NOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SUBJECT TO THE FOREGOING, BUT NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY OR ITS AFFILIATES FOR ANY (A) COST OF PROCUREMENT OF ANY SUBSTITUTE PRODUCTS OR SERVICES, OR COST OF REPLACEMENT OR RESTORATION OF ANY CUSTOMER DATA, (B) ECONOMIC LOSSES, EXPECTED OR LOST PROFITS, REVENUE, OR ANTICIPATED SAVINGS, LOSS OF BUSINESS, LOSS OF CONTRACTS, LOSS OF OR DAMAGE TO GOODWILL OR REPUTATION, AND/OR (C) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE, WHETHER ARISING OUT OF PERFORMANCE OR BREACH OF THIS AGREEMENT OR THE USE OR INABILITY TO USE THE PALANTIR TECHNOLOGY, EVEN IF THE PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH LOSS OR DAMAGES. EXCEPT FOR THE PARTIES' OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED THE GREATER OF A) THE FEES PAID OR PAYABLE TO PALANTIR BY CUSTOMER UNDER THE AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM FOR THE SERVICE OR PROFESSIONAL SERVICES THAT GAVE RISE TO SUCH CLAIM OR B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. NOTWITHSTANDING THE FOREGOING SENTENCE, IF NO FEES ARE PAYABLE BY CUSTOMER DURING THE TERM, EXCEPT FOR THE PARTIES’ OBLIGATIONS SET FORTH IN SECTIONS 5 AND 9.2 OF THIS AGREEMENT AND CUSTOMER’S PAYMENT OBLIGATIONS HEREUNDER, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY AGREES THAT THE MAXIMUM AGGREGATE LIABILITY OF EITHER PARTY AND ITS AFFILIATES TO THE OTHER PARTY AND ITS AFFILIATES FOR ALL CLAIMS OF ANY KIND SHALL NOT EXCEED FIFTY THOUSAND DOLLARS (USD 50,000), AND THAT SUCH REMEDY IS FAIR AND ADEQUATE. THE LIMITATIONS SET FORTH IN THIS SECTION 12 SHALL APPLY REGARDLESS OF WHETHER AN ACTION IS BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY.”
4. Dispute Resolution. If Customer is a natural person, Section 13 of the Terms of Service shall be replaced with the following:
“13. DISPUTE RESOLUTION. ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT, INCLUDING ARBITRABILITY, THAT IS FOR AN AMOUNT EXCEEDING FIVE THOUSAND GREAT BRITISH POUNDS (5,000 GBP) THAT CANNOT BE RESOLVED FOLLOWING GOOD FAITH DISCUSSIONS WITHIN SIXTY (60) DAYS AFTER NOTICE OF A DISPUTE SHALL BE FINALLY SETTLED BY ARBITRATION. IF CUSTOMER IS LOCATED IN THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF THE STATE OF NEW YORK, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND ARBITRATION SHALL BE ADMINISTERED IN NEW YORK, NEW YORK, UNITED STATES UNDER THE COMPREHENSIVE ARBITRATION RULES AND PROCEDURES OF THE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. (“JAMS”) AND THE FEDERAL RULES OF EVIDENCE (NOTWITHSTANDING JAMS RULE 22(D) OR ANY OTHER JAMS RULE TO THE CONTRARY). IF CUSTOMER IS LOCATED OUTSIDE OF THE AMERICAS, THEN THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE ADMINISTERED IN LONDON, UNITED KINGDOM UNDER THE RULES OF ARBITRATION OF THE INTERNATIONAL CHAMBER OF COMMERCE (“ICC RULES”); PROVIDED THAT IF CUSTOMER IS A BUSINESS ENTITY ORGANIZED UNDER THE LAWS OF THE KINGDOM OF SAUDI ARABIA, THEN NOTWITHSTANDING THE FOREGOING, THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AND ARBITRATION SHALL BE CONDUCTED IN THE ENGLISH LANGUAGE AND ADMINISTERED IN RIYADH, KINGDOM OF SAUDI ARABIA UNDER THE RULES OF ARBITRATION OF THE SAUDI CENTER FOR COMMERCIAL ARBITRATION (“SCCA”). NOTWITHSTANDING THE FOREGOING, EACH PARTY SHALL HAVE THE RIGHT TO INSTITUTE AN ACTION AT ANY TIME IN A COURT OF PROPER JURISDICTION FOR PRELIMINARY INJUNCTIVE RELIEF PENDING A FINAL DECISION BY THE ARBITRATOR(S), PROVIDED THAT (A) THE PARTY INSTITUTING THE ACTION SHALL SEEK AN ORDER TO FILE THE ACTION UNDER SEAL (OR AT A MINIMUM DO SO FOR ANY FILINGS CONTAINING CONFIDENTIAL INFORMATION OR TRADE SECRETS) IN ORDER TO LIMIT DISCLOSURE AS PROVIDED IN SECTION 6 OF THIS AGREEMENT; AND (B) A PERMANENT INJUNCTION AND DAMAGES SHALL ONLY BE AWARDED BY THE ARBITRATOR(S). ANY DISPUTE, CONTROVERSY, OR CLAIM ARISING FROM OR RELATING TO THIS AGREEMENT THAT IS NOT REQUIRED TO BE REFERRED TO ARBITRATION PURSUANT TO THE FOREGOING SHALL BE REFERRED TO THE COURTS OF ENGLAND AND WALES, AND THE GOVERNING LAW SHALL BE THE SUBSTANTIVE LAWS OF ENGLAND AND WALES, WITHOUT REGARD TO CONFLICTS OF LAW PROVISIONS THEREOF, AND WITHOUT REGARD TO THE UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS."
Data Protection Addendum (AIP Now)
Effective January 14th 2025
DownloadTable of Contents
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED IN THE AGREEMENT), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS DPA, THAT YOU UNDERSTAND THE TERMS OF THIS DPA, AND THAT YOU, IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, OR YOU AND THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS DPA. IF YOU ARE ENTERING INTO THESE TERMS IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, YOU ALSO REPRESENT AND WARRANT THAT YOU ARE NOT USING THE PALANTIR TECHNOLOGY ON BEHALF OF OR UNDER THE INSTRUCTIONS OF ANY OTHER THIRD PARTY OR LEGAL ENTITY. IF YOU ARE ENTERING INTO THIS DPA ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS DPA ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS DPA, DO NOT SELECT "I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS DPA, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
The customer agreeing to the terms of this DPA (“Customer”) and the Palantir Technologies entity that is the signatory to the Agreement (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing Customer’s use of Palantir Technology, including the Service, and the provision of related Professional Services to Customer by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This DPA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer under the Agreement. Any capitalized terms used but not defined in this DPA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the terms and conditions in this DPA shall prevail and control.
1 DEFINITIONS
1.1 The following capitalized terms will have the meanings indicated below:
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data that is subject to Data Protection Laws;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all applicable laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of a Controller, including as applicable the terms “processor”, “service provider” “contractor” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws as applicable;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
2 TERM
2.1 This DPA will take effect from the DPA Effective Date and remain in effect until the destruction or return of all Customer Personal Data by Palantir in accordance with the Agreement, at which point it will automatically terminate.
3 SCOPE AND APPLICATION
3.1 This DPA is incorporated into, and forms part of, the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer when in the course of the provision of the Service. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the provisions in this DPA shall prevail and control.
4 ROLE OF THE PARTIES
4.1 Customer and any relevant Customer Affiliate, hereby appoints and instructs Palantir as a Processor, or Subprocessor as applicable, of the Customer Personal Data. Accordingly, the Parties shall comply with applicable Data Protection Laws as relevant to their respective Processing of Customer Personal Data under the Agreement.
4.2 As between the Parties, Customer shall be liable and responsible as the Controller (or Processor, if Customer is Processing Personal Data with the Service for a third-party Controller) and Palantir shall be liable and responsible as the Processor (or Subprocessor), in respect of Customer Personal Data processed under the Agreement.
4.3 In the event that Customer acts as a Processor (or Subprocessor) in respect of Customer Personal Data, Customer represents and warrants to Palantir that it is validly authorized by the relevant Controller to enter into the Agreement and this DPA and to provide Customer Instructions (as defined below) on behalf of Controller in relation to Customer Personal Data.
4.4 In the event that Customer is an employee of Palantir or a Palantir Affiliate, Customer acknowledges that it is not acting on behalf of Palantir or any Palantir Affiliate and is acting as a separate and independent Controller in relation to the Processing of Customer Personal Data via the Palantir Technology.
4.5 In the event that Customer jointly controls Customer Personal Data with a third-party Controller, Customer represents and warrants that its Processing of Customer Personal Data in connection with its use of the Palantir Technology is duly authorised by such third-party Controller and is carried out in compliance with applicable Data Protection Laws.
4.6 In the event that Customer introduces any new User to the Palantir Technology (whether such User is acting on his/her own behalf or on behalf of a third party), Customer shall procure that any such User enters into a separate arrangement directly with Palantir in relation to such use (including any applicable Palantir Terms of Service and any related DPA) and acknowledges that any such User's use of the Palantir Technology shall be conditional on their doing so.
4.7 The subject matter and details of Processing are described in the Agreement and this DPA, including Exhibit B (subject matter and details of Customer Personal Data processing) and any other relevant exhibits for applicable additional Services.
4.8 Palantir shall process Prompts and Outputs as Usage Data, as further described in the Agreement and AIP Now Privacy Policy, to secure the Service, including monitoring for abuse or malicious User activity.
5 CUSTOMER PROCESSING OF PERSONAL DATA
5.1 Customer shall ensure that any Processing of Customer Personal Data via Customer’s use of the Service, including any instructions provided to Palantir in relation to such Processing, shall comply with all applicable Data Protection Laws.
5.2 Customer instructs Palantir to Process Customer Personal Data: (a) to provide the Service specified in the Agreement and Documentation or otherwise perform its obligations thereunder; (b) as further initiated by Customer via Customer’s or Users use of the Service in accordance with the Agreement and Documentation; and/or (c) in accordance with any additional instruction outside the scope of the Agreement or this DPA, as further documented in any other written instructions given by Customer and acknowledged by Palantir in writing as constituting instructions for purposes of this DPA (collectively, “Customer Instructions”). Customer acknowledges that any additional Customer Instructions issued under (c) above may result in additional charges or fees to the Customer by Palantir, which shall be payable in accordance with the terms of the Agreement.
5.3 Customer shall have sole responsibility for the lawful Processing of Customer Personal Data in connection with its use of the Palantir Technology and/or its receipt of any related Professional Services in accordance with applicable Data Protection Laws, including without limitation, the accuracy, quality, and legality of the Customer Personal Data, the means by which it acquires and uses Customer Personal Data, and the Customer Instructions regarding the Processing of Customer Personal Data. Customer represents and warrants that it has (or its Controller has) a valid legal basis for the Processing of Customer Personal Data and has (or its Controller has) provided (or procured the provision of) all notifications and obtained (or procured the provision of) all consents (including Consents), authorisations, approvals, and/or agreements (including, where Customer is a Processor or Subprocessor, with and from the applicable Controller(s)) required under applicable laws or policies in order to enable Palantir to receive and Process Customer Personal Data in accordance with this DPA, the Agreement and Customer Instructions.
5.4 The Customer shall be responsible for providing guidance to Users regarding the use of the Services and in particular the use of Personal Data within the Services.
5.5 The Customer Personal Data shall not include any:
5.5.1 government related identifiers (where that term is defined under applicable Data Protection Laws) to the extent that the Processing of such government related identifiers are not permitted under applicable Data Protection Laws;
5.5.2 Personal Data relating to children (in accordance with the relevant age of majority in applicable jurisdictions), unless permitted under, or in compliance with applicable Data Protection Laws; or
5.5.3 Personal Data which is under the Control of another Controller, without their express authorisation.
6 PALANTIR PROCESSING OF CUSTOMER PERSONAL DATA
6.1 Palantir will Process Customer Personal Data for the business purposes of providing to Customer the services, namely the Palantir Technology and Professional Services pursuant to the Customer Instructions and any other purpose for which the Customer provides authorization via the Service, where such option is made available ("Business Purposes"), in accordance with the terms of the Agreement and this DPA as well as any requirements set out by applicable Data Protection Laws. For the avoidance of doubt, Customer is disclosing Customer Personal Data to Palantir only for the limited and specified Business Purposes set forth within the Agreement and the Customer Instructions. Palantir shall process Customer personal Data pursuant to Customer’s instructions and shall:
(a) designate and maintain a Data Protection Officer as required by Data Protection Laws, which can be contacted at privacy@palantir.com;
(b) not Sell or Share Customer Personal Data or otherwise retain, use, disclose, or Process Customer Personal Data outside of the direct business relationship between the Parties or for any purpose other than for the fulfilment of the Business Purposes pursuant to Customer Instructions, unless obligated to do otherwise by applicable law or regulation or requests or orders of judicial, governmental or regulatory entities (including without limitation subpoenas), in which case Palantir will inform Customer of that legal requirement before such Processing occurs unless legally prohibited from doing so;
(c) not combine Customer Personal Data with Personal Data that it receives from other sources or collects from its own interactions with a Data Subject, provided, that Palantir may combine Customer Personal Data as necessary to perform its Business Purposes and will not Sell or Share Customer Personal Data;
(d) implement appropriate Technical and Organisational Measures to protect the confidentiality, integrity, availability and resilience of Palantir’s systems Processing Customer Personal Data. Palantir may update the Technical and Organisational Measures from time to time provided that any such updates are no less protective than the original Technical and Organisational Measures. To the extent such assistance requires Palantir to take additional steps beyond those imposed on Palantir by Data Protection Laws or specifically required pursuant to the Agreement; or to the extent the relevant technical and organizational measures are required as a result of an act or omission by Customer or a Party acting on behalf of Customer in breach of this Agreement or Data Protection Laws, then Palantir’s obligation to provide such assistance shall be subject to Customer’s payment of Palantir’s reasonable fees in respect of such additional assistance; Palantir’s security obligations under this DPA apply without prejudice to the Customer’s own security obligations under applicable Data Protection Laws;
(e) ensure that all persons authorized by Palantir to Process Customer Personal Data, including any Subprocessors (as defined below), are bound by confidentiality obligations consistent with those set out in this DPA, the Agreement or otherwise sufficient to meet the requirements of Data Protection Laws;
(f) take reasonable steps to return or destroy Customer Personal Data, when it is no longer necessary for the purposes of performing the relevant Services upon termination of the Agreement, unless storage is otherwise required under applicable Data Protection Laws; and
(g) process Customer Personal Data in a manner that is consistent with the same level of privacy protection that is required of Customer under applicable Data Protection Laws.
6.2 Customer shall instruct Palantir as to the subject-matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and the categories of Data Subjects taking into account the specific tasks and responsibilities of the Processor in the context of the Processing to be carried out and the risk to the rights and freedoms of the Data Subject as part of Customer Instructions. Notwithstanding anything to the contrary herein, Customer shall ensure that its acts or omissions, including in relation to any Customer Instructions to Palantir, do not put Palantir in breach of the Data Protection Laws.
6.3 Customer has assessed the level of security appropriate to the Processing in the context of its obligations under Data Protection Laws and agrees that the Technical and Organisational Measures are consistent with such assessment. Customer further acknowledges that Palantir is not able to assess, and does not have knowledge of, the specific Personal Data provided by Customer to Palantir or made available by Customer to Palantir in relation to the Services and that as a result the technical and organisational Measures proposed by Palantir are generic in nature and Palantir is unable to assess whether or not they reflect any particular risks posed by the Personal Data.
7 SUBPROCESSORS
7.1 Customer specifically authorizes the engagement as Subprocessors of (a) the entities listed in Exhibit A and/or applicable specific additional Services exhibits in this DPA and (b) all Palantir Affiliates from time to time, provided that, prior to permitting such Subprocessors to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.2 Subject to Section 7.3, Customer generally authorizes Palantir to engage additional Subprocessors (“Additional Subprocessors”), provided that, prior to permitting such Additional Subprocessor to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Additional Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.3 At least 30 days before Palantir initiating the use of an Additional Subprocessor in connection with the provision of Services to Customer, the updated list of Subprocessors for the Service shall be available in Exhibit A, also accessible here https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795, and Palantir shall provide Customer with a mechanism to obtain notice of that update. The Parties agree this notification satisfies the notification requirements of Section 28.2 of the GDPR and Clause 9 of the SCC. Where Customer indicates in writing that it objects to the Processing of Customer Personal Data by such Additional Subprocessor, the Parties shall seek to resolve the Customer concerns and where necessary the Customer may exercise its applicable rights to terminate the Agreement.
7.4 To the extent required by Data Protection Law, Palantir shall remain liable to Customer for the performance of the Subprocessor’s obligations in relation to this Section 7 (“Subprocessor Data Protection Liability”), and Palantir shall be permitted to re-perform or to procure the re-performance of any such obligations and Customer acknowledges that such re-performance shall diminish any claim that Customer has against Palantir in respect of any Subprocessor Data Protection Liability.
8 AUDIT
8.1 Palantir uses third party auditors to verify the adequacy of its security measures. This audit is performed at least annually, by independent and reputable third-party auditors at Palantir’s selection and expense, and in accordance with Service Organization Controls 2 (SOC2) or substantially equivalent industry standards, and results in the generation of an audit report (“Report”) which will be the Confidential Information of Palantir. The Service and operations are also certified compliant with the standards and accreditations set out on the “compliance and accreditation” tab at: https://www.palantir.com/information-security/ (“Accreditations”).
8.2 At Customer’s written request, Palantir will provide Customer with a confidential summary of the Report, documentation evidencing compliance with the Accreditations, and the Accountability Information outlined in Section 10 of this DPA so that Customer can reasonably verify Palantir’s compliance with the data security and data protection obligations under this DPA. Subject to Section 8.3, if Data Protection Laws, Standard Contractual Clauses, or the Agreement require Palantir to provide Customer with access to Palantir facilities or information in addition to the Report and the Accountability Information, then Palantir shall permit Customer to audit Palantir’s compliance with the terms and conditions of this DPA as it applies to Customer Personal Data to the extent expressly required by the Agreement, the Standard Contractual Clauses, or Data Protection Laws.
8.3 In order to request an audit of Palantir’s facilities under this Section 8 (and where such an audit is authorized under Section 8.2), Customer shall notify Palantir and the Parties shall agree, as soon as reasonably possible but always in advance, the reasonable dates, duration and scope of the audit, the identity and qualifications of the auditor, and any security and confidentiality controls required for access to the information or Processes in scope of such audit. Palantir may decline the request or decline to follow any instruction requested by Customer regarding audits. To the extent Palantir declines an audit request and such audit is unambiguously required under applicable Data Protection Laws or the DPA, Customer is entitled to terminate the Agreement in accordance with the Agreement. The Customer shall bear the reasonable costs of Palantir in fulfilling any requirements under this Section. The scope of any audit under this Section 8 shall be limited to Palantir systems and facilities used to Process Customer Personal Data and Documentation directly related to such Processing.
8.4 All information provided or made available to Customer, its auditor or any other third party authorized under the present DPA to have access to the above information pursuant to this Section 8 shall be Confidential Information of Palantir.
8.5 In the event of any confirmed material non-compliance by Palantir with the terms of this DPA, Customer may take reasonable steps to remediate the same, including, without limitation, by requiring the suspension of all Processing of Customer Personal Data until such time as Customer determines that the non-compliance has been remediated. In the event that Palantir determines that it can no longer meet its obligations pursuant to this DPA, Palantir shall promptly notify Customer of such determination.
9 DEALINGS WITH DATA PROTECTION AUTHORITIES AND DATA PROTECTION IMPACT ASSESSMENTS
9.1 Palantir shall reasonably cooperate, on reasonable request and at Customer’s cost, with any Data Protection Authority in the performance of its tasks, taking into account the nature of the Processing by, and information available to, Palantir.
9.2 Taking into account the nature of the Service and the information available to Palantir, Palantir will assist Customer in complying with Customer’s obligations in respect of data protection impact assessments (including a 'risk assessment', 'privacy impact assessment', 'data protection assessment' or any equivalent documentation) and prior consultation or mandatory submission to a Data Protection Authority where applicable under Data Protection Laws, by providing the Report, Accountability Information and Documentation.
10 ACCOUNTABILITY
To the extent required by Data Protection Laws, Palantir shall maintain electronic records of all categories of Processing activities carried out on behalf of Customer, containing:
(a) the name and contact details of the Processors and Subprocessors;
(b) details of the types of Processing being carried out;
(c) details of any transfers of Customer Personal Data to a territory or international organisation outside of the EEA or UK, and documentation of suitable safeguards (if applicable); and
(d) a general description of the technical and organisational security measures used in relation to the Processing,
together, the “Accountability Information”.
11 DATA SUBJECT RIGHTS
11.1 With regard to Customer Personal Data, where Palantir directly receives a Request from a Data Subject, or anyone authorized to act on their behalf, any claim or complaint in relation to their rights under the Data Protection Laws, and provided Palantir can reasonably identify from the information provided that the request, claim or complaint relates to Customer and Customer Personal Data, then unless prohibited by applicable law, Palantir shall forward the request, claim or complaint to Customer.
11.2 The Service provides Customer with controls, including security features and functionalities, that Customer may use to retrieve, correct, delete or restrict Customer Personal Data. Customer may use these controls as technical and organisational measures to comply with its obligations under Data Protection Laws, to respond to requests from Data Subjects.
12 DATA INCIDENT
12.1 Palantir shall notify Customer without undue delay after becoming aware of (or where required by applicable Data Protection Laws) having reasonable grounds to believe that there has been a Data Incident and provide Customer with any information required to be included under applicable Data Protection Laws. For avoidance of doubt, a Data Incident shall not include acts or omissions which do not breach Palantir’s security or the security of any Subprocessor; port scans, authorized penetration tests, and denial of service attacks; or any access to or Processing of Customer Personal Data that is consistent with Customer Instructions. Palantir’s notification of, or response to, a Data Incident in accordance with this Section 12.1. will not be construed as an acknowledgment by Palantir of any fault or liability with respect to the Data Incident.
12.2 Palantir shall provide Customer with reasonable cooperation and assistance in dealing with a Data Incident, in particular in relation to (a) taking commercially reasonable steps to resolve any data privacy or security issues involving any Customer Personal Data; and (b) providing Customer with necessary and requested assistance to enable Customer to make any appropriate notifications to individuals affected by the Data Incident or to a Supervisory Authority to the extent reasonably possible; provided that, Customer shall maintain and follow an effective cyber incident response policy, which shall include the use of legal professional, litigation, or client attorney privilege, work in good faith with Palantir in relation to the Data Incident, or, in the event that Customer acts as an individual or sole trader, provided that Customer shall maintain and follow effective and necessary incident responses and mitigation measures reasonably expected from any individual or sole trader and agree with Palantir the form and method of any public announcement in relation to the Data Incident.
12.3 Any information provided by Palantir pursuant to this Section 12 shall be the Confidential Information of Palantir and Palantir’s notification of or response to a Data Incident under this Section 12 will not be construed as an acknowledgement by Palantir or, if relevant, its Subprocessors of any fault or liability with respect to the performance of any Service or Professional Services (as applicable).
13 DATA TRANSFERS
13.1 Palantir may Process Personal Data in countries outside of the country in which Customer is established in which Palantir or its Subprocessors maintains facilities, employees or infrastructure.
13.2 Where the Processing of Customer Personal Data in the course of the provision of the Service involves a Restricted Transfer of Customer Personal Data by or on behalf of Customer, from a country which places restrictions on the transfer of Personal Data to countries not deemed to be an Adequate Country then:
(a) The Parties shall hereby enter into a set of SCCs. The applicable SCCs and any required Completions as applicable and set out in Exhibit D, shall hereby be deemed incorporated into this DPA, and apply between Customer (as Exporter) and Palantir (as importer);
(b) Palantir shall provide appropriate safeguards, meeting the requirements of the SCCs in respect of onward transfers, in relation to transfers of Personal Data between Palantir Affiliates for the purpose of performing Services; and
(c) Palantir shall ensure that any transfers of Customer Personal Data between Palantir and any Palantir third party Subprocessors, are subject to contractual terms between Palantir and the relevant third party Subprocessor providing appropriate safeguards and containing clauses equivalent to the SCCs.
13.3 Nothing in this DPA or the Agreement modifies any rights or obligations of Palantir or customer under the Standard Contractual Clauses.
14 LIABILITY
14.1 Subject to 14.2, the total combined liability of either Party and its Affiliates towards the other Party and its Affiliates under or in connection with the Agreement and the Standard Contractual Clauses combined will be the liability cap, and subject to the liability limitations, set forth in the Agreement for the relevant Party.
14.2 Nothing in this DPA serves to modify, disapply or amend the terms of the Agreement relating to liability, including but not limited to any exclusions and/or limitations of liability.
14.3 Customer shall ensure that all Customer Data it uploads in the course of the provision of the Service is accurate and complies with all applicable laws. Customer shall defend and indemnify Palantir for any and all damages, liabilities, penalties, fines and expenses (including from third parties) arising out of the Customer’s failure to comply with the present provision or any applicable laws in connection with Customer Data.
15 GOVERNING LAW AND JURISDICTION
15.1 The Parties shall modify the terms of this DPA as soon as possible if such modification is required for the parties to comply with any Data Protection Laws, or in order to implement or adhere to the Standard Contractual Clauses or such other permitted compliance mechanism under Data Protection Laws.
15.2 This DPA, and any dispute or claim (including any non-contractual disputes or claims) arising out of or in connection with it, or its subject matter or formation, shall be governed by and construed in accordance with the laws that govern the Agreement. If it is or becomes a requirement that, under the Data Protection Laws or other applicable laws, this DPA must be governed by (a) the laws of a member state of the European Union (and it is not already so governed), this DPA shall be governed by and construed in accordance with the laws of Ireland; (b) the laws of the United Kingdom, this DPA shall be governed by and construed in accordance with the laws of England and Wales, and/or (c) the laws of any other jurisdiction, then this DPA shall be governed by and construed in accordance with the laws of that jurisdiction, but only to the extent required to satisfy such laws.
15.3 The Parties irrevocably agree that the forum set out in the Agreement shall have exclusive jurisdiction to settle any dispute which may arise out of or in connection with this DPA and the documents to be entered into pursuant to it and that, accordingly, any proceedings arising out of or in connection with this DPA shall be brought in such forum save that where a mandatory requirement of Data Protection Law or other applicable laws requires that disputes arising out of or in connection with this DPA and any documents to be entered into pursuant to it are heard in (a) a member state of the European Union, then such disputes shall be heard in Ireland; (b) the United Kingdom, then such disputes shall be heard in England and Wales; and/or (c) any alternative forum, then such disputes shall be heard in that alternative forum, to the extent legally permitted. Each of the Parties irrevocably submits to the jurisdiction of such forum and waives any objection to proceedings in any such forum on the ground of venue or on the ground that proceedings have been brought in an inconvenient forum.
16 GENERAL TERMS
16.1 Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, whilst preserving the Parties’ intension as closely as possible, or, where not possible, (ii) construed in a manner as if the invalid off unenforceable part had never been contained therein.
16.2 Palantir may notify Customer in writing from time to time of any variations to this DPA, including relating to cross border transfers, which are required as a result of change in Data Protection Laws. Any such changes required shall take effect on the date falling 25 working days after the date such written notice is sent by Palantir to the Customer.
EXHIBIT A
List of approved Subprocessors
PART I - Subprocessors
To perform its obligations under the Palantir Terms of Service and Palantir Data Protection Agreement (or the alternative written agreement between Customer and Palantir, if applicable), Palantir Technologies Inc. and its Affiliates may use third party data processors (“Third-Party Subprocessors”) and Palantir Affiliates to process Customer Personal Data. Capitalized terms used but not defined here shall have the meanings provided in the Agreement.
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure, and AI services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
X.AI LLC | AI services | 1450 Page Mill Rd. Palo Alto, CA 94034, United States | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
| Oracle America, Inc. | Cloud hosting and infrastructure. | 500 Oracle Parkway, Redwood Shores, CA 94065 | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
PART II – Palantir Affiliates
Provided that an adequate level of data protection consistent with the Data Protection Laws and this Agreement is ensured by Palantir, Customer specifically authorizes Palantir Affiliates as listed here and as updated from time to time to act as Palantir’s Subprocessor(s) including by Processing Customer Personal Data for the purposes of the Agreement for the delivery of Service and/or Professional Services to Customer. Where required, Palantir and its respective Affiliate have entered into the Standard Contractual Clauses. Such Processing, where applicable, shall occur under the control and direction of Palantir and shall occur on systems managed or otherwise controlled by Palantir.
EXHIBIT B
Subject Matter and Details of Customer Personal Data Processing
Palantir Privacy Contact
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Service (as applicable) or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users.
Subject Matter of Processing
Palantir’s provision of the Service and Professional Services and performance of its obligations under the Agreement.
Nature and Purpose of Processing
Palantir will Process Customer Personal Data in accordance with the terms of this DPA for the purpose of providing the Service and Professional Services to Customer, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT C – APOLLO SERVICES
The following capitalized term will have the meaning indicated below:
“Apollo Services” means the specific Service selected by Customer in the Order Form for end-to-end continuous deployment SaaS solution, enabling Users to centrally manage multiple versions of Palantir Technology across independent environments and as exclusively described in the present Exhibit C for Apollo Services, excluding the application of Exhibit A and Exhibit B of the present DPA;
EXHIBIT C-1
List of approved Subprocessors
PART I – Subprocessors
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of providing Apollo Services to Customer under the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
PART II – Palantir Affiliates
As described under "PART II – Palantir Affiliates" in Exhibit A.
EXHIBIT C-2
Subject Matter and Details of Customer Personal Data Processing
For the provision of Apollo Services, the following shall apply:
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Apollo Service or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing via the Apollo Service by or at the direction of Customer or Customer’s Users. Categories of Customer Personal Data include Users identification details: name, addresses, email addresses and IDs.
Subject Matter of Processing
Palantir’s provision of the Apollo Service under the Agreement.
Nature and Purpose of Processing
Palantir will Process the above detailed Customer Personal Data in accordance with the terms of this DPA for the purpose of setting up Apollo Users’ accounts, providing the Apollo Service to Customer including scanning managed environments for vulnerabilities, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT D
Additions to the Standard Contractual Clauses
The following capitalized term will have the meaning indicated below:
"UK Addendum" means the international data transfer addendum to the EU SCCs issued by the UK Information Commissioner under s. 119A of the Data Protection Act 2018, or such other addendum as may amend or replace the addendum from time to time.
“Completions” means
(i) in relation to the EU SCCs in relation to exports from the EEA:
a) the optional wording at Clauses 7 and 11 is deleted;
b) in Clause 8.9 of such SCCs, the following paragraph is added after subsection (d):
“(e) Notwithstanding the above, any audit will be limited in scope and parameter to the systems processing the relevant personal data.
Where audits include inspections, they shall be carried out with reasonable prior notice. The parties will mutually agree upon the scope, timing, duration, control and evidence requirements of the audit, provided that this requirement to agree will not permit the data importer to unreasonably delay performance of the audit.
Any audit made pursuant to this Clause (i) shall be at the expense of the requesting data exporter, and such expenses shall include any reasonable related costs of the data importer, including compensation for the hours worked by the data importer’s staff; (ii) may, if the data exporter seeks to retain an independent auditor, only be done by a party approved in advance by the data importer, which approval cannot be unreasonably withheld; and (iii) shall be subject to a non-disclosure agreement.”
c) in Clause 9, Option 1 is deleted and the time period shall be not less than 30 days;
d) the applicable wording for Clause 13(a) of the EU SCCs (as determined by the instructions in square brackets in such SCCs) is retained and the two remaining alternatives are deleted;
e) in Clause 17 of the EU SCCs, Option 2 is deleted and Option 1 is completed with details of the laws of Ireland and in Clause 18(b) of the EU SCCs is completed with details of the courts of Ireland;
f) the parties set out in Annex 1 shall be completed with the names of the Customer as exporter and Palantir as importer, the transfers shall be as described in Exhibit B and any other relevant exhibits for applicable additional Services under this DPA and the supervisory authority shall be the Irish supervisory authority; in Annex II the list of technical and organisational measures shall be the Technical and Organisational Measures and in Annex III the list of sub-processors shall be those set out in Exhibit A; and
g) in the event that the EU SCCs are replaced from those in force at the Effective Date, such completions shall be made to the revised SCCs as most closely replicate those set out above.
(ii) in relation to the EU SCCs in relation to exports from other jurisdictions besides the EEA the completions set out in (i)(a)-(g) above shall apply save that:
a) in Clause 17 of such EU SCC, the second sentence is replaced with the following: “The Parties agree that this shall be English law” save where another governing law of the EU SCCs is required as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 17 shall be completed with details of the law which that Data Protection Law requires must be applied to such EU SCCs;
b) Clause 18(b) is replaced with the following “18(b) The Parties agree that those shall be the courts of England & Wales” save where another country, state or territory must have jurisdiction over the EU SCCs as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 18(b) of such EU SCCs shall be completed with details of the country, state or territory which that Data Protection Law requires must have jurisdiction over the EU SCCs;
c) references in the EU SCC to “a third party located outside the European Union” are replaced by references to “a third party located outside the country or territory in which the data exporter is established”;
d) references in such EU SCC to “the Member State” are replaced by references to “the country or territory in which the data exporter is established”;
e) all references to the GDPR in such EU SCC are replaced by references to Data Protection Law of the relevant country and references to provisions or concepts of the GDPR are replaced by references to the provisions or concepts of such Data Protection Law most closely related to the relevant term as understood in the GDPR;
f) all references to Member States of the European Union or to the European Union are replaced by references to the country of establishment of the exporter;
g) save where required as mandatory requirement of the relevant Data Protection Law, all references in the EU SCC to (a) data subject rights or other third party beneficiary rights or (b) to obligations or liability towards data subjects or other third parties shall be deleted and ignored; and
h) to the extent that any of references to the EU SCCs referred to above under (i) to (viii) are replaced in any amended provisions or replacement or subsequently approved clauses or instrument after the Effective Date, the amendments provided above under (ii)(a)-(h) shall be adapted and/or completed if and to the extent appropriate to reflect the effect of the former as close as possible
(iii) in relation to SCCs in relation to exports from the UK the EU SCCs shall apply as amended by either (i) the Information Commissioner’s “UK Addendum to the EU Commission Standard Contractual Clauses” found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdfhttps://ico.org.uk/media/about-the-ico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf or (ii) such replacement addendum to the EU Standard Contractual Clauses as the Information Commissioner might issue from time to time (these addenda known as the “UK SCC”), with the following items completed (or in the case of (ii) those items as most closely approximate the following items):
a) to the extent not covered by the foregoing, the completions set out in (i)(a)-(g) above shall apply save that:
b) Table 1 shall be completed with the names of the Customer as exporter and Palantir as importer;
c) in Table 2 the module of the EU SCCs selected shall be determined in accordance with the definition of SCCs set out below;
d) in Table 4 the “neither party” option shall be selected,
(iv) in relation to SCCs in relation to exports from Switzerland, the EU SCCs shall apply (incorporating the completions set out at (i)(a)-(g) above), as amended by either (a) the FDPIC’ decision guidance of 27 August 2021 found at https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222 setting out amendments to be made to the EU SCCs in respect of transfers subject to the Swiss FADP or (b) such replacement decision of the FDPIC relating to amendments to be made to the EU SCCs from time to time (these amendments known as the “Swiss SCCs”);
(v) in relation to SCCs in relation to exports from any other country, the completions set out in (i)(a)-(g) above shall be made or such other Completions as most closely achieves the same outcome as those Completions.
In respect of any transfers of Personal Data that may occur in the course of the provision of the Service, Module 2 (Controller to Processor) terms, as provided below in Annex 1 to Exhibit D, shall apply to the extent Customer is a Controller of Customer Personal Data. The Module 3 (Processor to Processor) terms, as provided below in Annex 2 to Exhibit D, shall apply to the extent Customer is a Processor (or subprocessor) of Customer Personal Data. For both Module 2 and Module 3 of the Standard Contractual Clauses, the election of specific terms and/or addition of required information shall apply as follows:
(a) The applicable wording for Clause 13(a) of the Standard Contractual Clauses (as determined by the instructions in square brackets in the Standard Contractual Clauses) is retained and the two remaining alternatives are deleted;
(b) details of Subprocessors the data importer intends to engage as set out in Exhibit A and/or any other relevant exhibits for applicable additional Services, respectively, to this Agreement are the “agreed list” of Subprocessors referread to in Clause 9(a) of the Standard Contractual Clauses.
ANNEX 1 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 2: Controller to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([1]) for the transfer of data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b)The data importer shall immediately inform the data exporter if it is unable to follow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([2]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([3]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([4]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii) the data importer is in substantial or persistent breach of these Clauses; or
(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of Ireland.
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Controller
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in clause 4.3(c) of the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.
The controls available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation.
ANNEX 2 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 3: Processor to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([5]) for the transfer of personal data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[Intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter ([1]).
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([6]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.
(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([7]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([8]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). The data exporter shall forward the notification to the controller.
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation, if appropriate in consultation with the controller. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the controller or the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
The data exporter shall forward the notification to the controller.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). The data exporter shall forward the information to the controller.
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimization
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. The data exporter shall make the assessment available to the controller.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a)The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b)In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c)The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i)the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii)the data importer is in substantial or persistent breach of these Clauses; or
(iii)the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority and the controller of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d)Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e)Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a)Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b)The Parties agree that those shall be the courts of Ireland.
(c)A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
(d)The Parties agree to submit themselves to the jurisdiction of such courts.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Processor
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case, Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
The controls available to Customer described in the DPA, as further documented in the Security Documentation.
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
Effective May 23rd 2024 to January 14th 2025
DownloadTable of Contents
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED IN THE AGREEMENT), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS DPA, THAT YOU UNDERSTAND THE TERMS OF THIS DPA, AND THAT YOU, IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, OR YOU AND THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS DPA. IF YOU ARE ENTERING INTO THESE TERMS IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, YOU ALSO REPRESENT AND WARRANT THAT YOU ARE NOT USING THE PALANTIR TECHNOLOGY ON BEHALF OF OR UNDER THE INSTRUCTIONS OF ANY OTHER THIRD PARTY OR LEGAL ENTITY. IF YOU ARE ENTERING INTO THIS DPA ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS DPA ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS DPA, DO NOT SELECT "I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS DPA, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
The customer agreeing to the terms of this DPA (“Customer”) and the Palantir Technologies entity that is the signatory to the Agreement (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing Customer’s use of Palantir Technology, including the Service, and the provision of related Professional Services to Customer by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This DPA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer under the Agreement. Any capitalized terms used but not defined in this DPA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the terms and conditions in this DPA shall prevail and control.
1 DEFINITIONS
1.1 The following capitalized terms will have the meanings indicated below:
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data that is subject to Data Protection Laws;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all applicable laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of a Controller, including as applicable the terms “processor”, “service provider” “contractor” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws as applicable;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
2 TERM
2.1 This DPA will take effect from the DPA Effective Date and remain in effect until the destruction or return of all Customer Personal Data by Palantir in accordance with the Agreement, at which point it will automatically terminate.
3 SCOPE AND APPLICATION
3.1 This DPA is incorporated into, and forms part of, the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer when in the course of the provision of the Service. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the provisions in this DPA shall prevail and control.
4 ROLE OF THE PARTIES
4.1 Customer and any relevant Customer Affiliate, hereby appoints and instructs Palantir as a Processor, or Subprocessor as applicable, of the Customer Personal Data. Accordingly, the Parties shall comply with applicable Data Protection Laws as relevant to their respective Processing of Customer Personal Data under the Agreement.
4.2 As between the Parties, Customer shall be liable and responsible as the Controller (or Processor, if Customer is Processing Personal Data with the Service for a third-party Controller) and Palantir shall be liable and responsible as the Processor (or Subprocessor), in respect of Customer Personal Data processed under the Agreement.
4.3 In the event that Customer acts as a Processor (or Subprocessor) in respect of Customer Personal Data, Customer represents and warrants to Palantir that it is validly authorized by the relevant Controller to enter into the Agreement and this DPA and to provide Customer Instructions (as defined below) on behalf of Controller in relation to Customer Personal Data.
4.4 In the event that Customer is an employee of Palantir or a Palantir Affiliate, Customer acknowledges that it is not acting on behalf of Palantir or any Palantir Affiliate and is acting as a separate and independent Controller in relation to the Processing of Customer Personal Data via the Palantir Technology.
4.5 In the event that Customer jointly controls Customer Personal Data with a third-party Controller, Customer represents and warrants that its Processing of Customer Personal Data in connection with its use of the Palantir Technology is duly authorised by such third-party Controller and is carried out in compliance with applicable Data Protection Laws.
4.6 In the event that Customer introduces any new User to the Palantir Technology (whether such User is acting on his/her own behalf or on behalf of a third party), Customer shall procure that any such User enters into a separate arrangement directly with Palantir in relation to such use (including any applicable Palantir Terms of Service and any related DPA) and acknowledges that any such User's use of the Palantir Technology shall be conditional on their doing so.
4.7 The subject matter and details of Processing are described in the Agreement and this DPA, including Exhibit B (subject matter and details of Customer Personal Data processing) and any other relevant exhibits for applicable additional Services.
4.8 Palantir shall process Prompts and Outputs as Usage Data, as further described in the Agreement and AIP Now Privacy Policy, to secure the Service, including monitoring for abuse or malicious User activity.
5 CUSTOMER PROCESSING OF PERSONAL DATA
5.1 Customer shall ensure that any Processing of Customer Personal Data via Customer’s use of the Service, including any instructions provided to Palantir in relation to such Processing, shall comply with all applicable Data Protection Laws.
5.2 Customer instructs Palantir to Process Customer Personal Data: (a) to provide the Service specified in the Agreement and Documentation or otherwise perform its obligations thereunder; (b) as further initiated by Customer via Customer’s or Users use of the Service in accordance with the Agreement and Documentation; and/or (c) in accordance with any additional instruction outside the scope of the Agreement or this DPA, as further documented in any other written instructions given by Customer and acknowledged by Palantir in writing as constituting instructions for purposes of this DPA (collectively, “Customer Instructions”). Customer acknowledges that any additional Customer Instructions issued under (c) above may result in additional charges or fees to the Customer by Palantir, which shall be payable in accordance with the terms of the Agreement.
5.3 Customer shall have sole responsibility for the lawful Processing of Customer Personal Data in connection with its use of the Palantir Technology and/or its receipt of any related Professional Services in accordance with applicable Data Protection Laws, including without limitation, the accuracy, quality, and legality of the Customer Personal Data, the means by which it acquires and uses Customer Personal Data, and the Customer Instructions regarding the Processing of Customer Personal Data. Customer represents and warrants that it has (or its Controller has) a valid legal basis for the Processing of Customer Personal Data and has (or its Controller has) provided (or procured the provision of) all notifications and obtained (or procured the provision of) all consents (including Consents), authorisations, approvals, and/or agreements (including, where Customer is a Processor or Subprocessor, with and from the applicable Controller(s)) required under applicable laws or policies in order to enable Palantir to receive and Process Customer Personal Data in accordance with this DPA, the Agreement and Customer Instructions.
5.4 The Customer shall be responsible for providing guidance to Users regarding the use of the Services and in particular the use of Personal Data within the Services.
5.5 The Customer Personal Data shall not include any:
5.5.1 government related identifiers (where that term is defined under applicable Data Protection Laws) to the extent that the Processing of such government related identifiers are not permitted under applicable Data Protection Laws;
5.5.2 Personal Data relating to children (in accordance with the relevant age of majority in applicable jurisdictions), unless permitted under, or in compliance with applicable Data Protection Laws; or
5.5.3 Personal Data which is under the Control of another Controller, without their express authorisation.
6 PALANTIR PROCESSING OF CUSTOMER PERSONAL DATA
6.1 Palantir will Process Customer Personal Data for the business purposes of providing to Customer the services, namely the Palantir Technology and Professional Services pursuant to the Customer Instructions and any other purpose for which the Customer provides authorization via the Service, where such option is made available ("Business Purposes"), in accordance with the terms of the Agreement and this DPA as well as any requirements set out by applicable Data Protection Laws. For the avoidance of doubt, Customer is disclosing Customer Personal Data to Palantir only for the limited and specified Business Purposes set forth within the Agreement and the Customer Instructions. Palantir shall process Customer personal Data pursuant to Customer’s instructions and shall:
(a) designate and maintain a Data Protection Officer as required by Data Protection Laws, which can be contacted at privacy@palantir.com;
(b) not Sell or Share Customer Personal Data or otherwise retain, use, disclose, or Process Customer Personal Data outside of the direct business relationship between the Parties or for any purpose other than for the fulfilment of the Business Purposes pursuant to Customer Instructions, unless obligated to do otherwise by applicable law or regulation or requests or orders of judicial, governmental or regulatory entities (including without limitation subpoenas), in which case Palantir will inform Customer of that legal requirement before such Processing occurs unless legally prohibited from doing so;
(c) not combine Customer Personal Data with Personal Data that it receives from other sources or collects from its own interactions with a Data Subject, provided, that Palantir may combine Customer Personal Data as necessary to perform its Business Purposes and will not Sell or Share Customer Personal Data;
(d) implement appropriate Technical and Organisational Measures to protect the confidentiality, integrity, availability and resilience of Palantir’s systems Processing Customer Personal Data. Palantir may update the Technical and Organisational Measures from time to time provided that any such updates are no less protective than the original Technical and Organisational Measures. To the extent such assistance requires Palantir to take additional steps beyond those imposed on Palantir by Data Protection Laws or specifically required pursuant to the Agreement; or to the extent the relevant technical and organizational measures are required as a result of an act or omission by Customer or a Party acting on behalf of Customer in breach of this Agreement or Data Protection Laws, then Palantir’s obligation to provide such assistance shall be subject to Customer’s payment of Palantir’s reasonable fees in respect of such additional assistance; Palantir’s security obligations under this DPA apply without prejudice to the Customer’s own security obligations under applicable Data Protection Laws;
(e) ensure that all persons authorized by Palantir to Process Customer Personal Data, including any Subprocessors (as defined below), are bound by confidentiality obligations consistent with those set out in this DPA, the Agreement or otherwise sufficient to meet the requirements of Data Protection Laws;
(f) take reasonable steps to return or destroy Customer Personal Data, when it is no longer necessary for the purposes of performing the relevant Services upon termination of the Agreement, unless storage is otherwise required under applicable Data Protection Laws; and
(g) process Customer Personal Data in a manner that is consistent with the same level of privacy protection that is required of Customer under applicable Data Protection Laws.
6.2 Customer shall instruct Palantir as to the subject-matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and the categories of Data Subjects taking into account the specific tasks and responsibilities of the Processor in the context of the Processing to be carried out and the risk to the rights and freedoms of the Data Subject as part of Customer Instructions. Notwithstanding anything to the contrary herein, Customer shall ensure that its acts or omissions, including in relation to any Customer Instructions to Palantir, do not put Palantir in breach of the Data Protection Laws.
6.3 Customer has assessed the level of security appropriate to the Processing in the context of its obligations under Data Protection Laws and agrees that the Technical and Organisational Measures are consistent with such assessment. Customer further acknowledges that Palantir is not able to assess, and does not have knowledge of, the specific Personal Data provided by Customer to Palantir or made available by Customer to Palantir in relation to the Services and that as a result the technical and organisational Measures proposed by Palantir are generic in nature and Palantir is unable to assess whether or not they reflect any particular risks posed by the Personal Data.
7 SUBPROCESSORS
7.1 Customer specifically authorizes the engagement as Subprocessors of (a) the entities listed in Exhibit A and/or applicable specific additional Services exhibits in this DPA and (b) all Palantir Affiliates from time to time, provided that, prior to permitting such Subprocessors to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.2 Subject to Section 7.3, Customer generally authorizes Palantir to engage additional Subprocessors (“Additional Subprocessors”), provided that, prior to permitting such Additional Subprocessor to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Additional Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.3 At least 30 days before Palantir initiating the use of an Additional Subprocessor in connection with the provision of Services to Customer, the updated list of Subprocessors for the Service shall be available in Exhibit A, also accessible here https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795, and Palantir shall provide Customer with a mechanism to obtain notice of that update. The Parties agree this notification satisfies the notification requirements of Section 28.2 of the GDPR and Clause 9 of the SCC. Where Customer indicates in writing that it objects to the Processing of Customer Personal Data by such Additional Subprocessor, the Parties shall seek to resolve the Customer concerns and where necessary the Customer may exercise its applicable rights to terminate the Agreement.
7.4 To the extent required by Data Protection Law, Palantir shall remain liable to Customer for the performance of the Subprocessor’s obligations in relation to this Section 7 (“Subprocessor Data Protection Liability”), and Palantir shall be permitted to re-perform or to procure the re-performance of any such obligations and Customer acknowledges that such re-performance shall diminish any claim that Customer has against Palantir in respect of any Subprocessor Data Protection Liability.
8 AUDIT
8.1 Palantir uses third party auditors to verify the adequacy of its security measures. This audit is performed at least annually, by independent and reputable third-party auditors at Palantir’s selection and expense, and in accordance with Service Organization Controls 2 (SOC2) or substantially equivalent industry standards, and results in the generation of an audit report (“Report”) which will be the Confidential Information of Palantir. The Service and operations are also certified compliant with the standards and accreditations set out on the “compliance and accreditation” tab at: https://www.palantir.com/information-security/ (“Accreditations”).
8.2 At Customer’s written request, Palantir will provide Customer with a confidential summary of the Report, documentation evidencing compliance with the Accreditations, and the Accountability Information outlined in Section 10 of this DPA so that Customer can reasonably verify Palantir’s compliance with the data security and data protection obligations under this DPA. Subject to Section 8.3, if Data Protection Laws, Standard Contractual Clauses, or the Agreement require Palantir to provide Customer with access to Palantir facilities or information in addition to the Report and the Accountability Information, then Palantir shall permit Customer to audit Palantir’s compliance with the terms and conditions of this DPA as it applies to Customer Personal Data to the extent expressly required by the Agreement, the Standard Contractual Clauses, or Data Protection Laws.
8.3 In order to request an audit of Palantir’s facilities under this Section 8 (and where such an audit is authorized under Section 8.2), Customer shall notify Palantir and the Parties shall agree, as soon as reasonably possible but always in advance, the reasonable dates, duration and scope of the audit, the identity and qualifications of the auditor, and any security and confidentiality controls required for access to the information or Processes in scope of such audit. Palantir may decline the request or decline to follow any instruction requested by Customer regarding audits. To the extent Palantir declines an audit request and such audit is unambiguously required under applicable Data Protection Laws or the DPA, Customer is entitled to terminate the Agreement in accordance with the Agreement. The Customer shall bear the reasonable costs of Palantir in fulfilling any requirements under this Section. The scope of any audit under this Section 8 shall be limited to Palantir systems and facilities used to Process Customer Personal Data and Documentation directly related to such Processing.
8.4 All information provided or made available to Customer, its auditor or any other third party authorized under the present DPA to have access to the above information pursuant to this Section 8 shall be Confidential Information of Palantir.
8.5 In the event of any confirmed material non-compliance by Palantir with the terms of this DPA, Customer may take reasonable steps to remediate the same, including, without limitation, by requiring the suspension of all Processing of Customer Personal Data until such time as Customer determines that the non-compliance has been remediated. In the event that Palantir determines that it can no longer meet its obligations pursuant to this DPA, Palantir shall promptly notify Customer of such determination.
9 DEALINGS WITH DATA PROTECTION AUTHORITIES AND DATA PROTECTION IMPACT ASSESSMENTS
9.1 Palantir shall reasonably cooperate, on reasonable request and at Customer’s cost, with any Data Protection Authority in the performance of its tasks, taking into account the nature of the Processing by, and information available to, Palantir.
9.2 Taking into account the nature of the Service and the information available to Palantir, Palantir will assist Customer in complying with Customer’s obligations in respect of data protection impact assessments (including a 'risk assessment', 'privacy impact assessment', 'data protection assessment' or any equivalent documentation) and prior consultation or mandatory submission to a Data Protection Authority where applicable under Data Protection Laws, by providing the Report, Accountability Information and Documentation.
10 ACCOUNTABILITY
To the extent required by Data Protection Laws, Palantir shall maintain electronic records of all categories of Processing activities carried out on behalf of Customer, containing:
(a) the name and contact details of the Processors and Subprocessors;
(b) details of the types of Processing being carried out;
(c) details of any transfers of Customer Personal Data to a territory or international organisation outside of the EEA or UK, and documentation of suitable safeguards (if applicable); and
(d) a general description of the technical and organisational security measures used in relation to the Processing,
together, the “Accountability Information”.
11 DATA SUBJECT RIGHTS
11.1 With regard to Customer Personal Data, where Palantir directly receives a Request from a Data Subject, or anyone authorized to act on their behalf, any claim or complaint in relation to their rights under the Data Protection Laws, and provided Palantir can reasonably identify from the information provided that the request, claim or complaint relates to Customer and Customer Personal Data, then unless prohibited by applicable law, Palantir shall forward the request, claim or complaint to Customer.
11.2 The Service provides Customer with controls, including security features and functionalities, that Customer may use to retrieve, correct, delete or restrict Customer Personal Data. Customer may use these controls as technical and organisational measures to comply with its obligations under Data Protection Laws, to respond to requests from Data Subjects.
12 DATA INCIDENT
12.1 Palantir shall notify Customer without undue delay after becoming aware of (or where required by applicable Data Protection Laws) having reasonable grounds to believe that there has been a Data Incident and provide Customer with any information required to be included under applicable Data Protection Laws. For avoidance of doubt, a Data Incident shall not include acts or omissions which do not breach Palantir’s security or the security of any Subprocessor; port scans, authorized penetration tests, and denial of service attacks; or any access to or Processing of Customer Personal Data that is consistent with Customer Instructions. Palantir’s notification of, or response to, a Data Incident in accordance with this Section 12.1. will not be construed as an acknowledgment by Palantir of any fault or liability with respect to the Data Incident.
12.2 Palantir shall provide Customer with reasonable cooperation and assistance in dealing with a Data Incident, in particular in relation to (a) taking commercially reasonable steps to resolve any data privacy or security issues involving any Customer Personal Data; and (b) providing Customer with necessary and requested assistance to enable Customer to make any appropriate notifications to individuals affected by the Data Incident or to a Supervisory Authority to the extent reasonably possible; provided that, Customer shall maintain and follow an effective cyber incident response policy, which shall include the use of legal professional, litigation, or client attorney privilege, work in good faith with Palantir in relation to the Data Incident, or, in the event that Customer acts as an individual or sole trader, provided that Customer shall maintain and follow effective and necessary incident responses and mitigation measures reasonably expected from any individual or sole trader and agree with Palantir the form and method of any public announcement in relation to the Data Incident.
12.3 Any information provided by Palantir pursuant to this Section 12 shall be the Confidential Information of Palantir and Palantir’s notification of or response to a Data Incident under this Section 12 will not be construed as an acknowledgement by Palantir or, if relevant, its Subprocessors of any fault or liability with respect to the performance of any Service or Professional Services (as applicable).
13 DATA TRANSFERS
13.1 Palantir may Process Personal Data in countries outside of the country in which Customer is established in which Palantir or its Subprocessors maintains facilities, employees or infrastructure.
13.2 Where the Processing of Customer Personal Data in the course of the provision of the Service involves a Restricted Transfer of Customer Personal Data by or on behalf of Customer, from a country which places restrictions on the transfer of Personal Data to countries not deemed to be an Adequate Country then:
(a) The Parties shall hereby enter into a set of SCCs. The applicable SCCs and any required Completions as applicable and set out in Exhibit D, shall hereby be deemed incorporated into this DPA, and apply between Customer (as Exporter) and Palantir (as importer);
(b) Palantir shall provide appropriate safeguards, meeting the requirements of the SCCs in respect of onward transfers, in relation to transfers of Personal Data between Palantir Affiliates for the purpose of performing Services; and
(c) Palantir shall ensure that any transfers of Customer Personal Data between Palantir and any Palantir third party Subprocessors, are subject to contractual terms between Palantir and the relevant third party Subprocessor providing appropriate safeguards and containing clauses equivalent to the SCCs.
13.3 Nothing in this DPA or the Agreement modifies any rights or obligations of Palantir or customer under the Standard Contractual Clauses.
14 LIABILITY
14.1 Subject to 14.2, the total combined liability of either Party and its Affiliates towards the other Party and its Affiliates under or in connection with the Agreement and the Standard Contractual Clauses combined will be the liability cap, and subject to the liability limitations, set forth in the Agreement for the relevant Party.
14.2 Nothing in this DPA serves to modify, disapply or amend the terms of the Agreement relating to liability, including but not limited to any exclusions and/or limitations of liability.
14.3 Customer shall ensure that all Customer Data it uploads in the course of the provision of the Service is accurate and complies with all applicable laws. Customer shall defend and indemnify Palantir for any and all damages, liabilities, penalties, fines and expenses (including from third parties) arising out of the Customer’s failure to comply with the present provision or any applicable laws in connection with Customer Data.
15 GOVERNING LAW AND JURISDICTION
15.1 The Parties shall modify the terms of this DPA as soon as possible if such modification is required for the parties to comply with any Data Protection Laws, or in order to implement or adhere to the Standard Contractual Clauses or such other permitted compliance mechanism under Data Protection Laws.
15.2 This DPA, and any dispute or claim (including any non-contractual disputes or claims) arising out of or in connection with it, or its subject matter or formation, shall be governed by and construed in accordance with the laws that govern the Agreement. If it is or becomes a requirement that, under the Data Protection Laws or other applicable laws, this DPA must be governed by (a) the laws of a member state of the European Union (and it is not already so governed), this DPA shall be governed by and construed in accordance with the laws of Ireland; (b) the laws of the United Kingdom, this DPA shall be governed by and construed in accordance with the laws of England and Wales, and/or (c) the laws of any other jurisdiction, then this DPA shall be governed by and construed in accordance with the laws of that jurisdiction, but only to the extent required to satisfy such laws.
15.3 The Parties irrevocably agree that the forum set out in the Agreement shall have exclusive jurisdiction to settle any dispute which may arise out of or in connection with this DPA and the documents to be entered into pursuant to it and that, accordingly, any proceedings arising out of or in connection with this DPA shall be brought in such forum save that where a mandatory requirement of Data Protection Law or other applicable laws requires that disputes arising out of or in connection with this DPA and any documents to be entered into pursuant to it are heard in (a) a member state of the European Union, then such disputes shall be heard in Ireland; (b) the United Kingdom, then such disputes shall be heard in England and Wales; and/or (c) any alternative forum, then such disputes shall be heard in that alternative forum, to the extent legally permitted. Each of the Parties irrevocably submits to the jurisdiction of such forum and waives any objection to proceedings in any such forum on the ground of venue or on the ground that proceedings have been brought in an inconvenient forum.
16 GENERAL TERMS
16.1 Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, whilst preserving the Parties’ intension as closely as possible, or, where not possible, (ii) construed in a manner as if the invalid off unenforceable part had never been contained therein.
16.2 Palantir may notify Customer in writing from time to time of any variations to this DPA, including relating to cross border transfers, which are required as a result of change in Data Protection Laws. Any such changes required shall take effect on the date falling 25 working days after the date such written notice is sent by Palantir to the Customer.
EXHIBIT A
List of approved Subprocessors
PART I - Subprocessors
To perform its obligations under the Palantir Terms of Service and Palantir Data Protection Agreement (or the alternative written agreement between Customer and Palantir, if applicable), Palantir Technologies Inc. and its Affiliates may use third party data processors (“Third-Party Subprocessors”) and Palantir Affiliates to process Customer Personal Data. Capitalized terms used but not defined here shall have the meanings provided in the Agreement.
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure, and AI services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
| Oracle America, Inc. | Cloud hosting and infrastructure. | 500 Oracle Parkway, Redwood Shores, CA 94065 | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
PART II – Palantir Affiliates
Provided that an adequate level of data protection consistent with the Data Protection Laws and this Agreement is ensured by Palantir, Customer specifically authorizes Palantir Affiliates as listed here and as updated from time to time to act as Palantir’s Subprocessor(s) including by Processing Customer Personal Data for the purposes of the Agreement for the delivery of Service and/or Professional Services to Customer. Where required, Palantir and its respective Affiliate have entered into the Standard Contractual Clauses. Such Processing, where applicable, shall occur under the control and direction of Palantir and shall occur on systems managed or otherwise controlled by Palantir.
EXHIBIT B
Subject Matter and Details of Customer Personal Data Processing
Palantir Privacy Contact
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Service (as applicable) or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users.
Subject Matter of Processing
Palantir’s provision of the Service and Professional Services and performance of its obligations under the Agreement.
Nature and Purpose of Processing
Palantir will Process Customer Personal Data in accordance with the terms of this DPA for the purpose of providing the Service and Professional Services to Customer, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT C – APOLLO SERVICES
The following capitalized term will have the meaning indicated below:
“Apollo Services” means the specific Service selected by Customer in the Order Form for end-to-end continuous deployment SaaS solution, enabling Users to centrally manage multiple versions of Palantir Technology across independent environments and as exclusively described in the present Exhibit C for Apollo Services, excluding the application of Exhibit A and Exhibit B of the present DPA;
EXHIBIT C-1
List of approved Subprocessors
PART I – Subprocessors
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of providing Apollo Services to Customer under the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
PART II – Palantir Affiliates
As described under "PART II – Palantir Affiliates" in Exhibit A.
EXHIBIT C-2
Subject Matter and Details of Customer Personal Data Processing
For the provision of Apollo Services, the following shall apply:
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Apollo Service or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing via the Apollo Service by or at the direction of Customer or Customer’s Users. Categories of Customer Personal Data include Users identification details: name, addresses, email addresses and IDs.
Subject Matter of Processing
Palantir’s provision of the Apollo Service under the Agreement.
Nature and Purpose of Processing
Palantir will Process the above detailed Customer Personal Data in accordance with the terms of this DPA for the purpose of setting up Apollo Users’ accounts, providing the Apollo Service to Customer including scanning managed environments for vulnerabilities, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT D
Additions to the Standard Contractual Clauses
The following capitalized term will have the meaning indicated below:
"UK Addendum" means the international data transfer addendum to the EU SCCs issued by the UK Information Commissioner under s. 119A of the Data Protection Act 2018, or such other addendum as may amend or replace the addendum from time to time.
“Completions” means
(i) in relation to the EU SCCs in relation to exports from the EEA:
a) the optional wording at Clauses 7 and 11 is deleted;
b) in Clause 8.9 of such SCCs, the following paragraph is added after subsection (d):
“(e) Notwithstanding the above, any audit will be limited in scope and parameter to the systems processing the relevant personal data.
Where audits include inspections, they shall be carried out with reasonable prior notice. The parties will mutually agree upon the scope, timing, duration, control and evidence requirements of the audit, provided that this requirement to agree will not permit the data importer to unreasonably delay performance of the audit.
Any audit made pursuant to this Clause (i) shall be at the expense of the requesting data exporter, and such expenses shall include any reasonable related costs of the data importer, including compensation for the hours worked by the data importer’s staff; (ii) may, if the data exporter seeks to retain an independent auditor, only be done by a party approved in advance by the data importer, which approval cannot be unreasonably withheld; and (iii) shall be subject to a non-disclosure agreement.”
c) in Clause 9, Option 1 is deleted and the time period shall be not less than 30 days;
d) the applicable wording for Clause 13(a) of the EU SCCs (as determined by the instructions in square brackets in such SCCs) is retained and the two remaining alternatives are deleted;
e) in Clause 17 of the EU SCCs, Option 2 is deleted and Option 1 is completed with details of the laws of Ireland and in Clause 18(b) of the EU SCCs is completed with details of the courts of Ireland;
f) the parties set out in Annex 1 shall be completed with the names of the Customer as exporter and Palantir as importer, the transfers shall be as described in Exhibit B and any other relevant exhibits for applicable additional Services under this DPA and the supervisory authority shall be the Irish supervisory authority; in Annex II the list of technical and organisational measures shall be the Technical and Organisational Measures and in Annex III the list of sub-processors shall be those set out in Exhibit A; and
g) in the event that the EU SCCs are replaced from those in force at the Effective Date, such completions shall be made to the revised SCCs as most closely replicate those set out above.
(ii) in relation to the EU SCCs in relation to exports from other jurisdictions besides the EEA the completions set out in (i)(a)-(g) above shall apply save that:
a) in Clause 17 of such EU SCC, the second sentence is replaced with the following: “The Parties agree that this shall be English law” save where another governing law of the EU SCCs is required as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 17 shall be completed with details of the law which that Data Protection Law requires must be applied to such EU SCCs;
b) Clause 18(b) is replaced with the following “18(b) The Parties agree that those shall be the courts of England & Wales” save where another country, state or territory must have jurisdiction over the EU SCCs as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 18(b) of such EU SCCs shall be completed with details of the country, state or territory which that Data Protection Law requires must have jurisdiction over the EU SCCs;
c) references in the EU SCC to “a third party located outside the European Union” are replaced by references to “a third party located outside the country or territory in which the data exporter is established”;
d) references in such EU SCC to “the Member State” are replaced by references to “the country or territory in which the data exporter is established”;
e) all references to the GDPR in such EU SCC are replaced by references to Data Protection Law of the relevant country and references to provisions or concepts of the GDPR are replaced by references to the provisions or concepts of such Data Protection Law most closely related to the relevant term as understood in the GDPR;
f) all references to Member States of the European Union or to the European Union are replaced by references to the country of establishment of the exporter;
g) save where required as mandatory requirement of the relevant Data Protection Law, all references in the EU SCC to (a) data subject rights or other third party beneficiary rights or (b) to obligations or liability towards data subjects or other third parties shall be deleted and ignored; and
h) to the extent that any of references to the EU SCCs referred to above under (i) to (viii) are replaced in any amended provisions or replacement or subsequently approved clauses or instrument after the Effective Date, the amendments provided above under (ii)(a)-(h) shall be adapted and/or completed if and to the extent appropriate to reflect the effect of the former as close as possible
(iii) in relation to SCCs in relation to exports from the UK the EU SCCs shall apply as amended by either (i) the Information Commissioner’s “UK Addendum to the EU Commission Standard Contractual Clauses” found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdfhttps://ico.org.uk/media/about-the-ico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf or (ii) such replacement addendum to the EU Standard Contractual Clauses as the Information Commissioner might issue from time to time (these addenda known as the “UK SCC”), with the following items completed (or in the case of (ii) those items as most closely approximate the following items):
a) to the extent not covered by the foregoing, the completions set out in (i)(a)-(g) above shall apply save that:
b) Table 1 shall be completed with the names of the Customer as exporter and Palantir as importer;
c) in Table 2 the module of the EU SCCs selected shall be determined in accordance with the definition of SCCs set out below;
d) in Table 4 the “neither party” option shall be selected,
(iv) in relation to SCCs in relation to exports from Switzerland, the EU SCCs shall apply (incorporating the completions set out at (i)(a)-(g) above), as amended by either (a) the FDPIC’ decision guidance of 27 August 2021 found at https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222 setting out amendments to be made to the EU SCCs in respect of transfers subject to the Swiss FADP or (b) such replacement decision of the FDPIC relating to amendments to be made to the EU SCCs from time to time (these amendments known as the “Swiss SCCs”);
(v) in relation to SCCs in relation to exports from any other country, the completions set out in (i)(a)-(g) above shall be made or such other Completions as most closely achieves the same outcome as those Completions.
In respect of any transfers of Personal Data that may occur in the course of the provision of the Service, Module 2 (Controller to Processor) terms, as provided below in Annex 1 to Exhibit D, shall apply to the extent Customer is a Controller of Customer Personal Data. The Module 3 (Processor to Processor) terms, as provided below in Annex 2 to Exhibit D, shall apply to the extent Customer is a Processor (or subprocessor) of Customer Personal Data. For both Module 2 and Module 3 of the Standard Contractual Clauses, the election of specific terms and/or addition of required information shall apply as follows:
(a) The applicable wording for Clause 13(a) of the Standard Contractual Clauses (as determined by the instructions in square brackets in the Standard Contractual Clauses) is retained and the two remaining alternatives are deleted;
(b) details of Subprocessors the data importer intends to engage as set out in Exhibit A and/or any other relevant exhibits for applicable additional Services, respectively, to this Agreement are the “agreed list” of Subprocessors referread to in Clause 9(a) of the Standard Contractual Clauses.
ANNEX 1 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 2: Controller to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([1]) for the transfer of data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b)The data importer shall immediately inform the data exporter if it is unable to follow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([2]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([3]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([4]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii) the data importer is in substantial or persistent breach of these Clauses; or
(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of Ireland.
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Controller
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in clause 4.3(c) of the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.
The controls available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation.
ANNEX 2 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 3: Processor to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([5]) for the transfer of personal data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[Intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter ([1]).
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([6]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.
(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([7]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([8]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). The data exporter shall forward the notification to the controller.
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation, if appropriate in consultation with the controller. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the controller or the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
The data exporter shall forward the notification to the controller.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). The data exporter shall forward the information to the controller.
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimization
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. The data exporter shall make the assessment available to the controller.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a)The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b)In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c)The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i)the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii)the data importer is in substantial or persistent breach of these Clauses; or
(iii)the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority and the controller of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d)Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e)Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a)Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b)The Parties agree that those shall be the courts of Ireland.
(c)A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
(d)The Parties agree to submit themselves to the jurisdiction of such courts.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Processor
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case, Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
The controls available to Customer described in the DPA, as further documented in the Security Documentation.
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
Effective May 3rd 2024 to May 23rd 2024
DownloadTable of Contents
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED IN THE AGREEMENT), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS DPA, THAT YOU UNDERSTAND THE TERMS OF THIS DPA, AND THAT YOU, IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, OR YOU AND THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS DPA. IF YOU ARE ENTERING INTO THESE TERMS IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, YOU ALSO REPRESENT AND WARRANT THAT YOU ARE NOT USING THE PALANTIR TECHNOLOGY ON BEHALF OF OR UNDER THE INSTRUCTIONS OF ANY OTHER THIRD PARTY OR LEGAL ENTITY. IF YOU ARE ENTERING INTO THIS DPA ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS DPA ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS DPA, DO NOT SELECT "I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS DPA, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
The customer agreeing to the terms of this DPA (“Customer”) and the Palantir Technologies entity that is the signatory to the Agreement (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing Customer’s use of Palantir Technology, including the Service, and the provision of related Professional Services to Customer by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This DPA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer under the Agreement. Any capitalized terms used but not defined in this DPA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the terms and conditions in this DPA shall prevail and control.
1 DEFINITIONS
1.1 The following capitalized terms will have the meanings indicated below:
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data that is subject to Data Protection Laws;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all applicable laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of a Controller, including as applicable the terms “processor”, “service provider” “contractor” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws as applicable;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
2 TERM
2.1 This DPA will take effect from the DPA Effective Date and remain in effect until the destruction or return of all Customer Personal Data by Palantir in accordance with the Agreement, at which point it will automatically terminate.
3 SCOPE AND APPLICATION
3.1 This DPA is incorporated into, and forms part of, the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer when in the course of the provision of the Service. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the provisions in this DPA shall prevail and control.
4 ROLE OF THE PARTIES
4.1 Customer and any relevant Customer Affiliate, hereby appoints and instructs Palantir as a Processor, or Subprocessor as applicable, of the Customer Personal Data. Accordingly, the Parties shall comply with applicable Data Protection Laws as relevant to their respective Processing of Customer Personal Data under the Agreement.
4.2 As between the Parties, Customer shall be liable and responsible as the Controller (or Processor, if Customer is Processing Personal Data with the Service for a third-party Controller) and Palantir shall be liable and responsible as the Processor (or Subprocessor), in respect of Customer Personal Data processed under the Agreement.
4.3 In the event that Customer acts as a Processor (or Subprocessor) in respect of Customer Personal Data, Customer represents and warrants to Palantir that it is validly authorized by the relevant Controller to enter into the Agreement and this DPA and to provide Customer Instructions (as defined below) on behalf of Controller in relation to Customer Personal Data.
4.4 In the event that Customer is an employee of Palantir or a Palantir Affiliate, Customer acknowledges that it is not acting on behalf of Palantir or any Palantir Affiliate and is acting as a separate and independent Controller in relation to the Processing of Customer Personal Data via the Palantir Technology.
4.5 In the event that Customer jointly controls Customer Personal Data with a third-party Controller, Customer represents and warrants that its Processing of Customer Personal Data in connection with its use of the Palantir Technology is duly authorised by such third-party Controller and is carried out in compliance with applicable Data Protection Laws.
4.6 In the event that Customer introduces any new User to the Palantir Technology (whether such User is acting on his/her own behalf or on behalf of a third party), Customer shall procure that any such User enters into a separate arrangement directly with Palantir in relation to such use (including any applicable Palantir Terms of Service and any related DPA) and acknowledges that any such User's use of the Palantir Technology shall be conditional on their doing so.
4.7 The subject matter and details of Processing are described in the Agreement and this DPA, including Exhibit B (subject matter and details of Customer Personal Data processing) and any other relevant exhibits for applicable additional Services.
4.8 Palantir shall process Prompts and Outputs as Usage Data, as further described in the Agreement and AIP Now Privacy Policy, to secure the Service, including monitoring for abuse or malicious User activity.
5 CUSTOMER PROCESSING OF PERSONAL DATA
5.1 Customer shall ensure that any Processing of Customer Personal Data via Customer’s use of the Service, including any instructions provided to Palantir in relation to such Processing, shall comply with all applicable Data Protection Laws.
5.2 Customer instructs Palantir to Process Customer Personal Data: (a) to provide the Service specified in the Agreement and Documentation or otherwise perform its obligations thereunder; (b) as further initiated by Customer via Customer’s or Users use of the Service in accordance with the Agreement and Documentation; and/or (c) in accordance with any additional instruction outside the scope of the Agreement or this DPA, as further documented in any other written instructions given by Customer and acknowledged by Palantir in writing as constituting instructions for purposes of this DPA (collectively, “Customer Instructions”). Customer acknowledges that any additional Customer Instructions issued under (c) above may result in additional charges or fees to the Customer by Palantir, which shall be payable in accordance with the terms of the Agreement.
5.3 Customer shall have sole responsibility for the lawful Processing of Customer Personal Data in connection with its use of the Palantir Technology and/or its receipt of any related Professional Services in accordance with applicable Data Protection Laws, including without limitation, the accuracy, quality, and legality of the Customer Personal Data, the means by which it acquires and uses Customer Personal Data, and the Customer Instructions regarding the Processing of Customer Personal Data. Customer represents and warrants that it has (or its Controller has) a valid legal basis for the Processing of Customer Personal Data and has (or its Controller has) provided (or procured the provision of) all notifications and obtained (or procured the provision of) all consents (including Consents), authorisations, approvals, and/or agreements (including, where Customer is a Processor or Subprocessor, with and from the applicable Controller(s)) required under applicable laws or policies in order to enable Palantir to receive and Process Customer Personal Data in accordance with this DPA, the Agreement and Customer Instructions.
5.4 The Customer shall be responsible for providing guidance to Users regarding the use of the Services and in particular the use of Personal Data within the Services.
5.5 The Customer Personal Data shall not include any:
5.5.1 government related identifiers (where that term is defined under applicable Data Protection Laws) to the extent that the Processing of such government related identifiers are not permitted under applicable Data Protection Laws;
5.5.2 Personal Data relating to children (in accordance with the relevant age of majority in applicable jurisdictions), unless permitted under, or in compliance with applicable Data Protection Laws; or
5.5.3 Personal Data which is under the Control of another Controller, without their express authorisation.
6 PALANTIR PROCESSING OF CUSTOMER PERSONAL DATA
6.1 Palantir will Process Customer Personal Data for the business purposes of providing to Customer the services, namely the Palantir Technology and Professional Services pursuant to the Customer Instructions and any other purpose for which the Customer provides authorization via the Service, where such option is made available ("Business Purposes"), in accordance with the terms of the Agreement and this DPA as well as any requirements set out by applicable Data Protection Laws. For the avoidance of doubt, Customer is disclosing Customer Personal Data to Palantir only for the limited and specified Business Purposes set forth within the Agreement and the Customer Instructions. Palantir shall process Customer personal Data pursuant to Customer’s instructions and shall:
(a) designate and maintain a Data Protection Officer as required by Data Protection Laws, which can be contacted at privacy@palantir.com;
(b) not Sell or Share Customer Personal Data or otherwise retain, use, disclose, or Process Customer Personal Data outside of the direct business relationship between the Parties or for any purpose other than for the fulfilment of the Business Purposes pursuant to Customer Instructions, unless obligated to do otherwise by applicable law or regulation or requests or orders of judicial, governmental or regulatory entities (including without limitation subpoenas), in which case Palantir will inform Customer of that legal requirement before such Processing occurs unless legally prohibited from doing so;
(c) not combine Customer Personal Data with Personal Data that it receives from other sources or collects from its own interactions with a Data Subject, provided, that Palantir may combine Customer Personal Data as necessary to perform its Business Purposes and will not Sell or Share Customer Personal Data;
(d) implement appropriate Technical and Organisational Measures to protect the confidentiality, integrity, availability and resilience of Palantir’s systems Processing Customer Personal Data. Palantir may update the Technical and Organisational Measures from time to time provided that any such updates are no less protective than the original Technical and Organisational Measures. To the extent such assistance requires Palantir to take additional steps beyond those imposed on Palantir by Data Protection Laws or specifically required pursuant to the Agreement; or to the extent the relevant technical and organizational measures are required as a result of an act or omission by Customer or a Party acting on behalf of Customer in breach of this Agreement or Data Protection Laws, then Palantir’s obligation to provide such assistance shall be subject to Customer’s payment of Palantir’s reasonable fees in respect of such additional assistance; Palantir’s security obligations under this DPA apply without prejudice to the Customer’s own security obligations under applicable Data Protection Laws;
(e) ensure that all persons authorized by Palantir to Process Customer Personal Data, including any Subprocessors (as defined below), are bound by confidentiality obligations consistent with those set out in this DPA, the Agreement or otherwise sufficient to meet the requirements of Data Protection Laws;
(f) take reasonable steps to return or destroy Customer Personal Data, when it is no longer necessary for the purposes of performing the relevant Services upon termination of the Agreement, unless storage is otherwise required under applicable Data Protection Laws; and
(g) process Customer Personal Data in a manner that is consistent with the same level of privacy protection that is required of Customer under applicable Data Protection Laws.
6.2 Customer shall instruct Palantir as to the subject-matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and the categories of Data Subjects taking into account the specific tasks and responsibilities of the Processor in the context of the Processing to be carried out and the risk to the rights and freedoms of the Data Subject as part of Customer Instructions. Notwithstanding anything to the contrary herein, Customer shall ensure that its acts or omissions, including in relation to any Customer Instructions to Palantir, do not put Palantir in breach of the Data Protection Laws.
6.3 Customer has assessed the level of security appropriate to the Processing in the context of its obligations under Data Protection Laws and agrees that the Technical and Organisational Measures are consistent with such assessment. Customer further acknowledges that Palantir is not able to assess, and does not have knowledge of, the specific Personal Data provided by Customer to Palantir or made available by Customer to Palantir in relation to the Services and that as a result the technical and organisational Measures proposed by Palantir are generic in nature and Palantir is unable to assess whether or not they reflect any particular risks posed by the Personal Data.
7 SUBPROCESSORS
7.1 Customer specifically authorizes the engagement as Subprocessors of (a) the entities listed in Exhibit A and/or applicable specific additional Services exhibits in this DPA and (b) all Palantir Affiliates from time to time, provided that, prior to permitting such Subprocessors to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.2 Subject to Section 7.3, Customer generally authorizes Palantir to engage additional Subprocessors (“Additional Subprocessors”), provided that, prior to permitting such Additional Subprocessor to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Additional Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.3 At least 30 days before Palantir initiating the use of an Additional Subprocessor in connection with the provision of Services to Customer, the updated list of Subprocessors for the Service shall be available in Exhibit A, also accessible here https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795, and Palantir shall provide Customer with a mechanism to obtain notice of that update. The Parties agree this notification satisfies the notification requirements of Section 28.2 of the GDPR and Clause 9 of the SCC. Where Customer indicates in writing that it objects to the Processing of Customer Personal Data by such Additional Subprocessor, the Parties shall seek to resolve the Customer concerns and where necessary the Customer may exercise its applicable rights to terminate the Agreement.
7.4 To the extent required by Data Protection Law, Palantir shall remain liable to Customer for the performance of the Subprocessor’s obligations in relation to this Section 7 (“Subprocessor Data Protection Liability”), and Palantir shall be permitted to re-perform or to procure the re-performance of any such obligations and Customer acknowledges that such re-performance shall diminish any claim that Customer has against Palantir in respect of any Subprocessor Data Protection Liability.
8 AUDIT
8.1 Palantir uses third party auditors to verify the adequacy of its security measures. This audit is performed at least annually, by independent and reputable third-party auditors at Palantir’s selection and expense, and in accordance with Service Organization Controls 2 (SOC2) or substantially equivalent industry standards, and results in the generation of an audit report (“Report”) which will be the Confidential Information of Palantir. The Service and operations are also certified compliant with the standards and accreditations set out on the “compliance and accreditation” tab at: https://www.palantir.com/information-security/ (“Accreditations”).
8.2 At Customer’s written request, Palantir will provide Customer with a confidential summary of the Report, documentation evidencing compliance with the Accreditations, and the Accountability Information outlined in Section 10 of this DPA so that Customer can reasonably verify Palantir’s compliance with the data security and data protection obligations under this DPA. Subject to Section 8.3, if Data Protection Laws, Standard Contractual Clauses, or the Agreement require Palantir to provide Customer with access to Palantir facilities or information in addition to the Report and the Accountability Information, then Palantir shall permit Customer to audit Palantir’s compliance with the terms and conditions of this DPA as it applies to Customer Personal Data to the extent expressly required by the Agreement, the Standard Contractual Clauses, or Data Protection Laws.
8.3 In order to request an audit of Palantir’s facilities under this Section 8 (and where such an audit is authorized under Section 8.2), Customer shall notify Palantir and the Parties shall agree, as soon as reasonably possible but always in advance, the reasonable dates, duration and scope of the audit, the identity and qualifications of the auditor, and any security and confidentiality controls required for access to the information or Processes in scope of such audit. Palantir may decline the request or decline to follow any instruction requested by Customer regarding audits. To the extent Palantir declines an audit request and such audit is unambiguously required under applicable Data Protection Laws or the DPA, Customer is entitled to terminate the Agreement in accordance with the Agreement. The Customer shall bear the reasonable costs of Palantir in fulfilling any requirements under this Section. The scope of any audit under this Section 8 shall be limited to Palantir systems and facilities used to Process Customer Personal Data and Documentation directly related to such Processing.
8.4 All information provided or made available to Customer, its auditor or any other third party authorized under the present DPA to have access to the above information pursuant to this Section 8 shall be Confidential Information of Palantir.
8.5 In the event of any confirmed material non-compliance by Palantir with the terms of this DPA, Customer may take reasonable steps to remediate the same, including, without limitation, by requiring the suspension of all Processing of Customer Personal Data until such time as Customer determines that the non-compliance has been remediated. In the event that Palantir determines that it can no longer meet its obligations pursuant to this DPA, Palantir shall promptly notify Customer of such determination.
9 DEALINGS WITH DATA PROTECTION AUTHORITIES AND DATA PROTECTION IMPACT ASSESSMENTS
9.1 Palantir shall reasonably cooperate, on reasonable request and at Customer’s cost, with any Data Protection Authority in the performance of its tasks, taking into account the nature of the Processing by, and information available to, Palantir.
9.2 Taking into account the nature of the Service and the information available to Palantir, Palantir will assist Customer in complying with Customer’s obligations in respect of data protection impact assessments (including a 'risk assessment', 'privacy impact assessment', 'data protection assessment' or any equivalent documentation) and prior consultation or mandatory submission to a Data Protection Authority where applicable under Data Protection Laws, by providing the Report, Accountability Information and Documentation.
10 ACCOUNTABILITY
To the extent required by Data Protection Laws, Palantir shall maintain electronic records of all categories of Processing activities carried out on behalf of Customer, containing:
(a) the name and contact details of the Processors and Subprocessors;
(b) details of the types of Processing being carried out;
(c) details of any transfers of Customer Personal Data to a territory or international organisation outside of the EEA or UK, and documentation of suitable safeguards (if applicable); and
(d) a general description of the technical and organisational security measures used in relation to the Processing,
together, the “Accountability Information”.
11 DATA SUBJECT RIGHTS
11.1 With regard to Customer Personal Data, where Palantir directly receives a Request from a Data Subject, or anyone authorized to act on their behalf, any claim or complaint in relation to their rights under the Data Protection Laws, and provided Palantir can reasonably identify from the information provided that the request, claim or complaint relates to Customer and Customer Personal Data, then unless prohibited by applicable law, Palantir shall forward the request, claim or complaint to Customer.
11.2 The Service provides Customer with controls, including security features and functionalities, that Customer may use to retrieve, correct, delete or restrict Customer Personal Data. Customer may use these controls as technical and organisational measures to comply with its obligations under Data Protection Laws, to respond to requests from Data Subjects.
12 DATA INCIDENT
12.1 Palantir shall notify Customer without undue delay after becoming aware of (or where required by applicable Data Protection Laws) having reasonable grounds to believe that there has been a Data Incident and provide Customer with any information required to be included under applicable Data Protection Laws. For avoidance of doubt, a Data Incident shall not include acts or omissions which do not breach Palantir’s security or the security of any Subprocessor; port scans, authorized penetration tests, and denial of service attacks; or any access to or Processing of Customer Personal Data that is consistent with Customer Instructions. Palantir’s notification of, or response to, a Data Incident in accordance with this Section 12.1. will not be construed as an acknowledgment by Palantir of any fault or liability with respect to the Data Incident.
12.2 Palantir shall provide Customer with reasonable cooperation and assistance in dealing with a Data Incident, in particular in relation to (a) taking commercially reasonable steps to resolve any data privacy or security issues involving any Customer Personal Data; and (b) providing Customer with necessary and requested assistance to enable Customer to make any appropriate notifications to individuals affected by the Data Incident or to a Supervisory Authority to the extent reasonably possible; provided that, Customer shall maintain and follow an effective cyber incident response policy, which shall include the use of legal professional, litigation, or client attorney privilege, work in good faith with Palantir in relation to the Data Incident, or, in the event that Customer acts as an individual or sole trader, provided that Customer shall maintain and follow effective and necessary incident responses and mitigation measures reasonably expected from any individual or sole trader and agree with Palantir the form and method of any public announcement in relation to the Data Incident.
12.3 Any information provided by Palantir pursuant to this Section 12 shall be the Confidential Information of Palantir and Palantir’s notification of or response to a Data Incident under this Section 12 will not be construed as an acknowledgement by Palantir or, if relevant, its Subprocessors of any fault or liability with respect to the performance of any Service or Professional Services (as applicable).
13 DATA TRANSFERS
13.1 Palantir may Process Personal Data in countries outside of the country in which Customer is established in which Palantir or its Subprocessors maintains facilities, employees or infrastructure.
13.2 Where the Processing of Customer Personal Data in the course of the provision of the Service involves a Restricted Transfer of Customer Personal Data by or on behalf of Customer, from a country which places restrictions on the transfer of Personal Data to countries not deemed to be an Adequate Country then:
(a) The Parties shall hereby enter into a set of SCCs. The applicable SCCs and any required Completions as applicable and set out in Exhibit D, shall hereby be deemed incorporated into this DPA, and apply between Customer (as Exporter) and Palantir (as importer);
(b) Palantir shall provide appropriate safeguards, meeting the requirements of the SCCs in respect of onward transfers, in relation to transfers of Personal Data between Palantir Affiliates for the purpose of performing Services; and
(c) Palantir shall ensure that any transfers of Customer Personal Data between Palantir and any Palantir third party Subprocessors, are subject to contractual terms between Palantir and the relevant third party Subprocessor providing appropriate safeguards and containing clauses equivalent to the SCCs.
13.3 Nothing in this DPA or the Agreement modifies any rights or obligations of Palantir or customer under the Standard Contractual Clauses.
14 LIABILITY
14.1 Subject to 14.2, the total combined liability of either Party and its Affiliates towards the other Party and its Affiliates under or in connection with the Agreement and the Standard Contractual Clauses combined will be the liability cap, and subject to the liability limitations, set forth in the Agreement for the relevant Party.
14.2 Nothing in this DPA serves to modify, disapply or amend the terms of the Agreement relating to liability, including but not limited to any exclusions and/or limitations of liability.
14.3 Customer shall ensure that all Customer Data it uploads in the course of the provision of the Service is accurate and complies with all applicable laws. Customer shall defend and indemnify Palantir for any and all damages, liabilities, penalties, fines and expenses (including from third parties) arising out of the Customer’s failure to comply with the present provision or any applicable laws in connection with Customer Data.
15 GOVERNING LAW AND JURISDICTION
15.1 The Parties shall modify the terms of this DPA as soon as possible if such modification is required for the parties to comply with any Data Protection Laws, or in order to implement or adhere to the Standard Contractual Clauses or such other permitted compliance mechanism under Data Protection Laws.
15.2 This DPA, and any dispute or claim (including any non-contractual disputes or claims) arising out of or in connection with it, or its subject matter or formation, shall be governed by and construed in accordance with the laws that govern the Agreement. If it is or becomes a requirement that, under the Data Protection Laws or other applicable laws, this DPA must be governed by (a) the laws of a member state of the European Union (and it is not already so governed), this DPA shall be governed by and construed in accordance with the laws of Ireland; (b) the laws of the United Kingdom, this DPA shall be governed by and construed in accordance with the laws of England and Wales, and/or (c) the laws of any other jurisdiction, then this DPA shall be governed by and construed in accordance with the laws of that jurisdiction, but only to the extent required to satisfy such laws.
15.3 The Parties irrevocably agree that the forum set out in the Agreement shall have exclusive jurisdiction to settle any dispute which may arise out of or in connection with this DPA and the documents to be entered into pursuant to it and that, accordingly, any proceedings arising out of or in connection with this DPA shall be brought in such forum save that where a mandatory requirement of Data Protection Law or other applicable laws requires that disputes arising out of or in connection with this DPA and any documents to be entered into pursuant to it are heard in (a) a member state of the European Union, then such disputes shall be heard in Ireland; (b) the United Kingdom, then such disputes shall be heard in England and Wales; and/or (c) any alternative forum, then such disputes shall be heard in that alternative forum, to the extent legally permitted. Each of the Parties irrevocably submits to the jurisdiction of such forum and waives any objection to proceedings in any such forum on the ground of venue or on the ground that proceedings have been brought in an inconvenient forum.
16 GENERAL TERMS
16.1 Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, whilst preserving the Parties’ intension as closely as possible, or, where not possible, (ii) construed in a manner as if the invalid off unenforceable part had never been contained therein.
16.2 Palantir may notify Customer in writing from time to time of any variations to this DPA, including relating to cross border transfers, which are required as a result of change in Data Protection Laws. Any such changes required shall take effect on the date falling 25 working days after the date such written notice is sent by Palantir to the Customer.
EXHIBIT A
List of approved Subprocessors
PART I - Subprocessors
To perform its obligations under the Palantir Terms of Service and Palantir Data Protection Agreement (or the alternative written agreement between Customer and Palantir, if applicable), Palantir Technologies Inc. and its Affiliates may use third party data processors (“Third-Party Subprocessors”) and Palantir Affiliates to process Customer Personal Data. Capitalized terms used but not defined here shall have the meanings provided in the Agreement.
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure, and AI services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
PART II – Palantir Affiliates
Provided that an adequate level of data protection consistent with the Data Protection Laws and this Agreement is ensured by Palantir, Customer specifically authorizes Palantir Affiliates as listed here and as updated from time to time to act as Palantir’s Subprocessor(s) including by Processing Customer Personal Data for the purposes of the Agreement for the delivery of Service and/or Professional Services to Customer. Where required, Palantir and its respective Affiliate have entered into the Standard Contractual Clauses. Such Processing, where applicable, shall occur under the control and direction of Palantir and shall occur on systems managed or otherwise controlled by Palantir.
EXHIBIT B
Subject Matter and Details of Customer Personal Data Processing
Palantir Privacy Contact
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Service (as applicable) or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users.
Subject Matter of Processing
Palantir’s provision of the Service and Professional Services and performance of its obligations under the Agreement.
Nature and Purpose of Processing
Palantir will Process Customer Personal Data in accordance with the terms of this DPA for the purpose of providing the Service and Professional Services to Customer, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT C – APOLLO SERVICES
The following capitalized term will have the meaning indicated below:
“Apollo Services” means the specific Service selected by Customer in the Order Form for end-to-end continuous deployment SaaS solution, enabling Users to centrally manage multiple versions of Palantir Technology across independent environments and as exclusively described in the present Exhibit C for Apollo Services, excluding the application of Exhibit A and Exhibit B of the present DPA;
EXHIBIT C-1
List of approved Subprocessors
PART I – Subprocessors
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of providing Apollo Services to Customer under the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
PART II – Palantir Affiliates
As described under "PART II – Palantir Affiliates" in Exhibit A.
EXHIBIT C-2
Subject Matter and Details of Customer Personal Data Processing
For the provision of Apollo Services, the following shall apply:
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Apollo Service or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing via the Apollo Service by or at the direction of Customer or Customer’s Users. Categories of Customer Personal Data include Users identification details: name, addresses, email addresses and IDs.
Subject Matter of Processing
Palantir’s provision of the Apollo Service under the Agreement.
Nature and Purpose of Processing
Palantir will Process the above detailed Customer Personal Data in accordance with the terms of this DPA for the purpose of setting up Apollo Users’ accounts, providing the Apollo Service to Customer including scanning managed environments for vulnerabilities, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT D
Additions to the Standard Contractual Clauses
The following capitalized term will have the meaning indicated below:
"UK Addendum" means the international data transfer addendum to the EU SCCs issued by the UK Information Commissioner under s. 119A of the Data Protection Act 2018, or such other addendum as may amend or replace the addendum from time to time.
“Completions” means
(i) in relation to the EU SCCs in relation to exports from the EEA:
a) the optional wording at Clauses 7 and 11 is deleted;
b) in Clause 8.9 of such SCCs, the following paragraph is added after subsection (d):
“(e) Notwithstanding the above, any audit will be limited in scope and parameter to the systems processing the relevant personal data.
Where audits include inspections, they shall be carried out with reasonable prior notice. The parties will mutually agree upon the scope, timing, duration, control and evidence requirements of the audit, provided that this requirement to agree will not permit the data importer to unreasonably delay performance of the audit.
Any audit made pursuant to this Clause (i) shall be at the expense of the requesting data exporter, and such expenses shall include any reasonable related costs of the data importer, including compensation for the hours worked by the data importer’s staff; (ii) may, if the data exporter seeks to retain an independent auditor, only be done by a party approved in advance by the data importer, which approval cannot be unreasonably withheld; and (iii) shall be subject to a non-disclosure agreement.”
c) in Clause 9, Option 1 is deleted and the time period shall be not less than 30 days;
d) the applicable wording for Clause 13(a) of the EU SCCs (as determined by the instructions in square brackets in such SCCs) is retained and the two remaining alternatives are deleted;
e) in Clause 17 of the EU SCCs, Option 2 is deleted and Option 1 is completed with details of the laws of Ireland and in Clause 18(b) of the EU SCCs is completed with details of the courts of Ireland;
f) the parties set out in Annex 1 shall be completed with the names of the Customer as exporter and Palantir as importer, the transfers shall be as described in Exhibit B and any other relevant exhibits for applicable additional Services under this DPA and the supervisory authority shall be the Irish supervisory authority; in Annex II the list of technical and organisational measures shall be the Technical and Organisational Measures and in Annex III the list of sub-processors shall be those set out in Exhibit A; and
g) in the event that the EU SCCs are replaced from those in force at the Effective Date, such completions shall be made to the revised SCCs as most closely replicate those set out above.
(ii) in relation to the EU SCCs in relation to exports from other jurisdictions besides the EEA the completions set out in (i)(a)-(g) above shall apply save that:
a) in Clause 17 of such EU SCC, the second sentence is replaced with the following: “The Parties agree that this shall be English law” save where another governing law of the EU SCCs is required as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 17 shall be completed with details of the law which that Data Protection Law requires must be applied to such EU SCCs;
b) Clause 18(b) is replaced with the following “18(b) The Parties agree that those shall be the courts of England & Wales” save where another country, state or territory must have jurisdiction over the EU SCCs as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 18(b) of such EU SCCs shall be completed with details of the country, state or territory which that Data Protection Law requires must have jurisdiction over the EU SCCs;
c) references in the EU SCC to “a third party located outside the European Union” are replaced by references to “a third party located outside the country or territory in which the data exporter is established”;
d) references in such EU SCC to “the Member State” are replaced by references to “the country or territory in which the data exporter is established”;
e) all references to the GDPR in such EU SCC are replaced by references to Data Protection Law of the relevant country and references to provisions or concepts of the GDPR are replaced by references to the provisions or concepts of such Data Protection Law most closely related to the relevant term as understood in the GDPR;
f) all references to Member States of the European Union or to the European Union are replaced by references to the country of establishment of the exporter;
g) save where required as mandatory requirement of the relevant Data Protection Law, all references in the EU SCC to (a) data subject rights or other third party beneficiary rights or (b) to obligations or liability towards data subjects or other third parties shall be deleted and ignored; and
h) to the extent that any of references to the EU SCCs referred to above under (i) to (viii) are replaced in any amended provisions or replacement or subsequently approved clauses or instrument after the Effective Date, the amendments provided above under (ii)(a)-(h) shall be adapted and/or completed if and to the extent appropriate to reflect the effect of the former as close as possible
(iii) in relation to SCCs in relation to exports from the UK the EU SCCs shall apply as amended by either (i) the Information Commissioner’s “UK Addendum to the EU Commission Standard Contractual Clauses” found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdfhttps://ico.org.uk/media/about-the-ico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf or (ii) such replacement addendum to the EU Standard Contractual Clauses as the Information Commissioner might issue from time to time (these addenda known as the “UK SCC”), with the following items completed (or in the case of (ii) those items as most closely approximate the following items):
a) to the extent not covered by the foregoing, the completions set out in (i)(a)-(g) above shall apply save that:
b) Table 1 shall be completed with the names of the Customer as exporter and Palantir as importer;
c) in Table 2 the module of the EU SCCs selected shall be determined in accordance with the definition of SCCs set out below;
d) in Table 4 the “neither party” option shall be selected,
(iv) in relation to SCCs in relation to exports from Switzerland, the EU SCCs shall apply (incorporating the completions set out at (i)(a)-(g) above), as amended by either (a) the FDPIC’ decision guidance of 27 August 2021 found at https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222 setting out amendments to be made to the EU SCCs in respect of transfers subject to the Swiss FADP or (b) such replacement decision of the FDPIC relating to amendments to be made to the EU SCCs from time to time (these amendments known as the “Swiss SCCs”);
(v) in relation to SCCs in relation to exports from any other country, the completions set out in (i)(a)-(g) above shall be made or such other Completions as most closely achieves the same outcome as those Completions.
In respect of any transfers of Personal Data that may occur in the course of the provision of the Service, Module 2 (Controller to Processor) terms, as provided below in Annex 1 to Exhibit D, shall apply to the extent Customer is a Controller of Customer Personal Data. The Module 3 (Processor to Processor) terms, as provided below in Annex 2 to Exhibit D, shall apply to the extent Customer is a Processor (or subprocessor) of Customer Personal Data. For both Module 2 and Module 3 of the Standard Contractual Clauses, the election of specific terms and/or addition of required information shall apply as follows:
(a) The applicable wording for Clause 13(a) of the Standard Contractual Clauses (as determined by the instructions in square brackets in the Standard Contractual Clauses) is retained and the two remaining alternatives are deleted;
(b) details of Subprocessors the data importer intends to engage as set out in Exhibit A and/or any other relevant exhibits for applicable additional Services, respectively, to this Agreement are the “agreed list” of Subprocessors referread to in Clause 9(a) of the Standard Contractual Clauses.
ANNEX 1 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 2: Controller to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([1]) for the transfer of data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b)The data importer shall immediately inform the data exporter if it is unable to follow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([2]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([3]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([4]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii) the data importer is in substantial or persistent breach of these Clauses; or
(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of Ireland.
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Controller
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in clause 4.3(c) of the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.
The controls available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation.
ANNEX 2 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 3: Processor to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([5]) for the transfer of personal data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[Intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter ([1]).
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([6]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.
(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([7]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([8]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). The data exporter shall forward the notification to the controller.
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation, if appropriate in consultation with the controller. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the controller or the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
The data exporter shall forward the notification to the controller.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). The data exporter shall forward the information to the controller.
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimization
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. The data exporter shall make the assessment available to the controller.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a)The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b)In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c)The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i)the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii)the data importer is in substantial or persistent breach of these Clauses; or
(iii)the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority and the controller of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d)Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e)Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a)Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b)The Parties agree that those shall be the courts of Ireland.
(c)A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
(d)The Parties agree to submit themselves to the jurisdiction of such courts.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Processor
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case, Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
The controls available to Customer described in the DPA, as further documented in the Security Documentation.
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
Effective May 1st 2024 to May 3rd 2024
DownloadTable of Contents
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED IN THE AGREEMENT), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS DPA, THAT YOU UNDERSTAND THE TERMS OF THIS DPA, AND THAT YOU, IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, OR YOU AND THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS DPA. IF YOU ARE ENTERING INTO THESE TERMS IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, YOU ALSO REPRESENT AND WARRANT THAT YOU ARE NOT USING THE PALANTIR TECHNOLOGY ON BEHALF OF OR UNDER THE INSTRUCTIONS OF ANY OTHER THIRD PARTY OR LEGAL ENTITY. IF YOU ARE ENTERING INTO THIS DPA ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS DPA ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS DPA, DO NOT SELECT "I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS DPA, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
The customer agreeing to the terms of this DPA (“Customer”) and the Palantir Technologies entity that is the signatory to the Agreement (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing Customer’s use of Palantir Technology, including the Service, and the provision of related Professional Services to Customer by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This DPA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer under the Agreement. Any capitalized terms used but not defined in this DPA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the terms and conditions in this DPA shall prevail and control.
1 DEFINITIONS
1.1 The following capitalized terms will have the meanings indicated below:
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data that is subject to Data Protection Laws;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all applicable laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of a Controller, including as applicable the terms “processor”, “service provider” “contractor” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws as applicable;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
2 TERM
2.1 This DPA will take effect from the DPA Effective Date and remain in effect until the destruction or return of all Customer Personal Data by Palantir in accordance with the Agreement, at which point it will automatically terminate.
3 SCOPE AND APPLICATION
3.1 This DPA is incorporated into, and forms part of, the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer when in the course of the provision of the Service. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the provisions in this DPA shall prevail and control.
4 ROLE OF THE PARTIES
4.1 Customer and any relevant Customer Affiliate, hereby appoints and instructs Palantir as a Processor, or Subprocessor as applicable, of the Customer Personal Data. Accordingly, the Parties shall comply with applicable Data Protection Laws as relevant to their respective Processing of Customer Personal Data under the Agreement.
4.2 As between the Parties, Customer shall be liable and responsible as the Controller (or Processor, if Customer is Processing Personal Data with the Service for a third-party Controller) and Palantir shall be liable and responsible as the Processor (or Subprocessor), in respect of Customer Personal Data processed under the Agreement.
4.3 In the event that Customer acts as a Processor (or Subprocessor) in respect of Customer Personal Data, Customer represents and warrants to Palantir that it is validly authorized by the relevant Controller to enter into the Agreement and this DPA and to provide Customer Instructions (as defined below) on behalf of Controller in relation to Customer Personal Data.
4.4 In the event that Customer is an employee of Palantir or a Palantir Affiliate, Customer acknowledges that it is not acting on behalf of Palantir or any Palantir Affiliate and is acting as a separate and independent Controller in relation to the Processing of Customer Personal Data via the Palantir Technology.
4.5 In the event that Customer jointly controls Customer Personal Data with a third-party Controller, Customer represents and warrants that its Processing of Customer Personal Data in connection with its use of the Palantir Technology is duly authorised by such third-party Controller and is carried out in compliance with applicable Data Protection Laws.
4.6 In the event that Customer introduces any new User to the Palantir Technology (whether such User is acting on his/her own behalf or on behalf of a third party), Customer shall procure that any such User enters into a separate arrangement directly with Palantir in relation to such use (including any applicable Palantir Terms of Service and any related DPA) and acknowledges that any such User's use of the Palantir Technology shall be conditional on their doing so.
4.7 The subject matter and details of Processing are described in the Agreement and this DPA, including Exhibit B (subject matter and details of Customer Personal Data processing) and any other relevant exhibits for applicable additional Services.
4.8 Palantir shall process Prompts and Outputs as Usage Data, as further described in the Agreement and AIP Now Privacy Policy, to secure the Service, including monitoring for abuse or malicious User activity.
5 CUSTOMER PROCESSING OF PERSONAL DATA
5.1 Customer shall ensure that any Processing of Customer Personal Data via Customer’s use of the Service, including any instructions provided to Palantir in relation to such Processing, shall comply with all applicable Data Protection Laws.
5.2 Customer instructs Palantir to Process Customer Personal Data: (a) to provide the Service specified in the Agreement and Documentation or otherwise perform its obligations thereunder; (b) as further initiated by Customer via Customer’s or Users use of the Service in accordance with the Agreement and Documentation; and/or (c) in accordance with any additional instruction outside the scope of the Agreement or this DPA, as further documented in any other written instructions given by Customer and acknowledged by Palantir in writing as constituting instructions for purposes of this DPA (collectively, “Customer Instructions”). Customer acknowledges that any additional Customer Instructions issued under (c) above may result in additional charges or fees to the Customer by Palantir, which shall be payable in accordance with the terms of the Agreement.
5.3 Customer shall have sole responsibility for the lawful Processing of Customer Personal Data in connection with its use of the Palantir Technology and/or its receipt of any related Professional Services in accordance with applicable Data Protection Laws, including without limitation, the accuracy, quality, and legality of the Customer Personal Data, the means by which it acquires and uses Customer Personal Data, and the Customer Instructions regarding the Processing of Customer Personal Data. Customer represents and warrants that it has (or its Controller has) a valid legal basis for the Processing of Customer Personal Data and has (or its Controller has) provided (or procured the provision of) all notifications and obtained (or procured the provision of) all consents (including Consents), authorisations, approvals, and/or agreements (including, where Customer is a Processor or Subprocessor, with and from the applicable Controller(s)) required under applicable laws or policies in order to enable Palantir to receive and Process Customer Personal Data in accordance with this DPA, the Agreement and Customer Instructions.
5.4 The Customer shall be responsible for providing guidance to Users regarding the use of the Services and in particular the use of Personal Data within the Services.
5.5 The Customer Personal Data shall not include any:
5.5.1 government related identifiers (where that term is defined under applicable Data Protection Laws) to the extent that the Processing of such government related identifiers are not permitted under applicable Data Protection Laws;
5.5.2 Personal Data relating to children (in accordance with the relevant age of majority in applicable jurisdictions), unless permitted under, or in compliance with applicable Data Protection Laws; or
5.5.3 Personal Data which is under the Control of another Controller, without their express authorisation.
6 PALANTIR PROCESSING OF CUSTOMER PERSONAL DATA
6.1 Palantir will Process Customer Personal Data for the business purposes of providing to Customer the services, namely the Palantir Technology and Professional Services pursuant to the Customer Instructions and any other purpose for which the Customer provides authorization via the Service, where such option is made available ("Business Purposes"), in accordance with the terms of the Agreement and this DPA as well as any requirements set out by applicable Data Protection Laws. For the avoidance of doubt, Customer is disclosing Customer Personal Data to Palantir only for the limited and specified Business Purposes set forth within the Agreement and the Customer Instructions. Palantir shall process Customer personal Data pursuant to Customer’s instructions and shall:
(a) designate and maintain a Data Protection Officer as required by Data Protection Laws, which can be contacted at privacy@palantir.com;
(b) not Sell or Share Customer Personal Data or otherwise retain, use, disclose, or Process Customer Personal Data outside of the direct business relationship between the Parties or for any purpose other than for the fulfilment of the Business Purposes pursuant to Customer Instructions, unless obligated to do otherwise by applicable law or regulation or requests or orders of judicial, governmental or regulatory entities (including without limitation subpoenas), in which case Palantir will inform Customer of that legal requirement before such Processing occurs unless legally prohibited from doing so;
(c) not combine Customer Personal Data with Personal Data that it receives from other sources or collects from its own interactions with a Data Subject, provided, that Palantir may combine Customer Personal Data as necessary to perform its Business Purposes and will not Sell or Share Customer Personal Data;
(d) implement appropriate Technical and Organisational Measures to protect the confidentiality, integrity, availability and resilience of Palantir’s systems Processing Customer Personal Data. Palantir may update the Technical and Organisational Measures from time to time provided that any such updates are no less protective than the original Technical and Organisational Measures. To the extent such assistance requires Palantir to take additional steps beyond those imposed on Palantir by Data Protection Laws or specifically required pursuant to the Agreement; or to the extent the relevant technical and organizational measures are required as a result of an act or omission by Customer or a Party acting on behalf of Customer in breach of this Agreement or Data Protection Laws, then Palantir’s obligation to provide such assistance shall be subject to Customer’s payment of Palantir’s reasonable fees in respect of such additional assistance; Palantir’s security obligations under this DPA apply without prejudice to the Customer’s own security obligations under applicable Data Protection Laws;
(e) ensure that all persons authorized by Palantir to Process Customer Personal Data, including any Subprocessors (as defined below), are bound by confidentiality obligations consistent with those set out in this DPA, the Agreement or otherwise sufficient to meet the requirements of Data Protection Laws;
(f) take reasonable steps to return or destroy Customer Personal Data, when it is no longer necessary for the purposes of performing the relevant Services upon termination of the Agreement, unless storage is otherwise required under applicable Data Protection Laws; and
(g) process Customer Personal Data in a manner that is consistent with the same level of privacy protection that is required of Customer under applicable Data Protection Laws.
6.2 Customer shall instruct Palantir as to the subject-matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and the categories of Data Subjects taking into account the specific tasks and responsibilities of the Processor in the context of the Processing to be carried out and the risk to the rights and freedoms of the Data Subject as part of Customer Instructions. Notwithstanding anything to the contrary herein, Customer shall ensure that its acts or omissions, including in relation to any Customer Instructions to Palantir, do not put Palantir in breach of the Data Protection Laws.
6.3 Customer has assessed the level of security appropriate to the Processing in the context of its obligations under Data Protection Laws and agrees that the Technical and Organisational Measures are consistent with such assessment. Customer further acknowledges that Palantir is not able to assess, and does not have knowledge of, the specific Personal Data provided by Customer to Palantir or made available by Customer to Palantir in relation to the Services and that as a result the technical and organisational Measures proposed by Palantir are generic in nature and Palantir is unable to assess whether or not they reflect any particular risks posed by the Personal Data.
7 SUBPROCESSORS
7.1 Customer specifically authorizes the engagement as Subprocessors of (a) the entities listed in Exhibit A and/or applicable specific additional Services exhibits in this DPA and (b) all Palantir Affiliates from time to time, provided that, prior to permitting such Subprocessors to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.2 Subject to Section 7.3, Customer generally authorizes Palantir to engage additional Subprocessors (“Additional Subprocessors”), provided that, prior to permitting such Additional Subprocessor to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Additional Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.3 At least 30 days before Palantir initiating the use of an Additional Subprocessor in connection with the provision of Services to Customer, the updated list of Subprocessors for the Service shall be available in Exhibit A, also accessible here https://palantir.pactsafe.io/aip-now-6493.html#template-kuaug4bax, and Palantir shall provide Customer with a mechanism to obtain notice of that update. The Parties agree this notification satisfies the notification requirements of Section 28.2 of the GDPR and Clause 9 of the SCC. Where Customer indicates in writing that it objects to the Processing of Customer Personal Data by such Additional Subprocessor, the Parties shall seek to resolve the Customer concerns and where necessary the Customer may exercise its applicable rights to terminate the Agreement.
7.4 To the extent required by Data Protection Law, Palantir shall remain liable to Customer for the performance of the Subprocessor’s obligations in relation to this Section 7 (“Subprocessor Data Protection Liability”), and Palantir shall be permitted to re-perform or to procure the re-performance of any such obligations and Customer acknowledges that such re-performance shall diminish any claim that Customer has against Palantir in respect of any Subprocessor Data Protection Liability.
8 AUDIT
8.1 Palantir uses third party auditors to verify the adequacy of its security measures. This audit is performed at least annually, by independent and reputable third-party auditors at Palantir’s selection and expense, and in accordance with Service Organization Controls 2 (SOC2) or substantially equivalent industry standards, and results in the generation of an audit report (“Report”) which will be the Confidential Information of Palantir. The Service and operations are also certified compliant with the standards and accreditations set out on the “compliance and accreditation” tab at: https://www.palantir.com/information-security/ (“Accreditations”).
8.2 At Customer’s written request, Palantir will provide Customer with a confidential summary of the Report, documentation evidencing compliance with the Accreditations, and the Accountability Information outlined in Section 10 of this DPA so that Customer can reasonably verify Palantir’s compliance with the data security and data protection obligations under this DPA. Subject to Section 8.3, if Data Protection Laws, Standard Contractual Clauses, or the Agreement require Palantir to provide Customer with access to Palantir facilities or information in addition to the Report and the Accountability Information, then Palantir shall permit Customer to audit Palantir’s compliance with the terms and conditions of this DPA as it applies to Customer Personal Data to the extent expressly required by the Agreement, the Standard Contractual Clauses, or Data Protection Laws.
8.3 In order to request an audit of Palantir’s facilities under this Section 8 (and where such an audit is authorized under Section 8.2), Customer shall notify Palantir and the Parties shall agree, as soon as reasonably possible but always in advance, the reasonable dates, duration and scope of the audit, the identity and qualifications of the auditor, and any security and confidentiality controls required for access to the information or Processes in scope of such audit. Palantir may decline the request or decline to follow any instruction requested by Customer regarding audits. To the extent Palantir declines an audit request and such audit is unambiguously required under applicable Data Protection Laws or the DPA, Customer is entitled to terminate the Agreement in accordance with the Agreement. The Customer shall bear the reasonable costs of Palantir in fulfilling any requirements under this Section. The scope of any audit under this Section 8 shall be limited to Palantir systems and facilities used to Process Customer Personal Data and Documentation directly related to such Processing.
8.4 All information provided or made available to Customer, its auditor or any other third party authorized under the present DPA to have access to the above information pursuant to this Section 8 shall be Confidential Information of Palantir.
8.5 In the event of any confirmed material non-compliance by Palantir with the terms of this DPA, Customer may take reasonable steps to remediate the same, including, without limitation, by requiring the suspension of all Processing of Customer Personal Data until such time as Customer determines that the non-compliance has been remediated. In the event that Palantir determines that it can no longer meet its obligations pursuant to this DPA, Palantir shall promptly notify Customer of such determination.
9 DEALINGS WITH DATA PROTECTION AUTHORITIES AND DATA PROTECTION IMPACT ASSESSMENTS
9.1 Palantir shall reasonably cooperate, on reasonable request and at Customer’s cost, with any Data Protection Authority in the performance of its tasks, taking into account the nature of the Processing by, and information available to, Palantir.
9.2 Taking into account the nature of the Service and the information available to Palantir, Palantir will assist Customer in complying with Customer’s obligations in respect of data protection impact assessments (including a 'risk assessment', 'privacy impact assessment', 'data protection assessment' or any equivalent documentation) and prior consultation or mandatory submission to a Data Protection Authority where applicable under Data Protection Laws, by providing the Report, Accountability Information and Documentation.
10 ACCOUNTABILITY
To the extent required by Data Protection Laws, Palantir shall maintain electronic records of all categories of Processing activities carried out on behalf of Customer, containing:
(a) the name and contact details of the Processors and Subprocessors;
(b) details of the types of Processing being carried out;
(c) details of any transfers of Customer Personal Data to a territory or international organisation outside of the EEA or UK, and documentation of suitable safeguards (if applicable); and
(d) a general description of the technical and organisational security measures used in relation to the Processing,
together, the “Accountability Information”.
11 DATA SUBJECT RIGHTS
11.1 With regard to Customer Personal Data, where Palantir directly receives a Request from a Data Subject, or anyone authorized to act on their behalf, any claim or complaint in relation to their rights under the Data Protection Laws, and provided Palantir can reasonably identify from the information provided that the request, claim or complaint relates to Customer and Customer Personal Data, then unless prohibited by applicable law, Palantir shall forward the request, claim or complaint to Customer.
11.2 The Service provides Customer with controls, including security features and functionalities, that Customer may use to retrieve, correct, delete or restrict Customer Personal Data. Customer may use these controls as technical and organisational measures to comply with its obligations under Data Protection Laws, to respond to requests from Data Subjects.
12 DATA INCIDENT
12.1 Palantir shall notify Customer without undue delay after becoming aware of (or where required by applicable Data Protection Laws) having reasonable grounds to believe that there has been a Data Incident and provide Customer with any information required to be included under applicable Data Protection Laws. For avoidance of doubt, a Data Incident shall not include acts or omissions which do not breach Palantir’s security or the security of any Subprocessor; port scans, authorized penetration tests, and denial of service attacks; or any access to or Processing of Customer Personal Data that is consistent with Customer Instructions. Palantir’s notification of, or response to, a Data Incident in accordance with this Section 12.1. will not be construed as an acknowledgment by Palantir of any fault or liability with respect to the Data Incident.
12.2 Palantir shall provide Customer with reasonable cooperation and assistance in dealing with a Data Incident, in particular in relation to (a) taking commercially reasonable steps to resolve any data privacy or security issues involving any Customer Personal Data; and (b) providing Customer with necessary and requested assistance to enable Customer to make any appropriate notifications to individuals affected by the Data Incident or to a Supervisory Authority to the extent reasonably possible; provided that, Customer shall maintain and follow an effective cyber incident response policy, which shall include the use of legal professional, litigation, or client attorney privilege, work in good faith with Palantir in relation to the Data Incident, or, in the event that Customer acts as an individual or sole trader, provided that Customer shall maintain and follow effective and necessary incident responses and mitigation measures reasonably expected from any individual or sole trader and agree with Palantir the form and method of any public announcement in relation to the Data Incident.
12.3 Any information provided by Palantir pursuant to this Section 12 shall be the Confidential Information of Palantir and Palantir’s notification of or response to a Data Incident under this Section 12 will not be construed as an acknowledgement by Palantir or, if relevant, its Subprocessors of any fault or liability with respect to the performance of any Service or Professional Services (as applicable).
13 DATA TRANSFERS
13.1 Palantir may Process Personal Data in countries outside of the country in which Customer is established in which Palantir or its Subprocessors maintains facilities, employees or infrastructure.
13.2 Where the Processing of Customer Personal Data in the course of the provision of the Service involves a Restricted Transfer of Customer Personal Data by or on behalf of Customer, from a country which places restrictions on the transfer of Personal Data to countries not deemed to be an Adequate Country then:
(a) The Parties shall hereby enter into a set of SCCs. The applicable SCCs and any required Completions as applicable and set out in Exhibit D, shall hereby be deemed incorporated into this DPA, and apply between Customer (as Exporter) and Palantir (as importer);
(b) Palantir shall provide appropriate safeguards, meeting the requirements of the SCCs in respect of onward transfers, in relation to transfers of Personal Data between Palantir Affiliates for the purpose of performing Services; and
(c) Palantir shall ensure that any transfers of Customer Personal Data between Palantir and any Palantir third party Subprocessors, are subject to contractual terms between Palantir and the relevant third party Subprocessor providing appropriate safeguards and containing clauses equivalent to the SCCs.
13.3 Nothing in this DPA or the Agreement modifies any rights or obligations of Palantir or customer under the Standard Contractual Clauses.
14 LIABILITY
14.1 Subject to 14.2, the total combined liability of either Party and its Affiliates towards the other Party and its Affiliates under or in connection with the Agreement and the Standard Contractual Clauses combined will be the liability cap, and subject to the liability limitations, set forth in the Agreement for the relevant Party.
14.2 Nothing in this DPA serves to modify, disapply or amend the terms of the Agreement relating to liability, including but not limited to any exclusions and/or limitations of liability.
14.3 Customer shall ensure that all Customer Data it uploads in the course of the provision of the Service is accurate and complies with all applicable laws. Customer shall defend and indemnify Palantir for any and all damages, liabilities, penalties, fines and expenses (including from third parties) arising out of the Customer’s failure to comply with the present provision or any applicable laws in connection with Customer Data.
15 GOVERNING LAW AND JURISDICTION
15.1 The Parties shall modify the terms of this DPA as soon as possible if such modification is required for the parties to comply with any Data Protection Laws, or in order to implement or adhere to the Standard Contractual Clauses or such other permitted compliance mechanism under Data Protection Laws.
15.2 This DPA, and any dispute or claim (including any non-contractual disputes or claims) arising out of or in connection with it, or its subject matter or formation, shall be governed by and construed in accordance with the laws that govern the Agreement. If it is or becomes a requirement that, under the Data Protection Laws or other applicable laws, this DPA must be governed by (a) the laws of a member state of the European Union (and it is not already so governed), this DPA shall be governed by and construed in accordance with the laws of Ireland; (b) the laws of the United Kingdom, this DPA shall be governed by and construed in accordance with the laws of England and Wales, and/or (c) the laws of any other jurisdiction, then this DPA shall be governed by and construed in accordance with the laws of that jurisdiction, but only to the extent required to satisfy such laws.
15.3 The Parties irrevocably agree that the forum set out in the Agreement shall have exclusive jurisdiction to settle any dispute which may arise out of or in connection with this DPA and the documents to be entered into pursuant to it and that, accordingly, any proceedings arising out of or in connection with this DPA shall be brought in such forum save that where a mandatory requirement of Data Protection Law or other applicable laws requires that disputes arising out of or in connection with this DPA and any documents to be entered into pursuant to it are heard in (a) a member state of the European Union, then such disputes shall be heard in Ireland; (b) the United Kingdom, then such disputes shall be heard in England and Wales; and/or (c) any alternative forum, then such disputes shall be heard in that alternative forum, to the extent legally permitted. Each of the Parties irrevocably submits to the jurisdiction of such forum and waives any objection to proceedings in any such forum on the ground of venue or on the ground that proceedings have been brought in an inconvenient forum.
16 GENERAL TERMS
16.1 Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, whilst preserving the Parties’ intension as closely as possible, or, where not possible, (ii) construed in a manner as if the invalid off unenforceable part had never been contained therein.
16.2 Palantir may notify Customer in writing from time to time of any variations to this DPA, including relating to cross border transfers, which are required as a result of change in Data Protection Laws. Any such changes required shall take effect on the date falling 25 working days after the date such written notice is sent by Palantir to the Customer.
EXHIBIT A
List of approved Subprocessors
PART I - Subprocessors
To perform its obligations under the Palantir Terms of Service and Palantir Data Protection Agreement (or the alternative written agreement between Customer and Palantir, if applicable), Palantir Technologies Inc. and its Affiliates may use third party data processors (“Third-Party Subprocessors”) and Palantir Affiliates to process Customer Personal Data. Capitalized terms used but not defined here shall have the meanings provided in the Agreement.
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure, and AI services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
PART II – Palantir Affiliates
Provided that an adequate level of data protection consistent with the Data Protection Laws and this Agreement is ensured by Palantir, Customer specifically authorizes Palantir Affiliates as listed here and as updated from time to time to act as Palantir’s Subprocessor(s) including by Processing Customer Personal Data for the purposes of the Agreement for the delivery of Service and/or Professional Services to Customer. Where required, Palantir and its respective Affiliate have entered into the Standard Contractual Clauses. Such Processing, where applicable, shall occur under the control and direction of Palantir and shall occur on systems managed or otherwise controlled by Palantir.
EXHIBIT B
Subject Matter and Details of Customer Personal Data Processing
Palantir Privacy Contact
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Service (as applicable) or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users.
Subject Matter of Processing
Palantir’s provision of the Service and Professional Services and performance of its obligations under the Agreement.
Nature and Purpose of Processing
Palantir will Process Customer Personal Data in accordance with the terms of this DPA for the purpose of providing the Service and Professional Services to Customer, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT C – APOLLO SERVICES
The following capitalized term will have the meaning indicated below:
“Apollo Services” means the specific Service selected by Customer in the Order Form for end-to-end continuous deployment SaaS solution, enabling Users to centrally manage multiple versions of Palantir Technology across independent environments and as exclusively described in the present Exhibit C for Apollo Services, excluding the application of Exhibit A and Exhibit B of the present DPA;
EXHIBIT C-1
List of approved Subprocessors
PART I – Subprocessors
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of providing Apollo Services to Customer under the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
PART II – Palantir Affiliates
As described under "PART II – Palantir Affiliates" in Exhibit A.
EXHIBIT C-2
Subject Matter and Details of Customer Personal Data Processing
For the provision of Apollo Services, the following shall apply:
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Apollo Service or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing via the Apollo Service by or at the direction of Customer or Customer’s Users. Categories of Customer Personal Data include Users identification details: name, addresses, email addresses and IDs.
Subject Matter of Processing
Palantir’s provision of the Apollo Service under the Agreement.
Nature and Purpose of Processing
Palantir will Process the above detailed Customer Personal Data in accordance with the terms of this DPA for the purpose of setting up Apollo Users’ accounts, providing the Apollo Service to Customer including scanning managed environments for vulnerabilities, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT D
Additions to the Standard Contractual Clauses
The following capitalized term will have the meaning indicated below:
"UK Addendum" means the international data transfer addendum to the EU SCCs issued by the UK Information Commissioner under s. 119A of the Data Protection Act 2018, or such other addendum as may amend or replace the addendum from time to time.
“Completions” means
(i) in relation to the EU SCCs in relation to exports from the EEA:
a) the optional wording at Clauses 7 and 11 is deleted;
b) in Clause 8.9 of such SCCs, the following paragraph is added after subsection (d):
“(e) Notwithstanding the above, any audit will be limited in scope and parameter to the systems processing the relevant personal data.
Where audits include inspections, they shall be carried out with reasonable prior notice. The parties will mutually agree upon the scope, timing, duration, control and evidence requirements of the audit, provided that this requirement to agree will not permit the data importer to unreasonably delay performance of the audit.
Any audit made pursuant to this Clause (i) shall be at the expense of the requesting data exporter, and such expenses shall include any reasonable related costs of the data importer, including compensation for the hours worked by the data importer’s staff; (ii) may, if the data exporter seeks to retain an independent auditor, only be done by a party approved in advance by the data importer, which approval cannot be unreasonably withheld; and (iii) shall be subject to a non-disclosure agreement.”
c) in Clause 9, Option 1 is deleted and the time period shall be not less than 30 days;
d) the applicable wording for Clause 13(a) of the EU SCCs (as determined by the instructions in square brackets in such SCCs) is retained and the two remaining alternatives are deleted;
e) in Clause 17 of the EU SCCs, Option 2 is deleted and Option 1 is completed with details of the laws of Ireland and in Clause 18(b) of the EU SCCs is completed with details of the courts of Ireland;
f) the parties set out in Annex 1 shall be completed with the names of the Customer as exporter and Palantir as importer, the transfers shall be as described in Exhibit B and any other relevant exhibits for applicable additional Services under this DPA and the supervisory authority shall be the Irish supervisory authority; in Annex II the list of technical and organisational measures shall be the Technical and Organisational Measures and in Annex III the list of sub-processors shall be those set out in Exhibit A; and
g) in the event that the EU SCCs are replaced from those in force at the Effective Date, such completions shall be made to the revised SCCs as most closely replicate those set out above.
(ii) in relation to the EU SCCs in relation to exports from other jurisdictions besides the EEA the completions set out in (i)(a)-(g) above shall apply save that:
a) in Clause 17 of such EU SCC, the second sentence is replaced with the following: “The Parties agree that this shall be English law” save where another governing law of the EU SCCs is required as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 17 shall be completed with details of the law which that Data Protection Law requires must be applied to such EU SCCs;
b) Clause 18(b) is replaced with the following “18(b) The Parties agree that those shall be the courts of England & Wales” save where another country, state or territory must have jurisdiction over the EU SCCs as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 18(b) of such EU SCCs shall be completed with details of the country, state or territory which that Data Protection Law requires must have jurisdiction over the EU SCCs;
c) references in the EU SCC to “a third party located outside the European Union” are replaced by references to “a third party located outside the country or territory in which the data exporter is established”;
d) references in such EU SCC to “the Member State” are replaced by references to “the country or territory in which the data exporter is established”;
e) all references to the GDPR in such EU SCC are replaced by references to Data Protection Law of the relevant country and references to provisions or concepts of the GDPR are replaced by references to the provisions or concepts of such Data Protection Law most closely related to the relevant term as understood in the GDPR;
f) all references to Member States of the European Union or to the European Union are replaced by references to the country of establishment of the exporter;
g) save where required as mandatory requirement of the relevant Data Protection Law, all references in the EU SCC to (a) data subject rights or other third party beneficiary rights or (b) to obligations or liability towards data subjects or other third parties shall be deleted and ignored; and
h) to the extent that any of references to the EU SCCs referred to above under (i) to (viii) are replaced in any amended provisions or replacement or subsequently approved clauses or instrument after the Effective Date, the amendments provided above under (ii)(a)-(h) shall be adapted and/or completed if and to the extent appropriate to reflect the effect of the former as close as possible
(iii) in relation to SCCs in relation to exports from the UK the EU SCCs shall apply as amended by either (i) the Information Commissioner’s “UK Addendum to the EU Commission Standard Contractual Clauses” found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdfhttps://ico.org.uk/media/about-the-ico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf or (ii) such replacement addendum to the EU Standard Contractual Clauses as the Information Commissioner might issue from time to time (these addenda known as the “UK SCC”), with the following items completed (or in the case of (ii) those items as most closely approximate the following items):
a) to the extent not covered by the foregoing, the completions set out in (i)(a)-(g) above shall apply save that:
b) Table 1 shall be completed with the names of the Customer as exporter and Palantir as importer;
c) in Table 2 the module of the EU SCCs selected shall be determined in accordance with the definition of SCCs set out below;
d) in Table 4 the “neither party” option shall be selected,
(iv) in relation to SCCs in relation to exports from Switzerland, the EU SCCs shall apply (incorporating the completions set out at (i)(a)-(g) above), as amended by either (a) the FDPIC’ decision guidance of 27 August 2021 found at https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222 setting out amendments to be made to the EU SCCs in respect of transfers subject to the Swiss FADP or (b) such replacement decision of the FDPIC relating to amendments to be made to the EU SCCs from time to time (these amendments known as the “Swiss SCCs”);
(v) in relation to SCCs in relation to exports from any other country, the completions set out in (i)(a)-(g) above shall be made or such other Completions as most closely achieves the same outcome as those Completions.
In respect of any transfers of Personal Data that may occur in the course of the provision of the Service, Module 2 (Controller to Processor) terms, as provided below in Annex 1 to Exhibit D, shall apply to the extent Customer is a Controller of Customer Personal Data. The Module 3 (Processor to Processor) terms, as provided below in Annex 2 to Exhibit D, shall apply to the extent Customer is a Processor (or subprocessor) of Customer Personal Data. For both Module 2 and Module 3 of the Standard Contractual Clauses, the election of specific terms and/or addition of required information shall apply as follows:
(a) The applicable wording for Clause 13(a) of the Standard Contractual Clauses (as determined by the instructions in square brackets in the Standard Contractual Clauses) is retained and the two remaining alternatives are deleted;
(b) details of Subprocessors the data importer intends to engage as set out in Exhibit A and/or any other relevant exhibits for applicable additional Services, respectively, to this Agreement are the “agreed list” of Subprocessors referread to in Clause 9(a) of the Standard Contractual Clauses.
ANNEX 1 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 2: Controller to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([1]) for the transfer of data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b)The data importer shall immediately inform the data exporter if it is unable to follow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([2]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([3]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([4]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii) the data importer is in substantial or persistent breach of these Clauses; or
(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of Ireland.
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Controller
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in clause 4.3(c) of the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.
The controls available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation.
ANNEX 2 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 3: Processor to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([5]) for the transfer of personal data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[Intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter ([1]).
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([6]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.
(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([7]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([8]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). The data exporter shall forward the notification to the controller.
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation, if appropriate in consultation with the controller. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the controller or the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
The data exporter shall forward the notification to the controller.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). The data exporter shall forward the information to the controller.
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimization
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. The data exporter shall make the assessment available to the controller.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a)The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b)In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c)The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i)the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii)the data importer is in substantial or persistent breach of these Clauses; or
(iii)the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority and the controller of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d)Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e)Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a)Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b)The Parties agree that those shall be the courts of Ireland.
(c)A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
(d)The Parties agree to submit themselves to the jurisdiction of such courts.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Processor
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case, Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
The controls available to Customer described in the DPA, as further documented in the Security Documentation.
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
Effective May 1st 2024 to May 1st 2024
DownloadTable of Contents
BY SELECTING “I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE, OR BY INSTALLING, EXECUTING, DOWNLOADING, ACCESSING OR OTHERWISE USING ANY PORTION OF THE PALANTIR TECHNOLOGY (AS DEFINED IN THE AGREEMENT), YOU CONFIRM THAT YOU (“YOU” OR “YOUR” OR “PERMITTED USER”) HAVE READ THIS DPA, THAT YOU UNDERSTAND THE TERMS OF THIS DPA, AND THAT YOU, IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, OR YOU AND THE ENTITY THAT YOU REPRESENT ARE UNCONDITIONALLY CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS DPA. IF YOU ARE ENTERING INTO THESE TERMS IN YOUR CAPACITY AS AN INDIVIDUAL OR SOLE TRADER, YOU ALSO REPRESENT AND WARRANT THAT YOU ARE NOT USING THE PALANTIR TECHNOLOGY ON BEHALF OF OR UNDER THE INSTRUCTIONS OF ANY OTHER THIRD PARTY OR LEGAL ENTITY. IF YOU ARE ENTERING INTO THIS DPA ON BEHALF OF AN ENTITY, SUCH AS THE COMPANY, ORGANIZATION, OR EDUCATIONAL INSTITUTION FOR WHICH YOU WORK, YOU REPRESENT AND WARRANT THAT YOU ARE AUTHORIZED TO ACCEPT THE TERMS OF THIS DPA ON BEHALF OF THE ENTITY AS ITS AUTHORIZED LEGAL REPRESENTATIVE. IF YOU DO NOT UNCONDITIONALLY AGREE TO ALL OF THE TERMS OF THIS DPA, DO NOT SELECT "I AGREE” (OR EQUIVALENT) WHERE SUCH OPTION IS MADE AVAILABLE AND DO NOT INSTALL, EXECUTE, DOWNLOAD, ACCESS, OR OTHERWISE USE ANY PORTION OF THE PALANTIR TECHNOLOGY.
PALANTIR’S ACCEPTANCE IS EXPRESSLY CONDITIONED UPON YOUR ASSENT TO ALL THE TERMS AND CONDITIONS OF THIS DPA, TO THE EXCLUSION OF ALL OTHER TERMS; IF THESE TERMS ARE CONSIDERED AN OFFER, ACCEPTANCE IS EXPRESSLY LIMITED TO THESE TERMS.
The customer agreeing to the terms of this DPA (“Customer”) and the Palantir Technologies entity that is the signatory to the Agreement (“Palantir”; each of Customer and Palantir a “Party” and collectively the “Parties”), have entered into an agreement (such as the Palantir Terms of Service and Order Form) governing Customer’s use of Palantir Technology, including the Service, and the provision of related Professional Services to Customer by Palantir, including any attachments, order forms, exhibits, and appendices thereto (collectively, the “Agreement”). This DPA supplements, is incorporated into, and forms part of the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer under the Agreement. Any capitalized terms used but not defined in this DPA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the terms and conditions in this DPA shall prevail and control.
1 DEFINITIONS
1.1 The following capitalized terms will have the meanings indicated below:
- “Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
- “Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity. In respect of Palantir, Affiliate shall include, without being limited to, all entities listed in Exhibit A, Part II and any other Palantir affiliates from time to time;
- “Completions” has the meaning given to it in Exhibit D of this DPA;
- “Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
- “Customer Personal Data” means any Personal Data contained within Customer Data that is subject to Data Protection Laws;
- “Data Incident” means any breach, as defined by applicable Data Protection Laws, of Palantir’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Palantir;
- “Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
- “Data Protection Laws” means all applicable laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Palantir under the Agreement, such as:
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
- California Privacy Rights Act of 2020 (“CPRA”);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
- The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
- The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
- “Data Protection Officer” means the natural person or company appointed where necessary under applicable Data Protection Laws to ensure an organization's compliance with Data Protection Laws and cooperate with the Data Protection Authorities;
- “Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
- “DPA Effective Date” means the Effective Date of the Agreement;
- “EEA” means the European Economic Area;
- “EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
- “Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
- “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
- “Processor” means the entity which Processes Personal Data on behalf of a Controller, including as applicable the terms “processor”, “service provider” “contractor” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws as applicable;
- “Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
- “Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
- “Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Palantir from time to time;
- “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
- “Service” shall have the meaning as set out in the Agreement and this DPA.
- “Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
- “Subprocessor” means any processor or service provider who processes personal data on behalf of Palantir for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
- “Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimise exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
- “Technical and Organisational Measures” means the technical and organisational measures agreed by the Parties in the Agreement and any additional technical and organisational measures implemented by Palantir pursuant to its obligations under applicable Data Protection Laws.
2 TERM
2.1 This DPA will take effect from the DPA Effective Date and remain in effect until the destruction or return of all Customer Personal Data by Palantir in accordance with the Agreement, at which point it will automatically terminate.
3 SCOPE AND APPLICATION
3.1 This DPA is incorporated into, and forms part of, the Agreement and establishes the rights and obligations of Palantir and Customer with respect to any Customer Personal Data Processed by Palantir on behalf of Customer when in the course of the provision of the Service. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the provisions in this DPA shall prevail and control.
4 ROLE OF THE PARTIES
4.1 Customer and any relevant Customer Affiliate, hereby appoints and instructs Palantir as a Processor, or Subprocessor as applicable, of the Customer Personal Data. Accordingly, the Parties shall comply with applicable Data Protection Laws as relevant to their respective Processing of Customer Personal Data under the Agreement.
4.2 As between the Parties, Customer shall be liable and responsible as the Controller (or Processor, if Customer is Processing Personal Data with the Service for a third-party Controller) and Palantir shall be liable and responsible as the Processor (or Subprocessor), in respect of Customer Personal Data processed under the Agreement.
4.3 In the event that Customer acts as a Processor (or Subprocessor) in respect of Customer Personal Data, Customer represents and warrants to Palantir that it is validly authorized by the relevant Controller to enter into the Agreement and this DPA and to provide Customer Instructions (as defined below) on behalf of Controller in relation to Customer Personal Data.
4.4 In the event that Customer is an employee of Palantir or a Palantir Affiliate, Customer acknowledges that it is not acting on behalf of Palantir or any Palantir Affiliate and is acting as a separate and independent Controller in relation to the Processing of Customer Personal Data via the Palantir Technology.
4.5 In the event that Customer jointly controls Customer Personal Data with a third-party Controller, Customer represents and warrants that its Processing of Customer Personal Data in connection with its use of the Palantir Technology is duly authorised by such third-party Controller and is carried out in compliance with applicable Data Protection Laws.
4.6 In the event that Customer introduces any new User to the Palantir Technology (whether such User is acting on his/her own behalf or on behalf of a third party), Customer shall procure that any such User enters into a separate arrangement directly with Palantir in relation to such use (including any applicable Palantir Terms of Service and any related DPA) and acknowledges that any such User's use of the Palantir Technology shall be conditional on their doing so.
4.7 The subject matter and details of Processing are described in the Agreement and this DPA, including Exhibit B (subject matter and details of Customer Personal Data processing) and any other relevant exhibits for applicable additional Services.
4.8 Palantir shall process Prompts and Outputs as Usage Data, as further described in the Agreement and AIP Now Privacy Policy, to secure the Service, including monitoring for abuse or malicious User activity.
5 CUSTOMER PROCESSING OF PERSONAL DATA
5.1 Customer shall ensure that any Processing of Customer Personal Data via Customer’s use of the Service, including any instructions provided to Palantir in relation to such Processing, shall comply with all applicable Data Protection Laws.
5.2 Customer instructs Palantir to Process Customer Personal Data: (a) to provide the Service specified in the Agreement and Documentation or otherwise perform its obligations thereunder; (b) as further initiated by Customer via Customer’s or Users use of the Service in accordance with the Agreement and Documentation; and/or (c) in accordance with any additional instruction outside the scope of the Agreement or this DPA, as further documented in any other written instructions given by Customer and acknowledged by Palantir in writing as constituting instructions for purposes of this DPA (collectively, “Customer Instructions”). Customer acknowledges that any additional Customer Instructions issued under (c) above may result in additional charges or fees to the Customer by Palantir, which shall be payable in accordance with the terms of the Agreement.
5.3 Customer shall have sole responsibility for the lawful Processing of Customer Personal Data in connection with its use of the Palantir Technology and/or its receipt of any related Professional Services in accordance with applicable Data Protection Laws, including without limitation, the accuracy, quality, and legality of the Customer Personal Data, the means by which it acquires and uses Customer Personal Data, and the Customer Instructions regarding the Processing of Customer Personal Data. Customer represents and warrants that it has (or its Controller has) a valid legal basis for the Processing of Customer Personal Data and has (or its Controller has) provided (or procured the provision of) all notifications and obtained (or procured the provision of) all consents (including Consents), authorisations, approvals, and/or agreements (including, where Customer is a Processor or Subprocessor, with and from the applicable Controller(s)) required under applicable laws or policies in order to enable Palantir to receive and Process Customer Personal Data in accordance with this DPA, the Agreement and Customer Instructions.
5.4 The Customer shall be responsible for providing guidance to Users regarding the use of the Services and in particular the use of Personal Data within the Services.
5.5 The Customer Personal Data shall not include any:
5.5.1 government related identifiers (where that term is defined under applicable Data Protection Laws) to the extent that the Processing of such government related identifiers are not permitted under applicable Data Protection Laws;
5.5.2 Personal Data relating to children (in accordance with the relevant age of majority in applicable jurisdictions), unless permitted under, or in compliance with applicable Data Protection Laws; or
5.5.3 Personal Data which is under the Control of another Controller, without their express authorisation.
6 PALANTIR PROCESSING OF CUSTOMER PERSONAL DATA
6.1 Palantir will Process Customer Personal Data for the business purposes of providing to Customer the services, namely the Palantir Technology and Professional Services pursuant to the Customer Instructions and any other purpose for which the Customer provides authorization via the Service, where such option is made available ("Business Purposes"), in accordance with the terms of the Agreement and this DPA as well as any requirements set out by applicable Data Protection Laws. For the avoidance of doubt, Customer is disclosing Customer Personal Data to Palantir only for the limited and specified Business Purposes set forth within the Agreement and the Customer Instructions. Palantir shall process Customer personal Data pursuant to Customer’s instructions and shall:
(a) designate and maintain a Data Protection Officer as required by Data Protection Laws, which can be contacted at privacy@palantir.com;
(b) not Sell or Share Customer Personal Data or otherwise retain, use, disclose, or Process Customer Personal Data outside of the direct business relationship between the Parties or for any purpose other than for the fulfilment of the Business Purposes pursuant to Customer Instructions, unless obligated to do otherwise by applicable law or regulation or requests or orders of judicial, governmental or regulatory entities (including without limitation subpoenas), in which case Palantir will inform Customer of that legal requirement before such Processing occurs unless legally prohibited from doing so;
(c) not combine Customer Personal Data with Personal Data that it receives from other sources or collects from its own interactions with a Data Subject, provided, that Palantir may combine Customer Personal Data as necessary to perform its Business Purposes and will not Sell or Share Customer Personal Data;
(d) implement appropriate Technical and Organisational Measures to protect the confidentiality, integrity, availability and resilience of Palantir’s systems Processing Customer Personal Data. Palantir may update the Technical and Organisational Measures from time to time provided that any such updates are no less protective than the original Technical and Organisational Measures. To the extent such assistance requires Palantir to take additional steps beyond those imposed on Palantir by Data Protection Laws or specifically required pursuant to the Agreement; or to the extent the relevant technical and organizational measures are required as a result of an act or omission by Customer or a Party acting on behalf of Customer in breach of this Agreement or Data Protection Laws, then Palantir’s obligation to provide such assistance shall be subject to Customer’s payment of Palantir’s reasonable fees in respect of such additional assistance; Palantir’s security obligations under this DPA apply without prejudice to the Customer’s own security obligations under applicable Data Protection Laws;
(e) ensure that all persons authorized by Palantir to Process Customer Personal Data, including any Subprocessors (as defined below), are bound by confidentiality obligations consistent with those set out in this DPA, the Agreement or otherwise sufficient to meet the requirements of Data Protection Laws;
(f) take reasonable steps to return or destroy Customer Personal Data, when it is no longer necessary for the purposes of performing the relevant Services upon termination of the Agreement, unless storage is otherwise required under applicable Data Protection Laws; and
(g) process Customer Personal Data in a manner that is consistent with the same level of privacy protection that is required of Customer under applicable Data Protection Laws.
6.2 Customer shall instruct Palantir as to the subject-matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and the categories of Data Subjects taking into account the specific tasks and responsibilities of the Processor in the context of the Processing to be carried out and the risk to the rights and freedoms of the Data Subject as part of Customer Instructions. Notwithstanding anything to the contrary herein, Customer shall ensure that its acts or omissions, including in relation to any Customer Instructions to Palantir, do not put Palantir in breach of the Data Protection Laws.
6.3 Customer has assessed the level of security appropriate to the Processing in the context of its obligations under Data Protection Laws and agrees that the Technical and Organisational Measures are consistent with such assessment. Customer further acknowledges that Palantir is not able to assess, and does not have knowledge of, the specific Personal Data provided by Customer to Palantir or made available by Customer to Palantir in relation to the Services and that as a result the technical and organisational Measures proposed by Palantir are generic in nature and Palantir is unable to assess whether or not they reflect any particular risks posed by the Personal Data.
7 SUBPROCESSORS
7.1 Customer specifically authorizes the engagement as Subprocessors of (a) the entities listed in Exhibit A and/or applicable specific additional Services exhibits in this DPA and (b) all Palantir Affiliates from time to time, provided that, prior to permitting such Subprocessors to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.2 Subject to Section 7.3, Customer generally authorizes Palantir to engage additional Subprocessors (“Additional Subprocessors”), provided that, prior to permitting such Additional Subprocessor to Process any Customer Personal Data, Palantir shall enter into a written agreement with the Additional Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.3 At least 30 days before Palantir initiating the use of an Additional Subprocessor in connection with the provision of Services to Customer, the updated list of Subprocessors for the Service shall be available in Exhibit A, also accessible here [link], and Palantir shall provide Customer with a mechanism to obtain notice of that update. The Parties agree this notification satisfies the notification requirements of Section 28.2 of the GDPR and Clause 9 of the SCC. Where Customer indicates in writing that it objects to the Processing of Customer Personal Data by such Additional Subprocessor, the Parties shall seek to resolve the Customer concerns and where necessary the Customer may exercise its applicable rights to terminate the Agreement.
7.4 To the extent required by Data Protection Law, Palantir shall remain liable to Customer for the performance of the Subprocessor’s obligations in relation to this Section 7 (“Subprocessor Data Protection Liability”), and Palantir shall be permitted to re-perform or to procure the re-performance of any such obligations and Customer acknowledges that such re-performance shall diminish any claim that Customer has against Palantir in respect of any Subprocessor Data Protection Liability.
8 AUDIT
8.1 Palantir uses third party auditors to verify the adequacy of its security measures. This audit is performed at least annually, by independent and reputable third-party auditors at Palantir’s selection and expense, and in accordance with Service Organization Controls 2 (SOC2) or substantially equivalent industry standards, and results in the generation of an audit report (“Report”) which will be the Confidential Information of Palantir. The Service and operations are also certified compliant with the standards and accreditations set out on the “compliance and accreditation” tab at: https://www.palantir.com/information-security/ (“Accreditations”).
8.2 At Customer’s written request, Palantir will provide Customer with a confidential summary of the Report, documentation evidencing compliance with the Accreditations, and the Accountability Information outlined in Section 10 of this DPA so that Customer can reasonably verify Palantir’s compliance with the data security and data protection obligations under this DPA. Subject to Section 8.3, if Data Protection Laws, Standard Contractual Clauses, or the Agreement require Palantir to provide Customer with access to Palantir facilities or information in addition to the Report and the Accountability Information, then Palantir shall permit Customer to audit Palantir’s compliance with the terms and conditions of this DPA as it applies to Customer Personal Data to the extent expressly required by the Agreement, the Standard Contractual Clauses, or Data Protection Laws.
8.3 In order to request an audit of Palantir’s facilities under this Section 8 (and where such an audit is authorized under Section 8.2), Customer shall notify Palantir and the Parties shall agree, as soon as reasonably possible but always in advance, the reasonable dates, duration and scope of the audit, the identity and qualifications of the auditor, and any security and confidentiality controls required for access to the information or Processes in scope of such audit. Palantir may decline the request or decline to follow any instruction requested by Customer regarding audits. To the extent Palantir declines an audit request and such audit is unambiguously required under applicable Data Protection Laws or the DPA, Customer is entitled to terminate the Agreement in accordance with the Agreement. The Customer shall bear the reasonable costs of Palantir in fulfilling any requirements under this Section. The scope of any audit under this Section 8 shall be limited to Palantir systems and facilities used to Process Customer Personal Data and Documentation directly related to such Processing.
8.4 All information provided or made available to Customer, its auditor or any other third party authorized under the present DPA to have access to the above information pursuant to this Section 8 shall be Confidential Information of Palantir.
8.5 In the event of any confirmed material non-compliance by Palantir with the terms of this DPA, Customer may take reasonable steps to remediate the same, including, without limitation, by requiring the suspension of all Processing of Customer Personal Data until such time as Customer determines that the non-compliance has been remediated. In the event that Palantir determines that it can no longer meet its obligations pursuant to this DPA, Palantir shall promptly notify Customer of such determination.
9 DEALINGS WITH DATA PROTECTION AUTHORITIES AND DATA PROTECTION IMPACT ASSESSMENTS
9.1 Palantir shall reasonably cooperate, on reasonable request and at Customer’s cost, with any Data Protection Authority in the performance of its tasks, taking into account the nature of the Processing by, and information available to, Palantir.
9.2 Taking into account the nature of the Service and the information available to Palantir, Palantir will assist Customer in complying with Customer’s obligations in respect of data protection impact assessments (including a 'risk assessment', 'privacy impact assessment', 'data protection assessment' or any equivalent documentation) and prior consultation or mandatory submission to a Data Protection Authority where applicable under Data Protection Laws, by providing the Report, Accountability Information and Documentation.
10 ACCOUNTABILITY
To the extent required by Data Protection Laws, Palantir shall maintain electronic records of all categories of Processing activities carried out on behalf of Customer, containing:
(a) the name and contact details of the Processors and Subprocessors;
(b) details of the types of Processing being carried out;
(c) details of any transfers of Customer Personal Data to a territory or international organisation outside of the EEA or UK, and documentation of suitable safeguards (if applicable); and
(d) a general description of the technical and organisational security measures used in relation to the Processing,
together, the “Accountability Information”.
11 DATA SUBJECT RIGHTS
11.1 With regard to Customer Personal Data, where Palantir directly receives a Request from a Data Subject, or anyone authorized to act on their behalf, any claim or complaint in relation to their rights under the Data Protection Laws, and provided Palantir can reasonably identify from the information provided that the request, claim or complaint relates to Customer and Customer Personal Data, then unless prohibited by applicable law, Palantir shall forward the request, claim or complaint to Customer.
11.2 The Service provides Customer with controls, including security features and functionalities, that Customer may use to retrieve, correct, delete or restrict Customer Personal Data. Customer may use these controls as technical and organisational measures to comply with its obligations under Data Protection Laws, to respond to requests from Data Subjects.
12 DATA INCIDENT
12.1 Palantir shall notify Customer without undue delay after becoming aware of (or where required by applicable Data Protection Laws) having reasonable grounds to believe that there has been a Data Incident and provide Customer with any information required to be included under applicable Data Protection Laws. For avoidance of doubt, a Data Incident shall not include acts or omissions which do not breach Palantir’s security or the security of any Subprocessor; port scans, authorized penetration tests, and denial of service attacks; or any access to or Processing of Customer Personal Data that is consistent with Customer Instructions. Palantir’s notification of, or response to, a Data Incident in accordance with this Section 12.1. will not be construed as an acknowledgment by Palantir of any fault or liability with respect to the Data Incident.
12.2 Palantir shall provide Customer with reasonable cooperation and assistance in dealing with a Data Incident, in particular in relation to (a) taking commercially reasonable steps to resolve any data privacy or security issues involving any Customer Personal Data; and (b) providing Customer with necessary and requested assistance to enable Customer to make any appropriate notifications to individuals affected by the Data Incident or to a Supervisory Authority to the extent reasonably possible; provided that, Customer shall maintain and follow an effective cyber incident response policy, which shall include the use of legal professional, litigation, or client attorney privilege, work in good faith with Palantir in relation to the Data Incident, or, in the event that Customer acts as an individual or sole trader, provided that Customer shall maintain and follow effective and necessary incident responses and mitigation measures reasonably expected from any individual or sole trader and agree with Palantir the form and method of any public announcement in relation to the Data Incident.
12.3 Any information provided by Palantir pursuant to this Section 12 shall be the Confidential Information of Palantir and Palantir’s notification of or response to a Data Incident under this Section 12 will not be construed as an acknowledgement by Palantir or, if relevant, its Subprocessors of any fault or liability with respect to the performance of any Service or Professional Services (as applicable).
13 DATA TRANSFERS
13.1 Palantir may Process Personal Data in countries outside of the country in which Customer is established in which Palantir or its Subprocessors maintains facilities, employees or infrastructure.
13.2 Where the Processing of Customer Personal Data in the course of the provision of the Service involves a Restricted Transfer of Customer Personal Data by or on behalf of Customer, from a country which places restrictions on the transfer of Personal Data to countries not deemed to be an Adequate Country then:
(a) The Parties shall hereby enter into a set of SCCs. The applicable SCCs and any required Completions as applicable and set out in Exhibit D, shall hereby be deemed incorporated into this DPA, and apply between Customer (as Exporter) and Palantir (as importer);
(b) Palantir shall provide appropriate safeguards, meeting the requirements of the SCCs in respect of onward transfers, in relation to transfers of Personal Data between Palantir Affiliates for the purpose of performing Services; and
(c) Palantir shall ensure that any transfers of Customer Personal Data between Palantir and any Palantir third party Subprocessors, are subject to contractual terms between Palantir and the relevant third party Subprocessor providing appropriate safeguards and containing clauses equivalent to the SCCs.
13.3 Nothing in this DPA or the Agreement modifies any rights or obligations of Palantir or customer under the Standard Contractual Clauses.
14 LIABILITY
14.1 Subject to 14.2, the total combined liability of either Party and its Affiliates towards the other Party and its Affiliates under or in connection with the Agreement and the Standard Contractual Clauses combined will be the liability cap, and subject to the liability limitations, set forth in the Agreement for the relevant Party.
14.2 Nothing in this DPA serves to modify, disapply or amend the terms of the Agreement relating to liability, including but not limited to any exclusions and/or limitations of liability.
14.3 Customer shall ensure that all Customer Data it uploads in the course of the provision of the Service is accurate and complies with all applicable laws. Customer shall defend and indemnify Palantir for any and all damages, liabilities, penalties, fines and expenses (including from third parties) arising out of the Customer’s failure to comply with the present provision or any applicable laws in connection with Customer Data.
15 GOVERNING LAW AND JURISDICTION
15.1 The Parties shall modify the terms of this DPA as soon as possible if such modification is required for the parties to comply with any Data Protection Laws, or in order to implement or adhere to the Standard Contractual Clauses or such other permitted compliance mechanism under Data Protection Laws.
15.2 This DPA, and any dispute or claim (including any non-contractual disputes or claims) arising out of or in connection with it, or its subject matter or formation, shall be governed by and construed in accordance with the laws that govern the Agreement. If it is or becomes a requirement that, under the Data Protection Laws or other applicable laws, this DPA must be governed by (a) the laws of a member state of the European Union (and it is not already so governed), this DPA shall be governed by and construed in accordance with the laws of Ireland; (b) the laws of the United Kingdom, this DPA shall be governed by and construed in accordance with the laws of England and Wales, and/or (c) the laws of any other jurisdiction, then this DPA shall be governed by and construed in accordance with the laws of that jurisdiction, but only to the extent required to satisfy such laws.
15.3 The Parties irrevocably agree that the forum set out in the Agreement shall have exclusive jurisdiction to settle any dispute which may arise out of or in connection with this DPA and the documents to be entered into pursuant to it and that, accordingly, any proceedings arising out of or in connection with this DPA shall be brought in such forum save that where a mandatory requirement of Data Protection Law or other applicable laws requires that disputes arising out of or in connection with this DPA and any documents to be entered into pursuant to it are heard in (a) a member state of the European Union, then such disputes shall be heard in Ireland; (b) the United Kingdom, then such disputes shall be heard in England and Wales; and/or (c) any alternative forum, then such disputes shall be heard in that alternative forum, to the extent legally permitted. Each of the Parties irrevocably submits to the jurisdiction of such forum and waives any objection to proceedings in any such forum on the ground of venue or on the ground that proceedings have been brought in an inconvenient forum.
16 GENERAL TERMS
16.1 Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, whilst preserving the Parties’ intension as closely as possible, or, where not possible, (ii) construed in a manner as if the invalid off unenforceable part had never been contained therein.
16.2 Palantir may notify Customer in writing from time to time of any variations to this DPA, including relating to cross border transfers, which are required as a result of change in Data Protection Laws. Any such changes required shall take effect on the date falling 25 working days after the date such written notice is sent by Palantir to the Customer.
EXHIBIT A
List of approved Subprocessors
PART I - Subprocessors
To perform its obligations under the Palantir Terms of Service and Palantir Data Protection Agreement (or the alternative written agreement between Customer and Palantir, if applicable), Palantir Technologies Inc. and its Affiliates may use third party data processors (“Third-Party Subprocessors”) and Palantir Affiliates to process Customer Personal Data. Capitalized terms used but not defined here shall have the meanings provided in the Agreement.
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services and AI services. | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | Cloud hosting and infrastructure, and AI services (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services is East US, South Central US, West Europe and other Azure regions as they become available. | Standard Contractual Clauses |
Google LLC | Cloud hosting and infrastructure (Google Cloud Platform) and AI services. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | The location for the purpose of providing the cloud hosting service is as selected by Customer in the Order Form or, as applicable, other parts of the Agreement. The location for the purpose of providing the AI services are all regions available for features of Generative AI on Google Vertex AI and other regions as they become available. | Standard Contractual Clauses |
Proofpoint, Inc. | Alerting and encrypted notification service. | 892 Ross Drive, Sunnyvale, CA 94089, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement. | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
OpenAI LLC | AI services | 3180 18th Street, San Francisco, CA 94110, USA | The location for the purpose of providing the AI service can be the United States and other regions as they become available. | Standard Contractual Clauses |
PART II – Palantir Affiliates
Provided that an adequate level of data protection consistent with the Data Protection Laws and this Agreement is ensured by Palantir, Customer specifically authorizes Palantir Affiliates as listed here and as updated from time to time to act as Palantir’s Subprocessor(s) including by Processing Customer Personal Data for the purposes of the Agreement for the delivery of Service and/or Professional Services to Customer. Where required, Palantir and its respective Affiliate have entered into the Standard Contractual Clauses. Such Processing, where applicable, shall occur under the control and direction of Palantir and shall occur on systems managed or otherwise controlled by Palantir.
EXHIBIT B
Subject Matter and Details of Customer Personal Data Processing
Palantir Privacy Contact
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Service (as applicable) or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users.
Subject Matter of Processing
Palantir’s provision of the Service and Professional Services and performance of its obligations under the Agreement.
Nature and Purpose of Processing
Palantir will Process Customer Personal Data in accordance with the terms of this DPA for the purpose of providing the Service and Professional Services to Customer, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT C – APOLLO SERVICES
The following capitalized term will have the meaning indicated below:
“Apollo Services” means the specific Service selected by Customer in the Order Form for end-to-end continuous deployment SaaS solution, enabling Users to centrally manage multiple versions of Palantir Technology across independent environments and as exclusively described in the present Exhibit C for Apollo Services, excluding the application of Exhibit A and Exhibit B of the present DPA;
EXHIBIT C-1
List of approved Subprocessors
PART I – Subprocessors
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of providing Apollo Services to Customer under the Agreement.
Authorized Third-Party Subprocessors | ||||
Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
Amazon Web Services, Inc. | Cloud hosting and infrastructure, alerting and encrypted notification services | 410 Terry Avenue North, Seattle, WA 98109, USA | As selected by Customer in the Order Form or, as applicable, other parts of the Agreement | Standard Contractual Clauses |
Microsoft Corporation | User authentication as an identity provider (where selected as chosen identity provider by Customer). | One Microsoft Way Redmond, WA 98052, USA | United States | Standard Contractual Clauses |
PART II – Palantir Affiliates
As described under "PART II – Palantir Affiliates" in Exhibit A.
EXHIBIT C-2
Subject Matter and Details of Customer Personal Data Processing
For the provision of Apollo Services, the following shall apply:
Categories of Data Subject Whose Personal Data May be Subject to Processing
Data Subjects include the individuals about whom Personal Data is provided to Palantir via the Apollo Service or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data
Customer Personal Data provided to Palantir for Processing via the Apollo Service by or at the direction of Customer or Customer’s Users. Categories of Customer Personal Data include Users identification details: name, addresses, email addresses and IDs.
Subject Matter of Processing
Palantir’s provision of the Apollo Service under the Agreement.
Nature and Purpose of Processing
Palantir will Process the above detailed Customer Personal Data in accordance with the terms of this DPA for the purpose of setting up Apollo Users’ accounts, providing the Apollo Service to Customer including scanning managed environments for vulnerabilities, or as otherwise compelled by applicable law.
Duration of Processing
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Palantir in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT D
Additions to the Standard Contractual Clauses
The following capitalized term will have the meaning indicated below:
"UK Addendum" means the international data transfer addendum to the EU SCCs issued by the UK Information Commissioner under s. 119A of the Data Protection Act 2018, or such other addendum as may amend or replace the addendum from time to time.
“Completions” means
(i) in relation to the EU SCCs in relation to exports from the EEA:
a) the optional wording at Clauses 7 and 11 is deleted;
b) in Clause 8.9 of such SCCs, the following paragraph is added after subsection (d):
“(e) Notwithstanding the above, any audit will be limited in scope and parameter to the systems processing the relevant personal data.
Where audits include inspections, they shall be carried out with reasonable prior notice. The parties will mutually agree upon the scope, timing, duration, control and evidence requirements of the audit, provided that this requirement to agree will not permit the data importer to unreasonably delay performance of the audit.
Any audit made pursuant to this Clause (i) shall be at the expense of the requesting data exporter, and such expenses shall include any reasonable related costs of the data importer, including compensation for the hours worked by the data importer’s staff; (ii) may, if the data exporter seeks to retain an independent auditor, only be done by a party approved in advance by the data importer, which approval cannot be unreasonably withheld; and (iii) shall be subject to a non-disclosure agreement.”
c) in Clause 9, Option 1 is deleted and the time period shall be not less than 30 days;
d) the applicable wording for Clause 13(a) of the EU SCCs (as determined by the instructions in square brackets in such SCCs) is retained and the two remaining alternatives are deleted;
e) in Clause 17 of the EU SCCs, Option 2 is deleted and Option 1 is completed with details of the laws of Ireland and in Clause 18(b) of the EU SCCs is completed with details of the courts of Ireland;
f) the parties set out in Annex 1 shall be completed with the names of the Customer as exporter and Palantir as importer, the transfers shall be as described in Exhibit B and any other relevant exhibits for applicable additional Services under this DPA and the supervisory authority shall be the Irish supervisory authority; in Annex II the list of technical and organisational measures shall be the Technical and Organisational Measures and in Annex III the list of sub-processors shall be those set out in Exhibit A; and
g) in the event that the EU SCCs are replaced from those in force at the Effective Date, such completions shall be made to the revised SCCs as most closely replicate those set out above.
(ii) in relation to the EU SCCs in relation to exports from other jurisdictions besides the EEA the completions set out in (i)(a)-(g) above shall apply save that:
a) in Clause 17 of such EU SCC, the second sentence is replaced with the following: “The Parties agree that this shall be English law” save where another governing law of the EU SCCs is required as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 17 shall be completed with details of the law which that Data Protection Law requires must be applied to such EU SCCs;
b) Clause 18(b) is replaced with the following “18(b) The Parties agree that those shall be the courts of England & Wales” save where another country, state or territory must have jurisdiction over the EU SCCs as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 18(b) of such EU SCCs shall be completed with details of the country, state or territory which that Data Protection Law requires must have jurisdiction over the EU SCCs;
c) references in the EU SCC to “a third party located outside the European Union” are replaced by references to “a third party located outside the country or territory in which the data exporter is established”;
d) references in such EU SCC to “the Member State” are replaced by references to “the country or territory in which the data exporter is established”;
e) all references to the GDPR in such EU SCC are replaced by references to Data Protection Law of the relevant country and references to provisions or concepts of the GDPR are replaced by references to the provisions or concepts of such Data Protection Law most closely related to the relevant term as understood in the GDPR;
f) all references to Member States of the European Union or to the European Union are replaced by references to the country of establishment of the exporter;
g) save where required as mandatory requirement of the relevant Data Protection Law, all references in the EU SCC to (a) data subject rights or other third party beneficiary rights or (b) to obligations or liability towards data subjects or other third parties shall be deleted and ignored; and
h) to the extent that any of references to the EU SCCs referred to above under (i) to (viii) are replaced in any amended provisions or replacement or subsequently approved clauses or instrument after the Effective Date, the amendments provided above under (ii)(a)-(h) shall be adapted and/or completed if and to the extent appropriate to reflect the effect of the former as close as possible
(iii) in relation to SCCs in relation to exports from the UK the EU SCCs shall apply as amended by either (i) the Information Commissioner’s “UK Addendum to the EU Commission Standard Contractual Clauses” found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdfhttps://ico.org.uk/media/about-the-ico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf or (ii) such replacement addendum to the EU Standard Contractual Clauses as the Information Commissioner might issue from time to time (these addenda known as the “UK SCC”), with the following items completed (or in the case of (ii) those items as most closely approximate the following items):
a) to the extent not covered by the foregoing, the completions set out in (i)(a)-(g) above shall apply save that:
b) Table 1 shall be completed with the names of the Customer as exporter and Palantir as importer;
c) in Table 2 the module of the EU SCCs selected shall be determined in accordance with the definition of SCCs set out below;
d) in Table 4 the “neither party” option shall be selected,
(iv) in relation to SCCs in relation to exports from Switzerland, the EU SCCs shall apply (incorporating the completions set out at (i)(a)-(g) above), as amended by either (a) the FDPIC’ decision guidance of 27 August 2021 found at https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222 setting out amendments to be made to the EU SCCs in respect of transfers subject to the Swiss FADP or (b) such replacement decision of the FDPIC relating to amendments to be made to the EU SCCs from time to time (these amendments known as the “Swiss SCCs”);
(v) in relation to SCCs in relation to exports from any other country, the completions set out in (i)(a)-(g) above shall be made or such other Completions as most closely achieves the same outcome as those Completions.
In respect of any transfers of Personal Data that may occur in the course of the provision of the Service, Module 2 (Controller to Processor) terms, as provided below in Annex 1 to Exhibit D, shall apply to the extent Customer is a Controller of Customer Personal Data. The Module 3 (Processor to Processor) terms, as provided below in Annex 2 to Exhibit D, shall apply to the extent Customer is a Processor (or subprocessor) of Customer Personal Data. For both Module 2 and Module 3 of the Standard Contractual Clauses, the election of specific terms and/or addition of required information shall apply as follows:
(a) The applicable wording for Clause 13(a) of the Standard Contractual Clauses (as determined by the instructions in square brackets in the Standard Contractual Clauses) is retained and the two remaining alternatives are deleted;
(b) details of Subprocessors the data importer intends to engage as set out in Exhibit A and/or any other relevant exhibits for applicable additional Services, respectively, to this Agreement are the “agreed list” of Subprocessors referread to in Clause 9(a) of the Standard Contractual Clauses.
ANNEX 1 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 2: Controller to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([1]) for the transfer of data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b)The data importer shall immediately inform the data exporter if it is unable to follow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([2]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([3]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([4]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii) the data importer is in substantial or persistent breach of these Clauses; or
(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of Ireland.
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Controller
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in clause 4.3(c) of the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.
The controls available to Customer described in clause 4.1 of the DPA, as further documented in the Security Documentation.
ANNEX 2 TO EXHIBIT D
STANDARD CONTRACTUAL CLAUSES
Module 3: Processor to Processor
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ([5]) for the transfer of personal data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)
have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);
(iii) Clause 9(a), (c), (d) and (e);
(iv) Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
[Intentionally left blank]
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
(a) The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter ([1]).
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ([6]) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.
(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) OPTION 2 GENERAL WRITTEN AUTHORISATION: The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 14 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ([7]) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ([8]);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). The data exporter shall forward the notification to the controller.
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation, if appropriate in consultation with the controller. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the controller or the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
The data exporter shall forward the notification to the controller.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). The data exporter shall forward the information to the controller.
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimization
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. The data exporter shall make the assessment available to the controller.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a)The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b)In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c)The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i)the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii)the data importer is in substantial or persistent breach of these Clauses; or
(iii)the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority and the controller of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d)Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e)Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
(a)Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b)The Parties agree that those shall be the courts of Ireland.
(c)A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
(d)The Parties agree to submit themselves to the jurisdiction of such courts.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
Name: Name of Customer as stated in the Agreement.
Address: Address of Customer as stated in the Agreement.
Contact person’s name, position and contact details: Point of contact for Customer as stated in the Agreement.
Activities relevant to the data transferred under these Clauses: Customer under the Agreement
Role (controller/processor): Processor
Data importer(s):
Name: Name of Palantir as stated in the Agreement.
Address: Address of Palantir as stated in the Agreement.
Contact person’s name, position and contact details: Data Protection Officer, dpo@palantir.com
Activities relevant to the data transferred under these Clauses: Supplier under the Agreement
Role (controller/processor): Processor
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
As described under "Categories of Data Subject Whose Personal Data May be Subject to Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Categories of personal data transferred
As described under "Categories of Customer Personal Data" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data, data concerning a natural person's sex life or sexual orientation to the extent that Customer Personal Data includes such sensitive data and is provided to Palantir for Processing (including via the Service) by or at the direction of Customer or Customer’s Users. In that case, Customer shall clearly identify such sensitive data to Palantir in writing before providing such sensitive data. The applied safeguards and restrictions are described in Annex II.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On a continuous basis.
Nature of the processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
Purpose(s) of the data transfer and further processing
As described under "Nature and Purpose of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described under "Duration of Processing" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As described under "Subject matter, nature and duration of processing by sub-processors" in Exhibit B and, where applicable, any other relevant exhibits for applicable additional Services.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13
The supervisory authority as determined in accordance with Clause 13 and as further specified at https://edpb.europa.eu/about-edpb/about-edpb/members_en (as updated from time to time).
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The security features and functionalities available to Customer described in the DPA, as further documented in the Security Documentation, and the technical and organisational measures described in the DPA.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
The controls available to Customer described in the DPA, as further documented in the Security Documentation.
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
- Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915. ↑
- The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses. ↑
- This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7. ↑
- As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies. ↑
Use Case Restrictions
Effective January 23rd 2025
DownloadTable of Contents
PALANTIR USE CASE RESTRICTIONS
By using the Palantir Foundry Platform or Palantir’s AI Platform (“AIP”) (including any other technology made available by Palantir to Customer “Palantir Technology”, which term if otherwise defined in the Agreement shall for purposes of these Palantir Use Case Restrictions have the definition provided in the Agreement), Customer agrees to abide by the following use case restrictions. Any capitalized terms not defined in these Use Case Restrictions will have the meaning provided to them in the Palantir Terms of Service, or any applicable agreement governing Customer’s use of the Palantir Technology (the “Agreement”).
In accordance with the Agreement, you and the Customer you represent (including such Customer’s users) will not use the Palantir Technology for any Prohibited Use Case. Customer must obtain Palantir’s prior written approval to use or permit any of Customer’s users to use the Palantir Technology for any Use Cases Requiring Pre-Approval.
Prohibited Use Cases:
- Political parties, committees, campaigns, or organizations workflows
- Offensive cyber workflows
- Predictive policing efforts
- Influencing union organizing efforts
- Facial recognition for surveillance workflows
- Predatory targeting workflows
- Clinical judgment or decision making, medical advice, diagnostic or therapeutic purposes, and/or as a medical device or accessory (as defined by the applicable law).
Use Cases Requiring Pre-Approval:
- Any use of non-public government data
- Law enforcement workflows (including, but not limited to, investigative watchlists)
- Immigration enforcement, monitoring, or surveillance workflows
- Mobility collecting, monitoring, or tracking workflows
- Video analysis workflows (e.g., CCTV)
- Tobacco, controlled substances, or illicit drugs related workflows
- Gambling related workflows.
- Employee monitoring workflows
- Biometric identity verification workflows
- Social media data use
Effective April 25th 2024 to January 23rd 2025
DownloadTable of Contents
PALANTIR USE CASE RESTRICTIONS
By using the Palantir Foundry Platform or Palantir’s AI Platform (“AIP”) (including any other technology made available by Palantir to Customer “Palantir Technology”, which term if otherwise defined in the Agreement shall for purposes of these Palantir Use Case Restrictions have the definition provided in the Agreement), Customer agrees to abide by the following use case restrictions. Any capitalized terms not defined in these Use Case Restrictions will have the meaning provided to them in the Palantir Terms of Service, or any applicable agreement governing Customer’s use of the Palantir Technology (the “Agreement”).
In accordance with the Agreement, you and the Customer you represent (including such Customer’s users) will not use the Palantir Technology for any Prohibited Use Case. Customer must obtain Palantir’s prior written approval to use or permit any of Customer’s users to use the Palantir Technology for any Use Cases Requiring Pre-Approval.
Prohibited Use Cases:
- Political parties, committees, campaigns, or organizations workflows
- Offensive cyber workflows
- Predictive policing efforts
- Influencing union organizing efforts
- Facial recognition for surveillance workflows
- Predatory targeting workflows
- Clinical judgment or decision making, medical advice, diagnostic or therapeutic purposes, and/or as a medical device or accessory (as defined by the applicable law).
Use Cases Requiring Pre-Approval:
- Any use of government data
- Law enforcement workflows (including, but not limited to, investigative watchlists)
- Immigration enforcement, monitoring, or surveillance workflows
- Mobility collecting, monitoring, or tracking workflows
- Video analysis workflows (e.g., CCTV)
- Tobacco, controlled substances, or illicit drugs related workflows
- Gambling related workflows.
- Employee monitoring workflows
- Biometric identity verification workflows
- Social media data use
Effective February 1st 2024 to April 25th 2024
DownloadTable of Contents
PALANTIR USE CASE RESTRICTIONS
By using the Palantir Foundry Platform or Palantir’s AI Platform (“AIP”) (including any other technology made available by Palantir to Customer “Palantir Technology”, which term if otherwise defined in the Agreement shall for purposes of these Palantir Use Case Restrictions have the definition provided in the Agreement), Customer agrees to abide by the following use case restrictions. Any capitalized terms not defined in these Use Case Restrictions will have the meaning provided to them in the Palantir Terms of Service, or any applicable agreement governing Customer’s use of the Palantir Technology (the “Agreement”).
In accordance with the Agreement, you and the Customer you represent (including such Customer’s users) will not use the Palantir Technology for any Prohibited Use Case. Customer must obtain Palantir’s prior written approval to use or permit any of Customer’s users to use the Palantir Technology for any Use Cases Requiring Pre-Approval.
Prohibited Use Cases:
- Political parties, committees, campaigns, or organizations workflows
- Offensive cyber workflows
- Predictive policing efforts
- Influencing union organizing efforts
- Facial recognition for surveillance workflows
- Predatory targeting workflows
- Clinical judgment or decision making, medical advice, diagnostic or therapeutic purposes, and/or as a medical device or accessory (as defined by the applicable law).
Use Cases Requiring Pre-Approval:
- Law enforcement workflows (including, but not limited to, investigative watchlists)
- Immigration enforcement, monitoring, or surveillance workflows
- Mobility collecting, monitoring, or tracking workflows
- Video analysis workflows (e.g., CCTV)
- Tobacco, controlled substances, or illicit drugs related workflows
- Gambling related workflows.
- Employee monitoring workflows
- Biometric identity verification workflows
- Social media data use
[SPANISH] Terms of Service (AIP Now)
Effective May 16th 2025
DownloadTable of Contents
PALANTIR AIP NOW CONDICIONES DEL SERVICIO
AL SELECCIONAR "ACEPTO" (O EQUIVALENTE) CUANDO DICHA OPCIÓN ESTÉ DISPONIBLE, O AL INSTALAR, EJECUTAR, DESCARGAR, ACCEDER O UTILIZAR DE CUALQUIER OTRO MODO CUALQUIER PARTE DE LA PLATAFORMA PALANTIR (SEGÚN SE DEFINE MÁS ADELANTE), USTED CONFIRMA QUE ("USTED" O "SU" O "USUARIO AUTORIZADO") HA LEÍDO ESTE ACUERDO (SEGÚN SE DEFINE MÁS ADELANTE), QUE COMPRENDE LOS TÉRMINOS DEL ACUERDO, Y QUE USTED Y (SI PROCEDE) LA ENTIDAD A LA QUE REPRESENTA CONSIENTEN INCONDICIONALMENTE EN QUEDAR VINCULADOS POR ESTE ACUERDO Y SE CONVIERTEN EN PARTE DEL MISMO, EL CUAL, PARA EVITAR CUALQUIER DUDA, CONTIENE LA SECCIÓN 13 RELATIVA AL ARBITRAJE OBLIGATORIO Y VINCULANTE DE DISPUTAS, LA SECCIÓN 4 RELATIVA AL USO ACEPTABLE Y LA SECCIÓN 9.2 RELATIVA A LAS INDEMNIZACIONES DEL CLIENTE.2 RELATIVA A LAS INDEMNIZACIONES DEL CLIENTE. SI CELEBRA ESTE ACUERDO EN NOMBRE DE UNA ENTIDAD, COMO LA EMPRESA, ORGANIZACIÓN O INSTITUCIÓN EDUCATIVA PARA LA QUE TRABAJA, DECLARA Y GARANTIZA QUE ESTÁ AUTORIZADO A ACEPTAR LOS TÉRMINOS DE ESTE ACUERDO EN NOMBRE DE LA ENTIDAD COMO SU REPRESENTANTE LEGAL AUTORIZADO. SI NO ACEPTA INCONDICIONALMENTE TODOS LOS TÉRMINOS DE ESTE ACUERDO, NO SELECCIONE "ACEPTO" CUANDO DICHA OPCIÓN ESTÉ DISPONIBLE Y NO INSTALE, EJECUTE, DESCARGUE, ACCEDA NI UTILICE DE NINGÚN OTRO MODO NINGUNA PARTE DE LA PLATAFORMA PALANTIR.
LA ACEPTACIÓN DE PALANTIR ESTÁ EXPRESAMENTE CONDICIONADA A SU CONFORMIDAD CON TODOS LOS TÉRMINOS Y CONDICIONES DE ESTE ACUERDO, CON EXCLUSIÓN DE TODOS LOS DEMÁS TÉRMINOS; SI ESTOS TÉRMINOS SE CONSIDERAN UNA OFERTA, LA ACEPTACIÓN ESTÁ EXPRESAMENTE LIMITADA A ESTOS TÉRMINOS.
PALANTIR AIP NOW ACTUALMENTE SÓLO ESTÁ DISPONIBLE PARA CLIENTES Y USUARIOS UBICADOS EN LOS ESTADOS UNIDOS, CANADÁ, LA REPÚBLICA DE LA INDIA, LA REPÚBLICA FEDERAL DE ALEMANIA, LOS PAÍSES BAJOS, ESPAÑA, AUSTRIA O EL REINO UNIDO. POR CONSIGUIENTE, DEBE PRESENTAR UNA IDENTIFICACIÓN (EN EL FORMULARIO DE ENVÍO DEL PEDIDO, TAL Y COMO SE DEFINE A CONTINUACIÓN) EMITIDA POR LOS ESTADOS UNIDOS (O SU ESTADO), CANADÁ, LA REPÚBLICA DE LA INDIA, LOS PAÍSES BAJOS, ESPAÑA, AUSTRIA, O EL REINO UNIDO PARA RECIBIR ACCESO A PALANTIR AIP NOW, Y NO PODRÁ ACCEDER NI UTILIZAR PALANTIR AIP NOW SI SE ENCUENTRA FUERA DE LOS ESTADOS UNIDOS, CANADÁ, LA REPÚBLICA DE LA INDIA, LA REPÚBLICA FEDERAL DE ALEMANIA, LOS PAÍSES BAJOS, ESPAÑA, AUSTRIA, O EL REINO UNIDO.
El presente Acuerdo se celebra entre el Cliente (tal y como se define a continuación) y Palantir (cada una de ellas una "Parte" y colectivamente las "Partes") y entra en vigor a partir de la fecha en la que Usted seleccione "ACEPTO" (o equivalente) en el Formulario de envío de pedidos cuando Palantir ponga a disposición dicha opción (la "Fecha de entrada en vigor").
1.1 "Afiliada" significa una entidad que, directa o indirectamente, posea o controle o sea propiedad o esté controlada por, o esté bajo propiedad o control común con, una Parte a partir de la Fecha de Entrada en Vigor y mientras dicha entidad siga siendo propiedad o esté controlada directa o indirectamente por la Parte. Tal y como se utiliza en el presente documento, "control" significa el poder de dirigir, directa o indirectamente, la gestión o los asuntos de una entidad y "propiedad" significa la titularidad efectiva de más del cincuenta por ciento de las acciones con derecho a voto u otras participaciones equivalentes con derecho a voto de una entidad.
1.2 "Acuerdo" hace referencia, de forma colectiva, a las presentes Condiciones de servicio de Palantir AIP Now y a todos los anexos, apéndices, condiciones, avisos, normas de funcionamiento, políticas (incluida la Política de privacidad de Palantir), exposiciones, anexos o documentos incorporados por referencia o hipervínculos en el presente documento (que pueden actualizarse ocasionalmente de conformidad con la Sección 13 del presente documento) o que podamos publicar ocasionalmente en el Sitio web o en las Cuentas del Cliente, así como a todos los documentos de pedido suscritos entre Palantir y el Cliente que hagan referencia al presente Acuerdo, incluido el Formulario de envío de pedido.
1.3 "Cliente" significa el cliente identificado en el Formulario de Envío de Pedido que es Parte de este Acuerdo, en nombre del cual Usted está aceptando los términos de este Acuerdo como su representante legal.
1.4 "Datos del Cliente" hace referencia a cualquier dato (incluidas las versiones agregadas o transformadas de los mismos y los resultados analíticos), modelo, algoritmo, análisis, código de transformación u otro contenido proporcionado por un tercero, ya sea directa o indirectamente, o creado por el Cliente, o por Usuarios que utilicen el Servicio o el Sitio Web, para su integración, uso u otro tipo de procesamiento en el Servicio o a través de él. Los Datos del Cliente excluyen los Datos de Uso.
1.5 "Software de conexión de datos" hace referencia al software de Palantir proporcionado para su instalación local para que el Cliente conecte los Datos del Cliente al Servicio.
1.6 "Documentación" hace referencia a cualquier documentación técnica para el Servicio que se ponga a disposición en relación con el Servicio, incluida la documentación técnica relevante para el Servicio disponible en https://www.palantir.com/docs/, actualizada cada cierto tiempo a discreción exclusiva de Palantir.
1.7 "Derechos de Propiedad Intelectual" significa todos los derechos, títulos e intereses sobre cualquier secreto comercial, patentes, derechos de autor, marcas de servicio, marcas registradas, know-how, nombres comerciales, derechos de imagen comercial y embalaje, derechos morales, derechos de privacidad, derechos de publicidad y cualquier derecho similar, incluyendo cualquier solicitud, continuación o registro con respecto a lo anterior, en virtud de las leyes o reglamentos de cualquier autoridad gubernamental, reguladora o judicial.
1.8 "Formulario de envío de pedido" hace referencia al formulario web (o documento que incorpore expresamente este Acuerdo por referencia) cumplimentado y/o ejecutado por Usted para incluir la información del Cliente y especificar el Servicio y/o los Servicios profesionales (si procede) que se prestarán en virtud del presente y que Usted envía en nombre del Cliente a Palantir.
1.9 "Palantir", a menos que se especifique expresamente lo contrario en un Formulario de Envío de Pedido, significa (a) Palantir Technologies Inc. si la ubicación principal de uso del Cliente es Estados Unidos, Canadá, la República Federal de Alemania, Países Bajos, España, Austria o la República de la India; o (b) Palantir Technologies UK, Ltd., si la ubicación principal de uso del Cliente es Reino Unido. si la ubicación principal de uso del Cliente es el Reino Unido. Sin perjuicio de lo anterior, (x) si la sede (es decir, el centro de actividad principal) de la entidad matriz última del Cliente se encuentra en la República de Corea, "Palantir" significa Palantir Korea LLC. Si no se aplican ni (a), ni (b), ni (x), "Palantir" significa Palantir Technologies Inc.
1.10 "Plataforma Palantir" hace referencia al Servicio, la Documentación, el Software de Conexión de Datos, los Materiales de Muestra, el Sitio Web, los modelos y las interfaces de programación de aplicaciones (API), proporcionados o puestos a disposición del Cliente como un servicio en relación con el presente Acuerdo, así como a cualquier mejora, modificación, obra derivada, parche, mejora y actualización de los mismos.
1.11 "Política de Privacidad de Palantir" hace referencia a cualquier política específica de privacidad disponible en el Sitio Web y/o accesible a través del Formulario de Envío de Pedidos.
1.12 "Materiales de muestra" hace referencia a cualquier tecnología y material proporcionado o puesto a disposición del Cliente por Palantir para su uso con el Servicio, incluidos el código de muestra, las bibliotecas de software, las herramientas de línea de comandos, el código de integración de datos, las plantillas y los archivos de configuración.
1.13 "Servicio" hace referencia al acceso de software como servicio a Palantir AIP Now (o a la(s) plataforma(s) que pueda(n) especificarse en un Formulario de envío de pedido).
1.14 "Impuestos" significa cualquier impuesto aplicable sobre ventas, uso, transacción, valor añadido, bienes y servicios, impuesto armonizado sobre ventas, impuesto de retención, impuesto especial o impuestos similares, y cualquier tasa o cargo extranjero, provincial, federal, estatal o local (incluidas, entre otras, las tasas medioambientales o similares), derechos, costes de cumplimiento de los controles y reglamentos de exportación e importación, y otros gravámenes gubernamentales, incluidas las sanciones e intereses correspondientes, impuestos sobre, con respecto a o asociados de otro modo con cualquier transacción en virtud del presente documento.
1.15 "Contenido de terceros" hace referencia a los datos, servicios o aplicaciones de terceros que interoperan con el Servicio y que Palantir puede, a criterio exclusivo del Cliente, facilitar el uso en relación con el Servicio y sujeto a un acuerdo independiente entre el Cliente y dicho tercero.
1.16 "Servicios de Terceros" hace referencia a los servicios de terceros que Palantir puede utilizar en la prestación del Servicio, tal y como se establece en la Documentación (o según acuerden las Partes).
1.17 "Sitio web" hace referencia a WWW.PALANTIR.COM o a cualquier otro dominio propiedad de Palantir, incluido cualquier subdominio de los anteriores, y a todo el software, las aplicaciones, los productos, el contenido y los servicios proporcionados por Palantir en el Sitio web o a través de él.
2. Prestación del servicio.
2.1 Acceso al Servicio. Palantir pondrá el Servicio a disposición del Cliente, sujeto a la condición subsiguiente establecida en la Cláusula 2.8, durante el Periodo de vigencia aplicable únicamente para su uso por parte del Cliente y sus Usuarios de conformidad con los términos y condiciones del presente Acuerdo y la Documentación para fines empresariales internos (y/o, si procede, personales) del Cliente, o (si procede) según se estipule explícitamente de otro modo en un Formulario de envío de pedido
2.2 Licencia de Software de Conexión de Datos. Si es aplicable para el uso del Servicio, y sujeto a la condición posterior establecida en la Sección 2.8, Palantir concede al Cliente durante el Periodo de vigencia una licencia limitada, no exclusiva, intransferible y no sublicenciable para utilizar el Software de Conexión de Datos con el único fin de utilizar y conectarse al Servicio. El Cliente permitirá a Palantir acceder al Software de Conexión de Datos de forma remota según sea necesario para prestar el Servicio.
2.3 Licencia de Materiales de Muestra. Palantir puede poner a disposición del Cliente Materiales de muestra para su uso durante el Periodo de vigencia. Si procede, y sujeto a la condición posterior establecida en la Sección 2.8, Palantir concede al Cliente durante el Periodo de vigencia una licencia limitada, no exclusiva, intransferible y no sublicenciable para copiar, modificar y utilizar los Materiales de muestra únicamente en la medida necesaria para el uso del Servicio por parte del Cliente.
2.4 Datos de uso. Palantir puede recopilar y utilizar métricas, análisis, estadísticas u otros datos relacionados con el uso del Servicio por parte del Cliente (a) para asegurar el Servicio en beneficio del Cliente; (b) para proporcionar, analizar, mantener, respaldar y mejorar el Servicio; y (c) para cualquier otro fin para el que el Cliente proporcione autorización a través del Servicio, cuando dicha opción esté disponible (colectivamente, "Datos de uso").
2.5 Seguridad. Palantir ha establecido un Programa de Seguridad de la Información ("ISP", por sus siglas en inglés) diseñado para garantizar sólidos controles prácticos de seguridad y el cumplimiento de las normas y marcos de mejores prácticas del sector. Puede encontrar una lista completa de las certificaciones de Palantir en https://www.palantir.com/information-security/ en "Compliance and Accreditation". Además, el ISP de Palantir está alineado con los marcos y sistemas de gestión NIST 800-53, TSC (Trust Service Criteria) y CIS (Center for Internet Security). El Cliente reconoce que la documentación de Palantir mencionada en esta Sección y otra información relacionada son Información Confidencial de Palantir en virtud del presente documento.
2.6 Niveles de Servicio y Soporte. Durante el Periodo de Vigencia, Palantir no tiene obligación alguna de prestar servicios de asistencia en virtud del presente Acuerdo. El presente Acuerdo no le otorga a Usted ni al Cliente ningún derecho a actualizaciones o mejoras de la Plataforma Palantir ni a extensiones o mejoras de la Plataforma Palantir desarrolladas por Palantir en el futuro. Palantir podrá ofrecer servicios de soporte por separado. Cualquier código de software complementario o material relacionado que Palantir le proporcione a Usted o al Cliente como parte de cualquier servicio de soporte se considerará parte de la Plataforma Palantir y estará sujeto a los términos y condiciones del presente Acuerdo.
2.7 Servicios Profesionales. Palantir prestará al Cliente los servicios de implementación, habilitación, formación u otros servicios profesionales que se especifiquen en el Formulario de envío de pedido y sujetos a las tarifas correspondientes ("Servicios profesionales"). Si el Formulario de envío de pedido no especifica ningún Servicio profesional, Palantir podrá, a su entera discreción (sin obligación de hacerlo en ausencia de un acuerdo independiente que estipule lo contrario), prestar al Cliente Servicios profesionales. La prestación de cualquier Servicio Profesional no afectará a la propiedad de la Plataforma Palantir y demás materiales proporcionados por Palantir en virtud del presente Acuerdo.
2.8 Requisitos de Cumplimiento de Palantir. Si Palantir determina, a su entera discreción, que el Cliente no ha satisfecho los Requisitos de Cumplimiento de Palantir, las obligaciones de Palantir en virtud de las Secciones 2.1, 2.2 y 2.3 (incluido el otorgamiento de los derechos de acceso y las concesiones de licencia previstas en las mismas) se extinguirán inmediatamente en el momento en que Palantir determine que el Cliente no ha satisfecho los Requisitos de Cumplimiento de Palantir. Palantir podrá evaluar (y volver a evaluar) el cumplimiento por parte del Cliente de los Requisitos de Cumplimiento de Palantir en cualquier momento, incluso después de que el Cliente haya accedido al Servicio. Además, el acceso continuado del Cliente al Servicio y/o a cualquier Plataforma de Palantir está condicionado a que Palantir determine, a su entera discreción, que el Cliente satisface los Requisitos de Cumplimiento de Palantir. Los "Requisitos de Cumplimiento de Palantir" comprenden (a título meramente enunciativo) la determinación por parte de Palantir (a su entera discreción) de que la ejecución del presente Acuerdo con el Cliente probablemente (i) no infrinja las obligaciones de Palantir en virtud de la normativa de control comercial de los Estados Unidos, incluida la normativa de Administración de Exportaciones de los EE. (ii) infrinja o incumpla las obligaciones contractuales de Palantir con terceros, (iii) haga que Palantir infrinja las leyes que prohíben el suministro de bienes, asistencia o servicios a Nacionales Especialmente Designados, tal y como los define el Departamento del Tesoro de los Estados Unidos, o a personas sujetas a prohibiciones similares de bloqueo o denegación administradas por una agencia gubernamental de los EE.(iv) infrinjan las obligaciones de Palantir en virtud de las leyes y normativas de exportación y sanciones de los Estados Unidos y otras jurisdicciones aplicables, incluidas, entre otras, las de la Oficina de Industria y Seguridad de los Estados Unidos y la Oficina de Control de Activos Extranjeros, o (v) infrinjan de cualquier otro modo las políticas o los valores de Palantir. Palantir se reserva el derecho a modificar la definición de Requisitos de Cumplimiento de Palantir en cualquier momento, según sea necesario y a su entera discreción.
3. Uso del servicio por parte del cliente.
3.1 Cuentas.
(a) Si el Cliente es una entidad distinta de una persona física, como una empresa, organización o institución educativa, el Cliente no podrá proporcionar más de cinco (5) cuentas para acceder al Servicio ("Cuentas") para sus (1) empleados, (2) contratistas, (3) otros usuarios (incluidos los empleados o contratistas de sus Filiales) especificados en el Formulario de envío de pedido para los fines autorizados en virtud del presente, y/o (4) los clientes del Cliente (los "Terceros autorizados") sujetos a los términos y condiciones adicionales establecidos en la Sección 3.1(a)(i) a (vi) del presente documento (colectivamente, los "Usuarios").1(a)(i)-(vi) (colectivamente, "Usuarios"):
(i) El Cliente podrá conceder acceso al Servicio a un Tercero Autorizado con el único fin de utilizar los servicios prestados por el Cliente al Tercero Autorizado en relación con los fines empresariales del Cliente; para evitar cualquier duda, un Tercero Autorizado no podrá acceder al Servicio para sus propios fines empresariales independientes de los servicios prestados por el Cliente.
(ii) El acceso de Terceros Autorizados al Servicio se limitará estrictamente a las aplicaciones frontales del Cliente creadas por el Cliente utilizando la Plataforma Palantir, y se prohíbe a los Terceros Autorizados introducir datos directamente en la Plataforma Palantir, siempre que el Cliente pueda introducir datos de Terceros Autorizados en la Plataforma Palantir con sujeción a lo dispuesto en el punto (i) anterior.
(iii) El acceso de Terceros Autorizados se regirá y estará sujeto a todas las restricciones y obligaciones del Acuerdo, y el Cliente será responsable de cualquier incumplimiento o violación del mismo por parte de un Tercero Autorizado. El Cliente podrá proporcionar a un Tercero Autorizado acceso sujeto a las condiciones de acceso inalteradas que Palantir proporcione por separado al Cliente.
(iv) El uso por parte de un Tercero Autorizado estará sujeto a las tarifas establecidas en el presente documento.
(v) El Cliente es responsable de proporcionar asistencia a los Terceros Autorizados en relación con las aplicaciones front-end creadas por el Cliente, y el Cliente mantendrá una política de asistencia que establezca que el Tercero Autorizado deberá enviar cualquier consulta de asistencia al Cliente, siempre que el Cliente pueda elevar a Palantir los problemas de la Plataforma Palantir identificados por un Tercero Autorizado que no puedan ser resueltos por el Cliente, y Palantir proporcionará asistencia razonable al Cliente para dichas elevaciones durante el horario laboral normal de Palantir en la(s) región(es) designada(s) por Palantir.
(vi) El Cliente no accederá, ni permitirá que ningún Tercero Autorizado acceda, a la Plataforma Palantir desde ningún país incluido en la lista de países prohibidos de Palantir que Palantir pone a disposición del Cliente (cada uno de ellos, un "País Prohibido").
(b) Si el Cliente es una persona física, no podrá proporcionar más de cinco (5) Cuentas, cada una de ellas únicamente a otras personas físicas (cada una de las cuales se considerará Usuario) que hayan proporcionado al Cliente todos los consentimientos, autorizaciones, aprobaciones y/o acuerdos necesarios para permitir al Cliente utilizar y/o procesar los datos de dichos Usuarios en virtud de la legislación, la normativa o los acuerdos aplicables con dichos Usuarios, y que hayan suscrito con Palantir Condiciones de Servicio sustancialmente similares a las condiciones del presente Acuerdo; siempre y cuando, si el Cliente es una persona física que accede a la instancia del Servicio de otro cliente de Palantir como Usuario autorizado (o equivalente, tal y como se identifica en el Formulario de envío de pedido) (dicho otro cliente de Palantir, un "Usuario principal"), no se permita a dicho Cliente proporcionar ninguna Cuenta. El Cliente será responsable de (i) administrar las Cuentas; (ii) utilizar medidas de seguridad estándar del sector para proteger las Cuentas (incluido, entre otros, el uso de autenticación multifactor); (iii) cualquier actividad en las Cuentas y la supervisión de dicha actividad en las Cuentas (únicamente en la medida en que dicha supervisión no infrinja ningún otro término de este Acuerdo o la legislación aplicable) ; y (iv) las acciones y omisiones de sus Usuarios en relación con la Plataforma Palantir y/o las Cuentas. El Cliente desactivará inmediatamente cualquier Cuenta en cuanto tenga conocimiento de que se ha puesto en peligro o se ha producido un uso no autorizado de la misma (y, en tal caso, notificará inmediatamente a Palantir dicho compromiso o uso no autorizado), o a petición razonable de Palantir.
3.2 Protección de Datos. Las Partes cumplirán el Anexo de Protección de Datos de Palantir ("APD") disponible en https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795 . El Cliente será el único responsable de la exactitud, el contenido y la legalidad de los Datos del Cliente y se asegurará de que cualquier integración de los Datos del Cliente en el Servicio cumpla con las leyes y normativas aplicables, incluidos, entre otros, los requisitos de localización de datos. En el papel de Palantir como Responsable del tratamiento (según se define en la DPA) con respecto al Cliente, se aplicará la Política de privacidad de AIP Now, disponible en http://www.palantir.com/aip-now-statement, que se incorpora al presente documento como referencia.
4. Uso aceptable.
4.1 Legislación aplicable. Su acceso y uso del Servicio y del Sitio web, así como los del Cliente, no infringirán las leyes aplicables de los Estados Unidos ni otras leyes aplicables en la jurisdicción en la que se encuentren Usted o el Cliente, en la que se encuentre cualquier persona física que pueda ser identificada (directa o indirectamente) por referencia a los Datos del cliente (cada uno, un "Sujeto de datos"), o en la que se almacenen los Datos del cliente, y es responsabilidad exclusiva de Usted y del Cliente garantizar dicho cumplimiento. Palantir podrá, ocasionalmente, poner a disposición políticas de uso aceptable, directrices de la comunidad o políticas similares, que pasarán a formar parte de este Acuerdo de conformidad con la política de actualizaciones establecida en la Sección 14.
4.2 Uso competitivo. El Cliente no utilizará, accederá, evaluará ni visualizará la Plataforma Palantir con el fin de crear u ofrecer un producto o servicio similar o competitivo con la Plataforma Palantir.
4.3 Controles de Exportación. La Plataforma Palantir puede estar sujeta a la normativa de control comercial de los Estados Unidos, como la Normativa de Administración de Exportaciones de los Estados Unidos, o a otras leyes de control de exportaciones aplicables en otras jurisdicciones, incluidas las leyes y normativas de exportación y sanciones a las que se hace referencia en la Sección 15 del presente Acuerdo. El Cliente no podrá utilizar la Plataforma Palantir en contravención del control de exportaciones u otros controles comerciales de los Estados Unidos o de cualquier otra jurisdicción aplicable. Esto incluye, sin limitación, las siguientes prohibiciones:
(a) El Cliente no podrá utilizar ni acceder al Servicio si es o está trabajando en nombre de un Nacional Especialmente Designado según la definición del Departamento del Tesoro de los Estados Unidos o de una persona sujeta a prohibiciones similares de bloqueo o denegación de acceso administradas por un organismo gubernamental de los Estados Unidos; y
(b) El Cliente no podrá utilizar ni acceder al Servicio para realizar ninguna actividad sujeta al Reglamento sobre Tráfico Internacional de Armas (ITAR) mantenido por el Departamento de Estado de los Estados Unidos, incluyendo, sin limitación, la ingesta de datos controlados por el ITAR.
4.4 Uso de PII y/o PHI. Si el Cliente utiliza o prevé utilizar Información Personalmente Identificable ("IPI"), Datos Personales, Información Personal o Información Sanitaria Protegida ("PHI"), tal y como se define en la legislación aplicable, en relación con el Servicio, el Cliente (a) deberá indicar dicho uso (previsto) cuando dicha opción esté disponible en el Formulario de Envío de Pedido, y ejecutar un Acuerdo de Socio Comercial antes de acceder o utilizar el Servicio; y (b) seguirá las directrices y mejores prácticas pertinentes para la protección de datos sensibles establecidas en la documentación disponible en https://www.palantir.com/docs/foundry/security/overview/. Para evitar cualquier duda, esta Sección no concede al Cliente permiso para utilizar la información anterior en relación con el Servicio si un Formulario de Envío de Pedido no permite expresamente dicho uso.
4.5 Limitaciones de los Casos de Uso. El Cliente deberá cumplir las Limitaciones de los Casos de Uso de Palantir disponibles en https://palantir.pactsafe.io/#ucr-985315, que por el presente se incorporan por referencia al Acuerdo, incluso en relación con cualquier uso de la Plataforma Palantir
4.6 Derechos de auditoría. El Cliente acepta que Palantir pueda auditar el uso del Servicio por parte del Cliente con el fin de verificar el cumplimiento de este Acuerdo por parte del Cliente, incluido, entre otros, el cumplimiento de la Sección 3.2 (Protección de datos), la Sección 4 (Uso aceptable), la Sección 5.3 (Restricciones), la Sección 6 (Confidencialidad) y la Sección 7 (Tarifas y pagos). Si Palantir tiene conocimiento o sospechas razonables de cualquier infracción del presente Acuerdo por parte del Cliente, previa notificación razonable, Palantir podrá auditar el cumplimiento del presente Acuerdo por parte del Cliente, el uso de la Plataforma Palantir por parte del Cliente y los sistemas y registros de supervisión de software del Cliente, siempre que dicha auditoría se lleve a cabo durante el horario laboral habitual del Cliente. Si Palantir considera razonablemente que dicha auditoría revela que el Cliente ha incumplido el presente Acuerdo, Palantir podrá ejercer sus derechos de rescisión en virtud de la Cláusula 8.2, y/o sus derechos de suspensión de servicios en virtud de la Cláusula 8.4, según corresponda, y el Cliente será responsable de los costes razonables de la auditoría, además de cualesquiera otros honorarios, daños, sanciones o recursos a los que Palantir pueda tener derecho en virtud del presente Acuerdo y/o la legislación aplicable. Para evitar cualquier duda, el inicio de una auditoría por parte de Palantir no es necesariamente una condición previa para el ejercicio de sus derechos de rescisión en virtud de la Cláusula 8.2 o el ejercicio de sus derechos de suspensión de servicios en virtud de la Cláusula 8.4, si se cumplen las condiciones que permiten el ejercicio de los derechos anteriores; la decisión de Palantir de iniciar una auditoría no excluye su capacidad para ejercer sus derechos en virtud de la Cláusula 8.2 o la Cláusula 8.4, si se cumplen las condiciones que permiten el ejercicio de los derechos anteriores.
5. Derechos de propiedad.
5.1 Propiedad del Cliente. En lo que respecta a las Partes, el Cliente posee todos los derechos, títulos e intereses, incluidos todos los Derechos de Propiedad Intelectual, sobre los Datos del Cliente y cualquier modificación realizada a los mismos. Sujeto al Acuerdo, el Cliente otorga a Palantir un derecho y una licencia no exclusivos, mundiales y exentos de regalías durante el Periodo de vigencia para utilizar y procesar los Datos del cliente con el único fin de proporcionar el Servicio y/o los Servicios profesionales, y según lo exija la legislación aplicable. Asimismo, el Cliente concede a Palantir un derecho y una licencia mundiales, perpetuos, irrevocables y exentos de regalías para utilizar, distribuir, divulgar y realizar e incorporar en la Plataforma Palantir cualquier sugerencia, solicitud de mejora, recomendación u otros comentarios proporcionados por el Cliente o los Usuarios en relación con la Plataforma Palantir
5.2 Propiedad de Palantir. En lo que respecta a las Partes, Palantir es propietaria de todos los derechos, títulos e intereses, incluidos todos los Derechos de Propiedad Intelectual, de la Plataforma Palantir y de cualquier otra documentación o material relacionado proporcionado por Palantir, así como de cualquier trabajo derivado, modificación o mejora de cualquiera de los anteriores (incluidos, entre otros, todos los Derechos de Propiedad Intelectual incorporados en cualquiera de los anteriores). A excepción de los derechos expresos concedidos en el presente documento, Palantir no concede ninguna otra licencia o acceso, ya sea expreso o implícito, ni ningún derecho de propiedad sobre ninguna Plataforma Palantir, software, servicios o Derechos de Propiedad Intelectual.
5.3 Restricciones. El Cliente no (y no permitirá que ningún tercero): (a) obtenga o intente obtener acceso no autorizado al Servicio o Sitio Web o infraestructura, o cualquier elemento del mismo, o eluda o interfiera con cualquier autenticación o medidas de seguridad del Servicio o Sitio Web; (b) interfiera o interrumpa la integridad o el rendimiento del Servicio o Sitio Web; (c) acceda o intente acceder a los datos de otro cliente; (d) afecte negativamente a la capacidad de otros clientes para utilizar el Servicio; (e) transmitir material que contenga virus de software u otros códigos informáticos, archivos, scripts, agentes o programas dañinos o nocivos a través del Servicio o el Sitio web; (f) descompilar, desensamblar, escanear, aplicar ingeniería inversa o intentar descubrir cualquier código fuente o ideas o algoritmos subyacentes de cualquier Plataforma de Palantir (excepto en la medida en que la legislación aplicable prohíba expresamente dicha restricción de ingeniería inversa, y en tal caso únicamente previa notificación por escrito a Palantir); (g) proporcionar, arrendar, prestar, utilizar con fines de multipropiedad u oficina de servicios, o utilizar de cualquier otro modo o permitir que otros utilicen el Servicio en beneficio de terceros; (h) utilizar el Servicio o el Sitio web para cualquier fin que no esté expresamente permitido por el presente Acuerdo; (i) listar o mostrar o copiar de cualquier otro modo cualquier código de cualquier Plataforma Palantir, excepto los Materiales de Muestra en la medida necesaria para el uso del Servicio por parte del Cliente; (j) copiar cualquier Plataforma Palantir (o componente de la misma) o desarrollar cualquier mejora, modificación o trabajo derivado de la misma, excepto los Materiales de Muestra en la medida necesaria para el uso del Servicio por parte del Cliente; (k) incluir cualquier parte de cualquier Plataforma Palantir en cualquier otro servicio, equipo o artículo; (l) permitir la transferencia, transmisión (incluida, entre otras, la puesta a disposición en línea, la transmisión electrónica o la comunicación al público por cualquier otro medio), exportación o reexportación de cualquier Plataforma Palantir (o cualquier parte de la misma) o de cualquier dato técnico de Palantir; (m) realizar pruebas de penetración en el Servicio, a menos que Palantir lo autorice; (n) utilizar, acceder, evaluar o visualizar la Plataforma Palantir con el fin de crear u ofrecer un producto o servicio similar a la Plataforma Palantir o que compita con ella; (o) eliminar, ocultar o alterar, o violar de cualquier otro modo los términos de cualquier aviso de derechos de autor, marcas comerciales, logotipos y nombres comerciales y cualquier otro aviso (incluidas las licencias de código abierto o similares de terceros) o identificaciones que aparezcan en o sobre cualquier Plataforma Palantir y cualquier medio asociado; (p) utilizar el Sitio Web o la Plataforma Palantir para realizar o promover cualquier fraude o tergiversación (incluido, entre otros, el suministro de información fraudulenta o engañosa en respuesta al Formulario de Envío de Pedidos); o (q) utilizar o acceder al Servicio con el fin de realizar o apoyar actividades o comunicaciones de spam, o actividades o comunicaciones de marketing que infrinjan la Ley de Control del Asalto de Pornografía y Marketing No Solicitados (15 U.S.C. § 7701 et seq.), la Ley de Protección del Consumidor Telefónico (47 U.S.C. § 227) y todas las demás leyes aplicables que prohíban el spam o que regulen de otro modo la transmisión de materiales y/o comunicaciones de marketing. Sin perjuicio de lo anterior, o de cualquier declaración en contrario en el presente documento, el Contenido de Terceros puede estar disponible con avisos y licencias de código abierto o similares de dichas comunidades y terceros que rigen el uso de dichas partes, y el Cliente acepta por el presente documento estar vinculado a dichas licencias y cumplirlas en su totalidad; no obstante, las disposiciones de renuncia de garantía y limitación de responsabilidad del presente Contrato se aplicarán a todo dicho Contenido de Terceros.
6. Confidencialidad. Cada una de las Partes (la "Parte Receptora") mantendrá estrictamente confidencial toda la Información Confidencial de la otra Parte (la "Parte Reveladora"), y no utilizará dicha Información Confidencial excepto a los efectos del presente Acuerdo, y no revelará dicha Información Confidencial a ningún tercero salvo a los directores, empleados, agentes, abogados, contables, subcontratistas de u otros representantes de la Parte Receptora que estén sujetos a obligaciones de confidencialidad al menos tan restrictivas como las del presente documento ("Representantes Autorizados"). La Parte Receptora empleará al menos el mismo grado de cuidado que utiliza para evitar la divulgación de su propia información confidencial, pero en ningún caso menos que un cuidado razonable. La Parte Receptora podrá, sin incumplir las obligaciones del Acuerdo, revelar Información Confidencial en la medida en que lo exija una orden judicial o gubernamental válida, o lo exija la legislación aplicable, siempre que la Parte Receptora: (a) notifique por escrito a la Parte Reveladora con una antelación razonable dicha revelación y (b) realice esfuerzos razonables para limitar la revelación y obtener, o ayudar a la Parte Reveladora a obtener, un tratamiento confidencial o una orden de protección que impida o limite la revelación, permitiendo al mismo tiempo a la Parte Reveladora participar en el procedimiento. "Información Confidencial" significa (i) en el caso de Palantir, la Plataforma Palantir (incluida cualquier información relacionada con la misma); (ii) en el caso del Cliente, los Datos del Cliente; y (iii) cualquier otra información que, por la naturaleza de la información revelada o por la forma de su revelación, una persona razonable entendería que es confidencial, en cada caso, en cualquier forma (incluidas, entre otras, la electrónica o la oral) y tanto si se ha facilitado antes, durante o después de la Fecha de Entrada en Vigor; No obstante, la Información Confidencial no incluirá ninguna información que (1) sea o pase a ser de dominio público por acción u omisión de la Parte Receptora o sus Representantes Autorizados; (2) sea conocida por la Parte Receptora en la Fecha de Entrada en Vigor o en el momento de su divulgación por la Parte Divulgadora (según conste en registros escritos) sin obligación de mantenerla confidencial, lo que ocurra primero; (3) haya sido divulgada legítimamente a la Parte Receptora antes de la Fecha de Entrada en Vigor por otra fuente sin que el tercero divulgador haya violado la confidencialidad y sin restricción alguna a su divulgación o uso; o (4) la Parte Receptora pueda documentar mediante pruebas escritas que dicha información fue desarrollada de forma independiente sin ningún uso o referencia a la Información Confidencial. La Parte Receptora será responsable de cualquier incumplimiento de esta Sección por parte de cualquier persona o entidad a la que la Parte Receptora esté autorizada a revelar Información Confidencial en virtud de esta Sección. Las obligaciones de la Parte Receptora con respecto a la Información Confidencial sobrevivirán a la rescisión del presente Acuerdo durante cinco (5) años; no obstante, las obligaciones de la Parte Receptora en virtud del presente Acuerdo sobrevivirán a la rescisión y continuarán a perpetuidad, o durante el tiempo que permita la legislación aplicable, con respecto a cualquier Información Confidencial que sea un secreto comercial en virtud de la legislación aplicable.
7. Tarifas y pago; impuestos. El Servicio se considera prestado en el momento en que se proporciona acceso al Cliente o en beneficio del Cliente. Si existen tarifas fijas establecidas en el Formulario de solicitud de pedido, dichas tarifas se facturarán y abonarán por adelantado, o de cualquier otra forma establecida en el Formulario de solicitud de pedido. Cualquier tarifa basada en el uso establecida en el Formulario de envío de pedido, incluso si se paga en exceso de cualquier uso incluido aplicable especificado en el Formulario de envío de pedido, se calculará de acuerdo con las tarifas de uso establecidas en el Formulario de envío de pedido (según corresponda) y se facturará y pagará trimestralmente a mes vencido, o según se establezca de otro modo en el Formulario de envío de pedido. Todos los pagos se realizarán mediante transferencia bancaria a una cuenta designada por Palantir en la divisa indicada en la factura correspondiente, o mediante cualquier otro método de pago acordado por las Partes (incluido lo especificado en el Formulario de envío de pedido) y según lo establecido en la factura correspondiente, en un plazo de treinta (30) días a partir de la fecha de emisión de la factura de Palantir . Todo pago atrasado estará sujeto a un cargo por servicio equivalente al 1,5% mensual de la cantidad adeudada o a la cantidad máxima de intereses permitida por la legislación aplicable, el menor de los dos. A menos que se indique lo contrario en el Formulario de envío de pedido, las tarifas no incluyen los Impuestos aplicables (excepto los impuestos sobre los ingresos netos de Palantir o medidos en función de dichos ingresos). El Cliente será responsable de todos los Impuestos derivados del presente Acuerdo de modo que, tras el pago de dichos Impuestos, el importe que Palantir reciba no sea inferior a las tarifas establecidas en el Formulario de Envío de Pedido. En caso de que se aplique un tratado de doble imposición que establezca un tipo de retención fiscal cero o reducido, el Cliente acepta (a) no retener impuestos en caso de un tipo de retención fiscal cero o (b) retener al tipo impositivo reducido de conformidad con el tratado de doble imposición.
8. Vigencia y terminación; suspensión.
8.1 Vigencia; Rescisión por conveniencia. A menos que se especifique lo contrario en el Formulario de envío de pedido, el presente Contrato entrará en vigor en la Fecha de entrada en vigor y seguirá vigente en hasta que se rescinda según lo dispuesto en el presente documento (el "Plazo"); no obstante, si el Cliente es una persona física que accede a una instancia del Servicio de un Usuario principal como Usuario autorizado (o equivalente, según se identifique en el Formulario de envío de pedido), el Plazo seguirá en vigor hasta que caduque o se rescinda el acceso del Usuario principal al Servicio. Sin perjuicio de lo anterior, si se especifica lo contrario en el Formulario de envío de pedido, por "Plazo" se entenderá el período comprendido entre la Fecha de entrada en vigor y el vencimiento del plazo especificado en el Formulario de envío de pedido. Palantir podrá rescindir este Acuerdo por conveniencia, por cualquier motivo o sin él, en cualquier momento, previa notificación al Cliente de dicha rescisión con sesenta (60) días de antelación.
8.2 Rescisión por causa justificada. Sin limitar los demás derechos de cualquiera de las Partes, cualquiera de ellas podrá resolver el presente Acuerdo por causa justificada (a) en caso de incumplimiento sustancial por la otra Parte de cualquiera de las disposiciones del presente Acuerdo y de no subsanación del incumplimiento (y notificación por escrito de dicha subsanación a la Parte no incumplidora) en el plazo de treinta (30) días a partir de la notificación por escrito de dicho incumplimiento por parte de la Parte no incumplidora o (b) si la otra Parte solicita protección en virtud de cualquier procedimiento de quiebra, suspensión de pagos o similar, o si dicho procedimiento se incoa contra dicha Parte y no se desestima en el plazo de noventa (90) días. Salvo cuando se especifique un recurso exclusivo en el presente Acuerdo, el ejercicio por cualquiera de las Partes del derecho a resolver en virtud de la presente disposición se entenderá sin perjuicio de cualesquiera otros recursos que puedan corresponderle en virtud del presente Acuerdo o de la ley. En caso de rescisión del presente Acuerdo por parte del Cliente por causa justificada de conformidad con la Cláusula 8.2(a) o por parte de Palantir debido al incumplimiento por parte del Cliente de los Requisitos de Cumplimiento de Palantir, tal y como se establece en la Cláusula 8.4(c) (Suspensión de los Servicios), Palantir proporcionará un reembolso prorrateado de las tarifas prepagadas por los Servicios no utilizados a partir de la fecha efectiva de rescisión
8.3 Efecto de la rescisión. Tras la rescisión o el vencimiento del presente Acuerdo, salvo que se establezca específicamente lo contrario a continuación, todos los derechos, el acceso y las licencias del Cliente concedidos a la Plataforma Palantir cesarán inmediatamente y el Cliente devolverá o destruirá inmediatamente todo el Software de Conexión de Datos, los Materiales de Muestra y la Documentación, así como cualquier otra Información Confidencial de Palantir y, previa solicitud por escrito, certificará por escrito a Palantir el cumplimiento de lo anterior en un plazo de diez (10) días a partir de dicha solicitud. Tras la rescisión o el vencimiento del presente Acuerdo, si así lo solicita el Cliente, éste tendrá acceso al Servicio durante treinta (30) días, de conformidad con las condiciones del presente Acuerdo, con el único fin de recuperar los Datos del Cliente. A partir de ese momento, Palantir eliminará todos los Datos del Cliente. Sin perjuicio de lo anterior, Palantir conservará, con sujeción a las demás condiciones del presente Acuerdo y únicamente con fines de seguridad, la información de uso y los metadatos relacionados con la seguridad del Servicio, excluidos los Datos del cliente (excepto la información relacionada con la seguridad, como direcciones IP, nombres de usuario, intentos de inicio de sesión y consultas de búsqueda), durante un período de dos (2) años a partir del último evento registrado. Ninguna rescisión o expiración del presente Acuerdo limitará o afectará a los derechos u obligaciones devengados con anterioridad a la fecha efectiva de rescisión o expiración (incluidas, entre otras, las obligaciones de pago). Las secciones 1, 4 (excluida la sección 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14 y 15 seguirán vigentes tras la rescisión o expiración del presente Contrato.
8.4 Suspensión de los Servicios. Si Palantir determina razonablemente que: (a) Usted no tiene autorización para vincular al Cliente a este Acuerdo en nombre del Cliente (incumpliendo la declaración y garantía expresas del preámbulo de este Acuerdo); (b) el uso del Servicio, la Plataforma de Palantir o el Sitio web por parte del Cliente infringe la legislación aplicable o incumple de algún otro modo un término sustancial de este Acuerdo (incluidas la Sección 3.2 (Protección de datos), la Sección 4 (Uso aceptable), la Sección 5.3 (Restricciones), la Sección 6 (Confidencialidad) y la Sección 7 (Tarifas y pagos)); (c) el Cliente no satisface los Requisitos de cumplimiento de Palantir ; o (d) el Cliente ha incumplido alguna de las garantías establecidas en la Sección 11, Palantir se reserva el derecho a deshabilitar, suspender o cancelar el acceso del Cliente a la totalidad o parte del Sitio web y/o la Plataforma Palantir
9. Indemnización.
9.1 Indemnización de Palantir. Palantir defenderá al Cliente frente a cualquier reclamación por infracción o violación de cualquier Derecho de Propiedad Intelectual presentada contra el Cliente por un tercero basándose en el uso por parte del Cliente de la Plataforma Palantir de conformidad con los términos de este Acuerdo, e indemnizará y eximirá al Cliente de los costes razonables, los honorarios de abogados y los daños y perjuicios, si los hubiera, que finalmente se concedan contra el Cliente en virtud de una orden no apelable de un tribunal de jurisdicción competente en dicha reclamación o acuerdo alcanzado por Palantir. Si el uso por parte del Cliente de cualquiera de los elementos de la Plataforma Palantir es, o en opinión de Palantir es probable que sea, prohibido por un tribunal de jurisdicción competente debido al tipo de infracción especificado anteriormente, o si así lo exige un acuerdo aprobado por Palantir por escrito, Palantir podrá, a su entera discreción (a) sustituir los productos o servicios por otros sustancialmente similares desde el punto de vista funcional; (b) obtener para el Cliente el derecho a seguir utilizando la Plataforma Palantir; o (c) si Palantir determina razonablemente que las opciones (a) y (b) son comercialmente impracticables, rescindir el presente Acuerdo y reembolsar al Cliente una parte prorrateada de las tarifas pagadas en virtud del presente Acuerdo por la Plataforma Palantir rescindida que refleje la parte restante del Periodo de vigencia activa en el momento de la rescisión. Las anteriores obligaciones de indemnización de Palantir no se aplicarán (i) si la Plataforma Palantir es modificada por el Cliente o los Usuarios, o bajo sus instrucciones, pero solo en la medida en que la supuesta infracción no se hubiera producido de no ser por dicha modificación; (ii) si la Plataforma Palantir se combina con productos no autorizados por Palantir, pero solo en la medida en que la supuesta infracción no se hubiera producido de no ser por dicha combinación; (iii) a cualquier uso no autorizado de la Plataforma Palantir, cualquier uso que no sea coherente con la Documentación, cualquier uso que infrinja la Sección 4 (Uso aceptable), o el uso durante cualquier periodo de suspensión (tal y como se establece en la Sección 8.4); (iv) a cualquier uso no autorizado de la Plataforma Palantir, cualquier uso que no sea coherente con la Documentación, cualquier uso que infrinja la Sección 4 (Uso aceptable), o el uso durante cualquier periodo de suspensión (tal y como se establece en la Sección 8.4).4); (iv) a cualquier Dato del Cliente; o (v) a cualquier producto o servicio ajeno a Palantir
9.2 Indemnización del Cliente. El Cliente defenderá a Palantir frente a cualquier reclamación de terceros presentada contra Palantir que surja o esté relacionada con (a) la infracción de la legislación aplicable por parte del Cliente, (b) los Datos del Cliente, (c) el incumplimiento de la DPA por parte del Cliente, (d) el incumplimiento de la Sección 4 (Uso aceptable) por parte del Cliente, (e) el incumplimiento de la Sección 5.3 (Restricciones) por parte del Cliente o (f) cualquier producto o servicio ofrecido por el Cliente.3 (Restricciones), o (f) cualquier producto o servicio ofrecido por el Cliente (excepto si dicha reclamación es atribuible al Servicio ofrecido por Palantir) e indemnizará y mantendrá indemne a Palantir frente a los costes, honorarios de abogados y daños y perjuicios relacionados, si los hubiera, emitidos por una autoridad competente o concedidos finalmente en virtud de una orden no recurrible.
9.3 Procedimiento de indemnización. Las obligaciones de la Parte indemnizadora estarán condicionadas a que la Parte indemnizada proporcione a la Parte indemnizadora: (a) la pronta notificación por escrito (que en ningún caso excederá de veinte (20) días) de cualquier reclamación, pleito o demanda de la que tenga conocimiento; (b) el derecho a asumir la defensa y el control exclusivos de cualquier asunto que sea objeto de indemnización (siempre que la Parte indemnizadora no resuelva ninguna reclamación a menos que exima incondicionalmente a la Parte indemnizada de toda responsabilidad y no admita culpa o acto ilícito por parte de la Parte indemnizada); (c) cooperación con cualquier solicitud razonable que ayude a la Parte indemnizadora en su defensa y solución (a cargo de la Parte indemnizadora). Esta Sección establece la única responsabilidad y obligación de cada Parte y el único y exclusivo recurso con respecto a cualquier reclamación de infracción de los Derechos de Propiedad Intelectual.
10.1 Garantía de Palantir. Palantir garantiza que durante el Periodo de vigencia de (a) el Servicio se prestará sustancialmente de acuerdo con la Documentación aplicable y (b) los Servicios profesionales se prestarán de forma profesional y diligente. En caso de incumplimiento de una de las garantías anteriores, el Cliente podrá notificar por escrito a Palantir la rescisión del presente Acuerdo, que será efectiva treinta (30) días después de la recepción de la notificación por parte de Palantir, a menos que Palantir pueda subsanar el incumplimiento antes de la fecha efectiva de rescisión. Esta garantía no se aplicará en la medida en que dicho incumplimiento esté causado por los Datos del Cliente o el uso indebido o la modificación no autorizada del Servicio (incluida, entre otras, la infracción por parte del Cliente de la Sección 4 (Uso aceptable)) o de cualquier hardware seleccionado por el Cliente y utilizado en relación con el Servicio. En caso de rescisión del presente Acuerdo en virtud del ejercicio por parte del Cliente de su derecho en virtud de esta Sección, el Cliente tendrá derecho a recibir de Palantir, como único y exclusivo recurso, el reembolso de una parte prorrateada de las tarifas pagadas en virtud del presente Acuerdo que refleje la parte restante del Plazo activa en el momento de la rescisión
10.2 descargo de responsabilidad. NINGUNA CANTIDAD PAGADA EN VIRTUD DEL PRESENTE DOCUMENTO ES REEMBOLSABLE O COMPENSABLE, SALVO QUE SE ESTABLEZCA EXPLÍCITAMENTE LO CONTRARIO EN EL PRESENTE DOCUMENTO. SALVO QUE SE ESTABLEZCA EXPRESAMENTE LO CONTRARIO EN EL PRESENTE DOCUMENTO, Y SÓLO EN LA MEDIDA MÁXIMA PERMITIDA POR LA LEGISLACIÓN APLICABLE, LA PLATAFORMA PALANTIR Y LOS SERVICIOS PROFESIONALES SE PROPORCIONAN "TAL CUAL" SIN NINGUNA OTRA GARANTÍA DE NINGÚN TIPO, Y PALANTIR Y SUS PROVEEDORES Y PRESTADORES DE SERVICIOS RENUNCIAN POR EL PRESENTE DOCUMENTO A TODAS LAS GARANTÍAS DE CUALQUIER TIPO, YA SEAN EXPRESAS O IMPLÍCITAS, ORALES O ESCRITAS, RELATIVAS A LA PLATAFORMA PALANTIR Y A LOS SERVICIOS PROFESIONALES PRESTADOS EN VIRTUD DEL PRESENTE DOCUMENTO O DE CUALQUIER OTRO MODO, INCLUIDAS, A TÍTULO MERAMENTE ENUNCIATIVO Y NO LIMITATIVO, LAS GARANTÍAS DE NO INFRACCIÓN, COMERCIABILIDAD, TITULARIDAD O IDONEIDAD PARA UN FIN DETERMINADO. SIN PERJUICIO DE LA LIMITACIÓN ANTERIOR, PALANTIR NO GARANTIZA QUE LA PLATAFORMA PALANTIR Y LOS SERVICIOS PROFESIONALES SATISFAGAN LOS REQUISITOS DEL CLIENTE NI GARANTIZA NINGÚN RESULTADO, CONSECUENCIA O CONCLUSIÓN, NI QUE EL FUNCIONAMIENTO DEL SERVICIO SEA ININTERRUMPIDO O ESTÉ LIBRE DE ERRORES. PALANTIR NO SE HACE RESPONSABLE DE LOS SERVICIOS DE TERCEROS (INCLUIDOS, ENTRE OTROS, GARANTÍAS DE TIEMPO DE ACTIVIDAD, INTERRUPCIONES O FALLOS), LOS DATOS DE LOS CLIENTES O CUALQUIER CONTENIDO DE TERCEROS. PALANTIR NO CONTROLA LA TRANSFERENCIA DE INFORMACIÓN O DATOS DEL CLIENTE A TRAVÉS DE LAS INSTALACIONES DE COMUNICACIONES, INTERNET O LOS SERVICIOS DE TERCEROS, Y EL SERVICIO PUEDE ESTAR SUJETO A RETRASOS Y OTROS PROBLEMAS INHERENTES AL USO DE DICHAS INSTALACIONES DE COMUNICACIONES. PALANTIR NO SE HACE RESPONSABLE DE LOS RETRASOS, FALLOS U OTROS DAÑOS DERIVADOS DE DICHOS PROBLEMAS.
11. Garantía del Cliente. El Cliente garantiza que (a) ha proporcionado todas las notificaciones necesarias y ha obtenido todos los consentimientos, autorizaciones, aprobaciones y/o acuerdos necesarios, según lo exigido por cualquier ley o política aplicable, y ha informado a Palantir de cualquier obligación aplicable al procesamiento de los Datos del Cliente por parte de Palantir, con el fin de permitir a Palantir procesar los Datos del Cliente, incluidos los datos personales, de acuerdo con el alcance, la finalidad y las instrucciones especificadas por el Cliente, y que el Cliente no dirigirá el procesamiento de los Datos del Cliente por parte de Palantir infringiendo ninguna ley o normativa (incluidos los requisitos de localización) ni los derechos de terceros; (b) no utilizará el Servicio para fines no autorizados o ilegales; y (c) no cargará ni importará Datos del cliente al Servicio que requieran documentación adicional sin ejecutar previamente dicha documentación. Todos los Datos del cliente que el Cliente integre, utilice o ponga a disposición de cualquier otra forma en el Servicio o a través de él, así como las conclusiones que se extraigan de los mismos, se realizan por cuenta y riesgo del Cliente, que será el único responsable de cualquier daño o pérdida que se derive de los mismos.
12. Limitaciones de responsabilidad. EN LA MEDIDA MÁXIMA PERMITIDA POR LA LEGISLACIÓN APLICABLE, Y SIN PERJUICIO DE CUALQUIER OTRA DISPOSICIÓN DEL PRESENTE ACUERDO, NINGUNA DE LAS PARTES SERÁ RESPONSABLE ANTE LA OTRA PARTE O SUS FILIALES POR (A) EL COSTE DE ADQUISICIÓN DE CUALQUIER PRODUCTO O SERVICIO SUSTITUTIVO, O EL COSTE DE SUSTITUCIÓN O RESTAURACIÓN DE CUALQUIER DATO DEL CLIENTE, (B) PÉRDIDAS ECONÓMICAS, BENEFICIOS ESPERADOS O PERDIDOS, INGRESOS O AHORROS PREVISTOS, (B) PÉRDIDAS ECONÓMICAS, BENEFICIOS ESPERADOS O PERDIDOS, INGRESOS O AHORROS PREVISTOS, PÉRDIDA DE NEGOCIO, PÉRDIDA DE CONTRATOS, PÉRDIDA O DAÑO A LA BUENA VOLUNTAD O REPUTACIÓN, Y/O (C) PÉRDIDAS O DAÑOS INDIRECTOS, ESPECIALES, INCIDENTALES, PUNITIVOS O CONSECUENTES, YA SEA QUE SURJAN DEL CUMPLIMIENTO O INCUMPLIMIENTO DE ESTE ACUERDO O DEL USO O IMPOSIBILIDAD DE USO DE LA PLATAFORMA PALANTIR, INCLUSO SI LA PARTE HA SIDO ADVERTIDA SOBRE LA POSIBILIDAD DE TALES PÉRDIDAS O DAÑOS. A EXCEPCIÓN DE LAS OBLIGACIONES DE LAS PARTES ESTABLECIDAS EN LAS SECCIONES 5 Y 9.2 DE ESTE ACUERDO Y LAS OBLIGACIONES DE PAGO DEL CLIENTE EN VIRTUD DEL PRESENTE, EN LA MEDIDA MÁXIMA PERMITIDA POR LA LEGISLACIÓN APLICABLE, CADA PARTE ACUERDA QUE LA RESPONSABILIDAD TOTAL MÁXIMA DE CUALQUIERA DE LAS PARTES Y SUS FILIALES FRENTE A LA OTRA PARTE Y SUS FILIALES POR TODAS LAS RECLAMACIONES DE CUALQUIER TIPO NO SUPERARÁ LA MAYOR DE LAS SIGUIENTES CANTIDADES A) LAS TARIFAS PAGADAS O PAGADERAS A PALANTIR POR EL CLIENTE EN VIRTUD DEL ACUERDO EN LOS DOCE (12) MESES ANTERIORES A LA RECLAMACIÓN POR EL SERVICIO O LOS SERVICIOS PROFESIONALES QUE DIERON LUGAR A DICHA RECLAMACIÓN O B) CIEN MIL DÓLARES (USD 100.000), Y QUE DICHA COMPENSACIÓN ES JUSTA Y ADECUADA . NO OBSTANTE LA FRASE ANTERIOR, SI EL CLIENTE NO DEBE ABONAR HONORARIOS DURANTE EL PERIODO DE VIGENCIA, A EXCEPCIÓN DE LAS OBLIGACIONES DE LAS PARTES ESTABLECIDAS EN LAS SECCIONES 5 Y 9.2 DEL PRESENTE ACUERDO Y LAS OBLIGACIONES DE PAGO DEL CLIENTE EN VIRTUD DEL PRESENTE, EN LA MEDIDA MÁXIMA PERMITIDA POR LA LEGISLACIÓN APLICABLE, CADA PARTE ACUERDA QUE LA RESPONSABILIDAD TOTAL MÁXIMA DE CUALQUIERA DE LAS PARTES Y SUS FILIALES FRENTE A LA OTRA PARTE Y SUS FILIALES POR TODAS LAS RECLAMACIONES DE CUALQUIER TIPO NO SUPERARÁ LOS CINCUENTA MIL DÓLARES (USD 50.000), Y QUE DICHA COMPENSACIÓN ES JUSTA Y ADECUADA. LAS LIMITACIONES ESTABLECIDAS EN ESTA SECCIÓN 12 SE APLICARÁN INDEPENDIENTEMENTE DE SI UNA ACCIÓN SE BASA EN UN CONTRATO, AGRAVIO (INCLUYENDO NEGLIGENCIA), RESPONSABILIDAD ESTRICTA O CUALQUIER OTRA TEORÍA LEGAL O EQUITATIVA.
13. RESOLUCIÓN DE DISPUTAS. CUALQUIER DISPUTA, CONTROVERSIA O RECLAMACIÓN DERIVADA O RELACIONADA CON EL PRESENTE CONTRATO, INCLUIDA LA ARBITRABILIDAD, QUE NO PUEDA RESOLVERSE TRAS CONVERSACIONES DE BUENA FE EN UN PLAZO DE SESENTA (60) DÍAS TRAS LA NOTIFICACIÓN DE UNA DISPUTA, SE RESOLVERÁ DEFINITIVAMENTE MEDIANTE ARBITRAJE. EL DERECHO APLICABLE SERÁ EL DERECHO SUSTANTIVO DEL ESTADO DE NUEVA YORK, SIN TENER EN CUENTA LAS DISPOSICIONES SOBRE CONFLICTOS DE LEYES DEL MISMO, Y EL ARBITRAJE SE ADMINISTRARÁ EN NUEVA YORK, NUEVA YORK, ESTADOS UNIDOS, DE CONFORMIDAD CON LAS NORMAS Y PROCEDIMIENTOS GENERALES DE ARBITRAJE DE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. ("JAMS") Y LAS NORMAS FEDERALES SOBRE PRUEBAS (SIN PERJUICIO DE LA NORMA 22(D) DE JAMS O DE CUALQUIER OTRA NORMA DE JAMS QUE DISPONGA LO CONTRARIO). LAS PARTES ACUERDAN ABORDAR EL ARBITRAJE ÚNICAMENTE DE FORMA INDIVIDUAL, Y ESTE ACUERDO NO PERMITE EL ARBITRAJE COLECTIVO NI NINGUNA RECLAMACIÓN PRESENTADA COMO DEMANDANTE O MIEMBRO COLECTIVO EN NINGÚN PROCEDIMIENTO DE ARBITRAJE COLECTIVO, REPRESENTATIVO, PAGA, CONJUNTO O REPRESENTATIVO. EL TRIBUNAL ARBITRAL NO PODRÁ CONSOLIDAR LAS DEMANDAS DE MÁS DE UNA PERSONA Y NO PODRÁ PRESIDIR NINGUNA FORMA DE PROCEDIMIENTO REPRESENTATIVO O COLECTIVO. SIN PERJUICIO DE LO ANTERIOR, CADA UNA DE LAS PARTES TENDRÁ DERECHO A INTERPONER EN CUALQUIER MOMENTO UNA DEMANDA ANTE UN TRIBUNAL COMPETENTE PARA OBTENER MEDIDAS CAUTELARES PRELIMINARES A LA ESPERA DE LA DECISIÓN FINAL DEL ÁRBITRO O ÁRBITROS, SIEMPRE QUE (A) LA PARTE QUE INTERPONGA LA DEMANDA SOLICITE UNA ORDEN PARA PRESENTAR LA DEMANDA BAJO SELLO (O AL MENOS ASÍ LO HAGA PARA CUALQUIER PRESENTACIÓN QUE CONTENGA INFORMACIÓN CONFIDENCIAL O SECRETOS COMERCIALES) CON EL FIN DE LIMITAR LA DIVULGACIÓN SEGÚN LO DISPUESTO EN LA SECCIÓN 6 DEL PRESENTE ACUERDO; Y (B) EL ÁRBITRO O ÁRBITROS SÓLO CONCEDERÁN UNA MEDIDA CAUTELAR PERMANENTE Y UNA INDEMNIZACIÓN POR DAÑOS Y PERJUICIOS.
14.1 Actualizaciones del presente Acuerdo. Palantir se reserva el derecho a modificar este Acuerdo en cualquier momento y lo actualizará en caso de que se produzcan dichas modificaciones. Palantir notificará al Cliente los cambios a posteriori de este Acuerdo mediante la publicación de un aviso en el Sitio web y/o el envío de un correo electrónico a la dirección de correo electrónico principal especificada en un Formulario de envío de pedido aplicable o en la Cuenta del Cliente. Cualquier modificación de este Acuerdo entrará en vigor treinta (30) días después de que Palantir envíe dicha notificación. El uso continuado de la Plataforma Palantir por parte del Cliente en los treinta (30) días posteriores a la fecha en que Palantir envíe la notificación anterior constituye la aceptación de dichas revisiones del presente Acuerdo. Para cualquier otra modificación, el uso continuado de la Plataforma Palantir por parte del Cliente constituye la aceptación de nuestras revisiones del presente Acuerdo. Palantir se reserva el derecho a modificar en cualquier momento y ocasionalmente (incluida la eliminación de funcionalidades o herramientas), de forma temporal o permanente, la Plataforma Palantir (o cualquier parte de la misma)
15. Varios. Palantir prestará el Servicio y los Servicios profesionales de conformidad con las leyes y normativas aplicables a la prestación por parte de Palantir de dicho Servicio y Servicios profesionales en general, incluidas, entre otras, las relativas a la protección de datos y las transferencias internacionales de datos personales, sin tener en cuenta la utilización específica del Servicio por parte del Cliente, excepto en la medida establecida en el Formulario de envío de pedido, y sujeto al cumplimiento del presente Acuerdo por parte del Cliente. Las Partes cumplirán el Anexo de AIP de Palantir disponible en https://palantir.pactsafe.io/aip-legal-3791.html, que se incorpora por referencia en el presente documento. Salvo previo consentimiento por escrito de Palantir, ni el presente Acuerdo ni el acceso o las licencias concedidos en virtud del mismo podrán ser cedidos, transferidos o sublicenciados por el Cliente, incluyendo, sin limitación, en virtud de un cambio de control del Cliente o de la venta de todos o prácticamente todos los activos del Cliente; cualquier intento de hacerlo será nulo. Palantir podrá ceder o delegar este Acuerdo, en su totalidad o en parte, a cualquier persona o entidad en cualquier momento, con o sin el consentimiento del Cliente. Palantir podrá rescindir este Acuerdo en caso de cambio de control del Cliente o de venta de todos o prácticamente todos los activos del Cliente. Palantir podrá subcontratar este Acuerdo o partes del mismo. Cualquier notificación requerida o permitida en virtud del presente Acuerdo deberá enviarse por escrito al Cliente a la(s) dirección(es) indicada(s) en el Formulario de envío de pedido y, si se realiza por correo electrónico, las notificaciones a Palantir deberán enviarse alegalnotices@palantir.com o 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). Si alguna de las disposiciones de este Acuerdo fuera declarada inaplicable o inválida por un tribunal de jurisdicción competente, dicha disposición se limitará o eliminará en la medida mínima necesaria para que este Acuerdo siga siendo plenamente vigente y aplicable. Ninguna renuncia a un incumplimiento se considerará una renuncia a un incumplimiento posterior. El Servicio y los Servicios profesionales están sujetos al control de las leyes y reglamentos de exportación y sanciones de EE.UU., incluidos los Reglamentos de Administración de Exportaciones de EE.UU. ("EAR") administrados por la Oficina de Industria y Seguridad ("BIS") del Departamento de Comercio y los reglamentos de embargo y sanciones administrados por la Oficina de Control de Activos Extranjeros ("OFAC") del Departamento del Tesoro de EE.UU.. El Servicio controlado bajo 5D002.c.1, ENC. El Cliente se asegurará de que todas las exportaciones, reexportaciones, transferencias, usos finales y Usuarios del Servicio cumplan las leyes y normativas sobre exportación y sanciones de los Estados Unidos y otras jurisdicciones aplicables, incluidas, entre otras, las de la Oficina de Industria y Seguridad de los Estados Unidos y la Oficina de Control de Activos Extranjeros. El Cliente declara que no está sujeto a restricciones en virtud de ninguna lista de usuarios finales restringidos del gobierno de EE. UU., y que no es propiedad ni está controlado en un 50% o más, directa o indirectamente, por ninguna persona o entidad identificada en dichas listas. El Cliente notificará inmediatamente a Palantir si queda sujeto a alguna de dichas restricciones. El Cliente se abstendrá de realizar cualquier acción que provoque que Palantir infrinja las leyes y normativas aplicables en materia de exportación y sanciones. Excepto por la obligación de pagar dinero, ninguna de las Partes será responsable de ningún incumplimiento o retraso en virtud del presente Acuerdo debido a cualquier causa que escape a su control razonable , incluidos, entre otros, actos de guerra, casos fortuitos, terremotos, inundaciones, embargos, disturbios, sabotajes, escasez o conflicto laboral, actos gubernamentales o fallos de Internet, telecomunicaciones o del proveedor de servicios de alojamiento, ataques informáticos o actos malintencionados; siempre que la Parte que haya sufrido el retraso (a) notifique inmediatamente a la otra Parte dicha causa; y (b) realice esfuerzos comercialmente razonables para corregir rápidamente dicho incumplimiento o retraso en el cumplimiento. Palantir tiene derecho a suspender inmediatamente el acceso al Servicio: (a) si el Cliente incumple sustancialmente este Acuerdo; (b) para evitar un incidente de seguridad que afecte al Cliente, al Contenido del Cliente o al Servicio; o (c) si el acceso continuado infringe las leyes aplicables o si así se requiere en virtud de las leyes o normativas aplicables o de solicitudes u órdenes de autoridades gubernamentales, reguladoras o judiciales. No existen terceros beneficiarios en virtud del presente Acuerdo, ya sea de forma expresa o implícita. Para evitar cualquier duda, nada de lo dispuesto en el presente Acuerdo se interpretará como la creación de una empresa conjunta, empleo, asociación, alianza estratégica, alianza formal o relación de asociación estratégica entre las Partes. El presente Acuerdo constituye la declaración completa y exclusiva del entendimiento mutuo de las Partes y sustituye y anula todos los acuerdos y comunicaciones anteriores, tanto escritos como orales, relativos al objeto del presente Acuerdo. En caso de conflicto entre estas Condiciones de servicio y cualquier Formulario de envío de pedido o anexo, prevalecerán los términos de dicho Formulario de envío de pedido o anexo. Palantir no está afiliada en modo alguno a The Saul Zaentz Company d.b.a. Tolkien Enterprises ni al Patrimonio de J.R.R. Tolkien, ni cuenta con su respaldo o patrocinio.
ADENDA ESPECÍFICA POR PAÍS
Para los Clientes ubicados en cualquiera de los países identificados en este Anexo específico por país (el "Anexo") y para quienes las Condiciones de servicio de Palantir ("Condiciones de servicio") no se rijan por la legislación de Nueva York (por ejemplo, debido a que la disposición sobre elección de legislación de la Sección 13 de las Condiciones de servicio no sea efectiva en virtud de la legislación aplicable), las siguientes disposiciones específicas por país sustituirán o complementarán las disposiciones equivalentes de las Condiciones de servicio, tal y como se indica. Los términos en mayúsculas utilizados en el presente Anexo que no se definan en el mismo tendrán el mismo significado que se les atribuye en las Condiciones del servicio.
ESPAÑA
1. Condiciones en el idioma local. Una copia de estas Condiciones del servicio traducidas al español está disponible en: https://palantir.pactsafe.io/aip-now-6493.html#spa-aip-now-tos-251605 (las "Condiciones en español"). Para evitar cualquier duda, en caso de conflicto o incoherencia entre las anteriores Condiciones en español y esta versión en inglés (disponible en https://palantir.pactsafe.io/aip-now-6493.html#aip-now-tos-899513) de las Condiciones del servicio, prevalecerá la versión en inglés. Una copia del DPA traducido al español está disponible en https://palantir.pactsafe.io/aip-now-6493.html#spa-aip-now-dpa-051625 (el “DPA en español”). Para evitar cualquier duda, en caso de conflicto o inconsistencia entre el DPA en español anterior y la versión en inglés del DPA, prevalecerá y regirá la versión en inglés del DPA.
2. Resolución de conflictos. La sección 13 de las Condiciones de servicio se suprime en su totalidad y se sustituye por el texto siguiente:
"13.RESOLUCIÓN DE DISPUTAS. CUALQUIER DISPUTA, CONTROVERSIA O RECLAMACIÓN DERIVADA DE ESTE ACUERDO O RELACIONADA CON EL MISMO, INCLUIDA LA ARBITRABILIDAD, QUE NO PUEDA RESOLVERSE TRAS CONVERSACIONES DE BUENA FE EN UN PLAZO DE SESENTA (60) DÍAS TRAS LA NOTIFICACIÓN DE UNA DISPUTA, SE RESOLVERÁ DEFINITIVAMENTE DE LA SIGUIENTE MANERA. EL DERECHO APLICABLE SERÁ EL DERECHO SUSTANTIVO DE ESPAÑA, INDEPENDIENTEMENTE DE LAS DISPOSICIONES SOBRE CONFLICTOS DE LEYES. TODAS LAS DISPUTAS QUE SURJAN DE ESTE ACUERDO O EN RELACIÓN CON EL MISMO SERÁN RESUELTAS POR UN TRIBUNAL DE ESPAÑA CON JURISDICCIÓN COMPETENTE SOBRE EL LUGAR DE DOMICILIO DEL CLIENTE EN ESPAÑA (Y SI EL CLIENTE NO TIENE DOMICILIO EN ESPAÑA, SERÁN COMPETENTES LOS TRIBUNALES DE MADRID), CON PROCEDIMIENTOS EN INGLÉS."
Effective May 16th 2025 to May 16th 2025
DownloadTable of Contents
PALANTIR AIP NOW CONDICIONES DEL SERVICIO
AL SELECCIONAR "ACEPTO" (O EQUIVALENTE) CUANDO DICHA OPCIÓN ESTÉ DISPONIBLE, O AL INSTALAR, EJECUTAR, DESCARGAR, ACCEDER O UTILIZAR DE CUALQUIER OTRO MODO CUALQUIER PARTE DE LA PLATAFORMA PALANTIR (SEGÚN SE DEFINE MÁS ADELANTE), USTED CONFIRMA QUE ("USTED" O "SU" O "USUARIO AUTORIZADO") HA LEÍDO ESTE ACUERDO (SEGÚN SE DEFINE MÁS ADELANTE), QUE COMPRENDE LOS TÉRMINOS DEL ACUERDO, Y QUE USTED Y (SI PROCEDE) LA ENTIDAD A LA QUE REPRESENTA CONSIENTEN INCONDICIONALMENTE EN QUEDAR VINCULADOS POR ESTE ACUERDO Y SE CONVIERTEN EN PARTE DEL MISMO, EL CUAL, PARA EVITAR CUALQUIER DUDA, CONTIENE LA SECCIÓN 13 RELATIVA AL ARBITRAJE OBLIGATORIO Y VINCULANTE DE DISPUTAS, LA SECCIÓN 4 RELATIVA AL USO ACEPTABLE Y LA SECCIÓN 9.2 RELATIVA A LAS INDEMNIZACIONES DEL CLIENTE.2 RELATIVA A LAS INDEMNIZACIONES DEL CLIENTE. SI CELEBRA ESTE ACUERDO EN NOMBRE DE UNA ENTIDAD, COMO LA EMPRESA, ORGANIZACIÓN O INSTITUCIÓN EDUCATIVA PARA LA QUE TRABAJA, DECLARA Y GARANTIZA QUE ESTÁ AUTORIZADO A ACEPTAR LOS TÉRMINOS DE ESTE ACUERDO EN NOMBRE DE LA ENTIDAD COMO SU REPRESENTANTE LEGAL AUTORIZADO. SI NO ACEPTA INCONDICIONALMENTE TODOS LOS TÉRMINOS DE ESTE ACUERDO, NO SELECCIONE "ACEPTO" CUANDO DICHA OPCIÓN ESTÉ DISPONIBLE Y NO INSTALE, EJECUTE, DESCARGUE, ACCEDA NI UTILICE DE NINGÚN OTRO MODO NINGUNA PARTE DE LA PLATAFORMA PALANTIR.
LA ACEPTACIÓN DE PALANTIR ESTÁ EXPRESAMENTE CONDICIONADA A SU CONFORMIDAD CON TODOS LOS TÉRMINOS Y CONDICIONES DE ESTE ACUERDO, CON EXCLUSIÓN DE TODOS LOS DEMÁS TÉRMINOS; SI ESTOS TÉRMINOS SE CONSIDERAN UNA OFERTA, LA ACEPTACIÓN ESTÁ EXPRESAMENTE LIMITADA A ESTOS TÉRMINOS.
PALANTIR AIP NOW ACTUALMENTE SÓLO ESTÁ DISPONIBLE PARA CLIENTES Y USUARIOS UBICADOS EN LOS ESTADOS UNIDOS, CANADÁ, LA REPÚBLICA DE LA INDIA, LA REPÚBLICA FEDERAL DE ALEMANIA, LOS PAÍSES BAJOS, ESPAÑA, AUSTRIA O EL REINO UNIDO. POR CONSIGUIENTE, DEBE PRESENTAR UNA IDENTIFICACIÓN (EN EL FORMULARIO DE ENVÍO DEL PEDIDO, TAL Y COMO SE DEFINE A CONTINUACIÓN) EMITIDA POR LOS ESTADOS UNIDOS (O SU ESTADO), CANADÁ, LA REPÚBLICA DE LA INDIA, LOS PAÍSES BAJOS, ESPAÑA, AUSTRIA, O EL REINO UNIDO PARA RECIBIR ACCESO A PALANTIR AIP NOW, Y NO PODRÁ ACCEDER NI UTILIZAR PALANTIR AIP NOW SI SE ENCUENTRA FUERA DE LOS ESTADOS UNIDOS, CANADÁ, LA REPÚBLICA DE LA INDIA, LA REPÚBLICA FEDERAL DE ALEMANIA, LOS PAÍSES BAJOS, ESPAÑA, AUSTRIA, O EL REINO UNIDO.
El presente Acuerdo se celebra entre el Cliente (tal y como se define a continuación) y Palantir (cada una de ellas una "Parte" y colectivamente las "Partes") y entra en vigor a partir de la fecha en la que Usted seleccione "ACEPTO" (o equivalente) en el Formulario de envío de pedidos cuando Palantir ponga a disposición dicha opción (la "Fecha de entrada en vigor").
1.1 "Afiliada" significa una entidad que, directa o indirectamente, posea o controle o sea propiedad o esté controlada por, o esté bajo propiedad o control común con, una Parte a partir de la Fecha de Entrada en Vigor y mientras dicha entidad siga siendo propiedad o esté controlada directa o indirectamente por la Parte. Tal y como se utiliza en el presente documento, "control" significa el poder de dirigir, directa o indirectamente, la gestión o los asuntos de una entidad y "propiedad" significa la titularidad efectiva de más del cincuenta por ciento de las acciones con derecho a voto u otras participaciones equivalentes con derecho a voto de una entidad.
1.2 "Acuerdo" hace referencia, de forma colectiva, a las presentes Condiciones de servicio de Palantir AIP Now y a todos los anexos, apéndices, condiciones, avisos, normas de funcionamiento, políticas (incluida la Política de privacidad de Palantir), exposiciones, anexos o documentos incorporados por referencia o hipervínculos en el presente documento (que pueden actualizarse ocasionalmente de conformidad con la Sección 13 del presente documento) o que podamos publicar ocasionalmente en el Sitio web o en las Cuentas del Cliente, así como a todos los documentos de pedido suscritos entre Palantir y el Cliente que hagan referencia al presente Acuerdo, incluido el Formulario de envío de pedido.
1.3 "Cliente" significa el cliente identificado en el Formulario de Envío de Pedido que es Parte de este Acuerdo, en nombre del cual Usted está aceptando los términos de este Acuerdo como su representante legal.
1.4 "Datos del Cliente" hace referencia a cualquier dato (incluidas las versiones agregadas o transformadas de los mismos y los resultados analíticos), modelo, algoritmo, análisis, código de transformación u otro contenido proporcionado por un tercero, ya sea directa o indirectamente, o creado por el Cliente, o por Usuarios que utilicen el Servicio o el Sitio Web, para su integración, uso u otro tipo de procesamiento en el Servicio o a través de él. Los Datos del Cliente excluyen los Datos de Uso.
1.5 "Software de conexión de datos" hace referencia al software de Palantir proporcionado para su instalación local para que el Cliente conecte los Datos del Cliente al Servicio.
1.6 "Documentación" hace referencia a cualquier documentación técnica para el Servicio que se ponga a disposición en relación con el Servicio, incluida la documentación técnica relevante para el Servicio disponible en https://www.palantir.com/docs/, actualizada cada cierto tiempo a discreción exclusiva de Palantir.
1.7 "Derechos de Propiedad Intelectual" significa todos los derechos, títulos e intereses sobre cualquier secreto comercial, patentes, derechos de autor, marcas de servicio, marcas registradas, know-how, nombres comerciales, derechos de imagen comercial y embalaje, derechos morales, derechos de privacidad, derechos de publicidad y cualquier derecho similar, incluyendo cualquier solicitud, continuación o registro con respecto a lo anterior, en virtud de las leyes o reglamentos de cualquier autoridad gubernamental, reguladora o judicial.
1.8 "Formulario de envío de pedido" hace referencia al formulario web (o documento que incorpore expresamente este Acuerdo por referencia) cumplimentado y/o ejecutado por Usted para incluir la información del Cliente y especificar el Servicio y/o los Servicios profesionales (si procede) que se prestarán en virtud del presente y que Usted envía en nombre del Cliente a Palantir.
1.9 "Palantir", a menos que se especifique expresamente lo contrario en un Formulario de Envío de Pedido, significa (a) Palantir Technologies Inc. si la ubicación principal de uso del Cliente es Estados Unidos, Canadá, la República Federal de Alemania, Países Bajos, España, Austria o la República de la India; o (b) Palantir Technologies UK, Ltd., si la ubicación principal de uso del Cliente es Reino Unido. si la ubicación principal de uso del Cliente es el Reino Unido. Sin perjuicio de lo anterior, (x) si la sede (es decir, el centro de actividad principal) de la entidad matriz última del Cliente se encuentra en la República de Corea, "Palantir" significa Palantir Korea LLC. Si no se aplican ni (a), ni (b), ni (x), "Palantir" significa Palantir Technologies Inc.
1.10 "Plataforma Palantir" hace referencia al Servicio, la Documentación, el Software de Conexión de Datos, los Materiales de Muestra, el Sitio Web, los modelos y las interfaces de programación de aplicaciones (API), proporcionados o puestos a disposición del Cliente como un servicio en relación con el presente Acuerdo, así como a cualquier mejora, modificación, obra derivada, parche, mejora y actualización de los mismos.
1.11 "Política de Privacidad de Palantir" hace referencia a cualquier política específica de privacidad disponible en el Sitio Web y/o accesible a través del Formulario de Envío de Pedidos.
1.12 "Materiales de muestra" hace referencia a cualquier tecnología y material proporcionado o puesto a disposición del Cliente por Palantir para su uso con el Servicio, incluidos el código de muestra, las bibliotecas de software, las herramientas de línea de comandos, el código de integración de datos, las plantillas y los archivos de configuración.
1.13 "Servicio" hace referencia al acceso de software como servicio a Palantir AIP Now (o a la(s) plataforma(s) que pueda(n) especificarse en un Formulario de envío de pedido).
1.14 "Impuestos" significa cualquier impuesto aplicable sobre ventas, uso, transacción, valor añadido, bienes y servicios, impuesto armonizado sobre ventas, impuesto de retención, impuesto especial o impuestos similares, y cualquier tasa o cargo extranjero, provincial, federal, estatal o local (incluidas, entre otras, las tasas medioambientales o similares), derechos, costes de cumplimiento de los controles y reglamentos de exportación e importación, y otros gravámenes gubernamentales, incluidas las sanciones e intereses correspondientes, impuestos sobre, con respecto a o asociados de otro modo con cualquier transacción en virtud del presente documento.
1.15 "Contenido de terceros" hace referencia a los datos, servicios o aplicaciones de terceros que interoperan con el Servicio y que Palantir puede, a criterio exclusivo del Cliente, facilitar el uso en relación con el Servicio y sujeto a un acuerdo independiente entre el Cliente y dicho tercero.
1.16 "Servicios de Terceros" hace referencia a los servicios de terceros que Palantir puede utilizar en la prestación del Servicio, tal y como se establece en la Documentación (o según acuerden las Partes).
1.17 "Sitio web" hace referencia a WWW.PALANTIR.COM o a cualquier otro dominio propiedad de Palantir, incluido cualquier subdominio de los anteriores, y a todo el software, las aplicaciones, los productos, el contenido y los servicios proporcionados por Palantir en el Sitio web o a través de él.
2. Prestación del servicio.
2.1 Acceso al Servicio. Palantir pondrá el Servicio a disposición del Cliente, sujeto a la condición subsiguiente establecida en la Cláusula 2.8, durante el Periodo de vigencia aplicable únicamente para su uso por parte del Cliente y sus Usuarios de conformidad con los términos y condiciones del presente Acuerdo y la Documentación para fines empresariales internos (y/o, si procede, personales) del Cliente, o (si procede) según se estipule explícitamente de otro modo en un Formulario de envío de pedido
2.2 Licencia de Software de Conexión de Datos. Si es aplicable para el uso del Servicio, y sujeto a la condición posterior establecida en la Sección 2.8, Palantir concede al Cliente durante el Periodo de vigencia una licencia limitada, no exclusiva, intransferible y no sublicenciable para utilizar el Software de Conexión de Datos con el único fin de utilizar y conectarse al Servicio. El Cliente permitirá a Palantir acceder al Software de Conexión de Datos de forma remota según sea necesario para prestar el Servicio.
2.3 Licencia de Materiales de Muestra. Palantir puede poner a disposición del Cliente Materiales de muestra para su uso durante el Periodo de vigencia. Si procede, y sujeto a la condición posterior establecida en la Sección 2.8, Palantir concede al Cliente durante el Periodo de vigencia una licencia limitada, no exclusiva, intransferible y no sublicenciable para copiar, modificar y utilizar los Materiales de muestra únicamente en la medida necesaria para el uso del Servicio por parte del Cliente.
2.4 Datos de uso. Palantir puede recopilar y utilizar métricas, análisis, estadísticas u otros datos relacionados con el uso del Servicio por parte del Cliente (a) para asegurar el Servicio en beneficio del Cliente; (b) para proporcionar, analizar, mantener, respaldar y mejorar el Servicio; y (c) para cualquier otro fin para el que el Cliente proporcione autorización a través del Servicio, cuando dicha opción esté disponible (colectivamente, "Datos de uso").
2.5 Seguridad. Palantir ha establecido un Programa de Seguridad de la Información ("ISP", por sus siglas en inglés) diseñado para garantizar sólidos controles prácticos de seguridad y el cumplimiento de las normas y marcos de mejores prácticas del sector. Puede encontrar una lista completa de las certificaciones de Palantir en https://www.palantir.com/information-security/ en "Compliance and Accreditation". Además, el ISP de Palantir está alineado con los marcos y sistemas de gestión NIST 800-53, TSC (Trust Service Criteria) y CIS (Center for Internet Security). El Cliente reconoce que la documentación de Palantir mencionada en esta Sección y otra información relacionada son Información Confidencial de Palantir en virtud del presente documento.
2.6 Niveles de Servicio y Soporte. Durante el Periodo de Vigencia, Palantir no tiene obligación alguna de prestar servicios de asistencia en virtud del presente Acuerdo. El presente Acuerdo no le otorga a Usted ni al Cliente ningún derecho a actualizaciones o mejoras de la Plataforma Palantir ni a extensiones o mejoras de la Plataforma Palantir desarrolladas por Palantir en el futuro. Palantir podrá ofrecer servicios de soporte por separado. Cualquier código de software complementario o material relacionado que Palantir le proporcione a Usted o al Cliente como parte de cualquier servicio de soporte se considerará parte de la Plataforma Palantir y estará sujeto a los términos y condiciones del presente Acuerdo.
2.7 Servicios Profesionales. Palantir prestará al Cliente los servicios de implementación, habilitación, formación u otros servicios profesionales que se especifiquen en el Formulario de envío de pedido y sujetos a las tarifas correspondientes ("Servicios profesionales"). Si el Formulario de envío de pedido no especifica ningún Servicio profesional, Palantir podrá, a su entera discreción (sin obligación de hacerlo en ausencia de un acuerdo independiente que estipule lo contrario), prestar al Cliente Servicios profesionales. La prestación de cualquier Servicio Profesional no afectará a la propiedad de la Plataforma Palantir y demás materiales proporcionados por Palantir en virtud del presente Acuerdo.
2.8 Requisitos de Cumplimiento de Palantir. Si Palantir determina, a su entera discreción, que el Cliente no ha satisfecho los Requisitos de Cumplimiento de Palantir, las obligaciones de Palantir en virtud de las Secciones 2.1, 2.2 y 2.3 (incluido el otorgamiento de los derechos de acceso y las concesiones de licencia previstas en las mismas) se extinguirán inmediatamente en el momento en que Palantir determine que el Cliente no ha satisfecho los Requisitos de Cumplimiento de Palantir. Palantir podrá evaluar (y volver a evaluar) el cumplimiento por parte del Cliente de los Requisitos de Cumplimiento de Palantir en cualquier momento, incluso después de que el Cliente haya accedido al Servicio. Además, el acceso continuado del Cliente al Servicio y/o a cualquier Plataforma de Palantir está condicionado a que Palantir determine, a su entera discreción, que el Cliente satisface los Requisitos de Cumplimiento de Palantir. Los "Requisitos de Cumplimiento de Palantir" comprenden (a título meramente enunciativo) la determinación por parte de Palantir (a su entera discreción) de que la ejecución del presente Acuerdo con el Cliente probablemente (i) no infrinja las obligaciones de Palantir en virtud de la normativa de control comercial de los Estados Unidos, incluida la normativa de Administración de Exportaciones de los EE. (ii) infrinja o incumpla las obligaciones contractuales de Palantir con terceros, (iii) haga que Palantir infrinja las leyes que prohíben el suministro de bienes, asistencia o servicios a Nacionales Especialmente Designados, tal y como los define el Departamento del Tesoro de los Estados Unidos, o a personas sujetas a prohibiciones similares de bloqueo o denegación administradas por una agencia gubernamental de los EE.(iv) infrinjan las obligaciones de Palantir en virtud de las leyes y normativas de exportación y sanciones de los Estados Unidos y otras jurisdicciones aplicables, incluidas, entre otras, las de la Oficina de Industria y Seguridad de los Estados Unidos y la Oficina de Control de Activos Extranjeros, o (v) infrinjan de cualquier otro modo las políticas o los valores de Palantir. Palantir se reserva el derecho a modificar la definición de Requisitos de Cumplimiento de Palantir en cualquier momento, según sea necesario y a su entera discreción.
3. Uso del servicio por parte del cliente.
3.1 Cuentas.
(a) Si el Cliente es una entidad distinta de una persona física, como una empresa, organización o institución educativa, el Cliente no podrá proporcionar más de cinco (5) cuentas para acceder al Servicio ("Cuentas") para sus (1) empleados, (2) contratistas, (3) otros usuarios (incluidos los empleados o contratistas de sus Filiales) especificados en el Formulario de envío de pedido para los fines autorizados en virtud del presente, y/o (4) los clientes del Cliente (los "Terceros autorizados") sujetos a los términos y condiciones adicionales establecidos en la Sección 3.1(a)(i) a (vi) del presente documento (colectivamente, los "Usuarios").1(a)(i)-(vi) (colectivamente, "Usuarios"):
(i) El Cliente podrá conceder acceso al Servicio a un Tercero Autorizado con el único fin de utilizar los servicios prestados por el Cliente al Tercero Autorizado en relación con los fines empresariales del Cliente; para evitar cualquier duda, un Tercero Autorizado no podrá acceder al Servicio para sus propios fines empresariales independientes de los servicios prestados por el Cliente.
(ii) El acceso de Terceros Autorizados al Servicio se limitará estrictamente a las aplicaciones frontales del Cliente creadas por el Cliente utilizando la Plataforma Palantir, y se prohíbe a los Terceros Autorizados introducir datos directamente en la Plataforma Palantir, siempre que el Cliente pueda introducir datos de Terceros Autorizados en la Plataforma Palantir con sujeción a lo dispuesto en el punto (i) anterior.
(iii) El acceso de Terceros Autorizados se regirá y estará sujeto a todas las restricciones y obligaciones del Acuerdo, y el Cliente será responsable de cualquier incumplimiento o violación del mismo por parte de un Tercero Autorizado. El Cliente podrá proporcionar a un Tercero Autorizado acceso sujeto a las condiciones de acceso inalteradas que Palantir proporcione por separado al Cliente.
(iv) El uso por parte de un Tercero Autorizado estará sujeto a las tarifas establecidas en el presente documento.
(v) El Cliente es responsable de proporcionar asistencia a los Terceros Autorizados en relación con las aplicaciones front-end creadas por el Cliente, y el Cliente mantendrá una política de asistencia que establezca que el Tercero Autorizado deberá enviar cualquier consulta de asistencia al Cliente, siempre que el Cliente pueda elevar a Palantir los problemas de la Plataforma Palantir identificados por un Tercero Autorizado que no puedan ser resueltos por el Cliente, y Palantir proporcionará asistencia razonable al Cliente para dichas elevaciones durante el horario laboral normal de Palantir en la(s) región(es) designada(s) por Palantir.
(vi) El Cliente no accederá, ni permitirá que ningún Tercero Autorizado acceda, a la Plataforma Palantir desde ningún país incluido en la lista de países prohibidos de Palantir que Palantir pone a disposición del Cliente (cada uno de ellos, un "País Prohibido").
(b) Si el Cliente es una persona física, no podrá proporcionar más de cinco (5) Cuentas, cada una de ellas únicamente a otras personas físicas (cada una de las cuales se considerará Usuario) que hayan proporcionado al Cliente todos los consentimientos, autorizaciones, aprobaciones y/o acuerdos necesarios para permitir al Cliente utilizar y/o procesar los datos de dichos Usuarios en virtud de la legislación, la normativa o los acuerdos aplicables con dichos Usuarios, y que hayan suscrito con Palantir Condiciones de Servicio sustancialmente similares a las condiciones del presente Acuerdo; siempre y cuando, si el Cliente es una persona física que accede a la instancia del Servicio de otro cliente de Palantir como Usuario autorizado (o equivalente, tal y como se identifica en el Formulario de envío de pedido) (dicho otro cliente de Palantir, un "Usuario principal"), no se permita a dicho Cliente proporcionar ninguna Cuenta. El Cliente será responsable de (i) administrar las Cuentas; (ii) utilizar medidas de seguridad estándar del sector para proteger las Cuentas (incluido, entre otros, el uso de autenticación multifactor); (iii) cualquier actividad en las Cuentas y la supervisión de dicha actividad en las Cuentas (únicamente en la medida en que dicha supervisión no infrinja ningún otro término de este Acuerdo o la legislación aplicable) ; y (iv) las acciones y omisiones de sus Usuarios en relación con la Plataforma Palantir y/o las Cuentas. El Cliente desactivará inmediatamente cualquier Cuenta en cuanto tenga conocimiento de que se ha puesto en peligro o se ha producido un uso no autorizado de la misma (y, en tal caso, notificará inmediatamente a Palantir dicho compromiso o uso no autorizado), o a petición razonable de Palantir.
3.2 Protección de Datos. Las Partes cumplirán el Anexo de Protección de Datos de Palantir ("APD") disponible en https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795 . El Cliente será el único responsable de la exactitud, el contenido y la legalidad de los Datos del Cliente y se asegurará de que cualquier integración de los Datos del Cliente en el Servicio cumpla con las leyes y normativas aplicables, incluidos, entre otros, los requisitos de localización de datos. En el papel de Palantir como Responsable del tratamiento (según se define en la DPA) con respecto al Cliente, se aplicará la Política de privacidad de AIP Now, disponible en http://www.palantir.com/aip-now-statement, que se incorpora al presente documento como referencia.
4. Uso aceptable.
4.1 Legislación aplicable. Su acceso y uso del Servicio y del Sitio web, así como los del Cliente, no infringirán las leyes aplicables de los Estados Unidos ni otras leyes aplicables en la jurisdicción en la que se encuentren Usted o el Cliente, en la que se encuentre cualquier persona física que pueda ser identificada (directa o indirectamente) por referencia a los Datos del cliente (cada uno, un "Sujeto de datos"), o en la que se almacenen los Datos del cliente, y es responsabilidad exclusiva de Usted y del Cliente garantizar dicho cumplimiento. Palantir podrá, ocasionalmente, poner a disposición políticas de uso aceptable, directrices de la comunidad o políticas similares, que pasarán a formar parte de este Acuerdo de conformidad con la política de actualizaciones establecida en la Sección 14.
4.2 Uso competitivo. El Cliente no utilizará, accederá, evaluará ni visualizará la Plataforma Palantir con el fin de crear u ofrecer un producto o servicio similar o competitivo con la Plataforma Palantir.
4.3 Controles de Exportación. La Plataforma Palantir puede estar sujeta a la normativa de control comercial de los Estados Unidos, como la Normativa de Administración de Exportaciones de los Estados Unidos, o a otras leyes de control de exportaciones aplicables en otras jurisdicciones, incluidas las leyes y normativas de exportación y sanciones a las que se hace referencia en la Sección 15 del presente Acuerdo. El Cliente no podrá utilizar la Plataforma Palantir en contravención del control de exportaciones u otros controles comerciales de los Estados Unidos o de cualquier otra jurisdicción aplicable. Esto incluye, sin limitación, las siguientes prohibiciones:
(a) El Cliente no podrá utilizar ni acceder al Servicio si es o está trabajando en nombre de un Nacional Especialmente Designado según la definición del Departamento del Tesoro de los Estados Unidos o de una persona sujeta a prohibiciones similares de bloqueo o denegación de acceso administradas por un organismo gubernamental de los Estados Unidos; y
(b) El Cliente no podrá utilizar ni acceder al Servicio para realizar ninguna actividad sujeta al Reglamento sobre Tráfico Internacional de Armas (ITAR) mantenido por el Departamento de Estado de los Estados Unidos, incluyendo, sin limitación, la ingesta de datos controlados por el ITAR.
4.4 Uso de PII y/o PHI. Si el Cliente utiliza o prevé utilizar Información Personalmente Identificable ("IPI"), Datos Personales, Información Personal o Información Sanitaria Protegida ("PHI"), tal y como se define en la legislación aplicable, en relación con el Servicio, el Cliente (a) deberá indicar dicho uso (previsto) cuando dicha opción esté disponible en el Formulario de Envío de Pedido, y ejecutar un Acuerdo de Socio Comercial antes de acceder o utilizar el Servicio; y (b) seguirá las directrices y mejores prácticas pertinentes para la protección de datos sensibles establecidas en la documentación disponible en https://www.palantir.com/docs/foundry/security/overview/. Para evitar cualquier duda, esta Sección no concede al Cliente permiso para utilizar la información anterior en relación con el Servicio si un Formulario de Envío de Pedido no permite expresamente dicho uso.
4.5 Limitaciones de los Casos de Uso. El Cliente deberá cumplir las Limitaciones de los Casos de Uso de Palantir disponibles en https://palantir.pactsafe.io/#ucr-985315, que por el presente se incorporan por referencia al Acuerdo, incluso en relación con cualquier uso de la Plataforma Palantir
4.6 Derechos de auditoría. El Cliente acepta que Palantir pueda auditar el uso del Servicio por parte del Cliente con el fin de verificar el cumplimiento de este Acuerdo por parte del Cliente, incluido, entre otros, el cumplimiento de la Sección 3.2 (Protección de datos), la Sección 4 (Uso aceptable), la Sección 5.3 (Restricciones), la Sección 6 (Confidencialidad) y la Sección 7 (Tarifas y pagos). Si Palantir tiene conocimiento o sospechas razonables de cualquier infracción del presente Acuerdo por parte del Cliente, previa notificación razonable, Palantir podrá auditar el cumplimiento del presente Acuerdo por parte del Cliente, el uso de la Plataforma Palantir por parte del Cliente y los sistemas y registros de supervisión de software del Cliente, siempre que dicha auditoría se lleve a cabo durante el horario laboral habitual del Cliente. Si Palantir considera razonablemente que dicha auditoría revela que el Cliente ha incumplido el presente Acuerdo, Palantir podrá ejercer sus derechos de rescisión en virtud de la Cláusula 8.2, y/o sus derechos de suspensión de servicios en virtud de la Cláusula 8.4, según corresponda, y el Cliente será responsable de los costes razonables de la auditoría, además de cualesquiera otros honorarios, daños, sanciones o recursos a los que Palantir pueda tener derecho en virtud del presente Acuerdo y/o la legislación aplicable. Para evitar cualquier duda, el inicio de una auditoría por parte de Palantir no es necesariamente una condición previa para el ejercicio de sus derechos de rescisión en virtud de la Cláusula 8.2 o el ejercicio de sus derechos de suspensión de servicios en virtud de la Cláusula 8.4, si se cumplen las condiciones que permiten el ejercicio de los derechos anteriores; la decisión de Palantir de iniciar una auditoría no excluye su capacidad para ejercer sus derechos en virtud de la Cláusula 8.2 o la Cláusula 8.4, si se cumplen las condiciones que permiten el ejercicio de los derechos anteriores.
5. Derechos de propiedad.
5.1 Propiedad del Cliente. En lo que respecta a las Partes, el Cliente posee todos los derechos, títulos e intereses, incluidos todos los Derechos de Propiedad Intelectual, sobre los Datos del Cliente y cualquier modificación realizada a los mismos. Sujeto al Acuerdo, el Cliente otorga a Palantir un derecho y una licencia no exclusivos, mundiales y exentos de regalías durante el Periodo de vigencia para utilizar y procesar los Datos del cliente con el único fin de proporcionar el Servicio y/o los Servicios profesionales, y según lo exija la legislación aplicable. Asimismo, el Cliente concede a Palantir un derecho y una licencia mundiales, perpetuos, irrevocables y exentos de regalías para utilizar, distribuir, divulgar y realizar e incorporar en la Plataforma Palantir cualquier sugerencia, solicitud de mejora, recomendación u otros comentarios proporcionados por el Cliente o los Usuarios en relación con la Plataforma Palantir
5.2 Propiedad de Palantir. En lo que respecta a las Partes, Palantir es propietaria de todos los derechos, títulos e intereses, incluidos todos los Derechos de Propiedad Intelectual, de la Plataforma Palantir y de cualquier otra documentación o material relacionado proporcionado por Palantir, así como de cualquier trabajo derivado, modificación o mejora de cualquiera de los anteriores (incluidos, entre otros, todos los Derechos de Propiedad Intelectual incorporados en cualquiera de los anteriores). A excepción de los derechos expresos concedidos en el presente documento, Palantir no concede ninguna otra licencia o acceso, ya sea expreso o implícito, ni ningún derecho de propiedad sobre ninguna Plataforma Palantir, software, servicios o Derechos de Propiedad Intelectual.
5.3 Restricciones. El Cliente no (y no permitirá que ningún tercero): (a) obtenga o intente obtener acceso no autorizado al Servicio o Sitio Web o infraestructura, o cualquier elemento del mismo, o eluda o interfiera con cualquier autenticación o medidas de seguridad del Servicio o Sitio Web; (b) interfiera o interrumpa la integridad o el rendimiento del Servicio o Sitio Web; (c) acceda o intente acceder a los datos de otro cliente; (d) afecte negativamente a la capacidad de otros clientes para utilizar el Servicio; (e) transmitir material que contenga virus de software u otros códigos informáticos, archivos, scripts, agentes o programas dañinos o nocivos a través del Servicio o el Sitio web; (f) descompilar, desensamblar, escanear, aplicar ingeniería inversa o intentar descubrir cualquier código fuente o ideas o algoritmos subyacentes de cualquier Plataforma de Palantir (excepto en la medida en que la legislación aplicable prohíba expresamente dicha restricción de ingeniería inversa, y en tal caso únicamente previa notificación por escrito a Palantir); (g) proporcionar, arrendar, prestar, utilizar con fines de multipropiedad u oficina de servicios, o utilizar de cualquier otro modo o permitir que otros utilicen el Servicio en beneficio de terceros; (h) utilizar el Servicio o el Sitio web para cualquier fin que no esté expresamente permitido por el presente Acuerdo; (i) listar o mostrar o copiar de cualquier otro modo cualquier código de cualquier Plataforma Palantir, excepto los Materiales de Muestra en la medida necesaria para el uso del Servicio por parte del Cliente; (j) copiar cualquier Plataforma Palantir (o componente de la misma) o desarrollar cualquier mejora, modificación o trabajo derivado de la misma, excepto los Materiales de Muestra en la medida necesaria para el uso del Servicio por parte del Cliente; (k) incluir cualquier parte de cualquier Plataforma Palantir en cualquier otro servicio, equipo o artículo; (l) permitir la transferencia, transmisión (incluida, entre otras, la puesta a disposición en línea, la transmisión electrónica o la comunicación al público por cualquier otro medio), exportación o reexportación de cualquier Plataforma Palantir (o cualquier parte de la misma) o de cualquier dato técnico de Palantir; (m) realizar pruebas de penetración en el Servicio, a menos que Palantir lo autorice; (n) utilizar, acceder, evaluar o visualizar la Plataforma Palantir con el fin de crear u ofrecer un producto o servicio similar a la Plataforma Palantir o que compita con ella; (o) eliminar, ocultar o alterar, o violar de cualquier otro modo los términos de cualquier aviso de derechos de autor, marcas comerciales, logotipos y nombres comerciales y cualquier otro aviso (incluidas las licencias de código abierto o similares de terceros) o identificaciones que aparezcan en o sobre cualquier Plataforma Palantir y cualquier medio asociado; (p) utilizar el Sitio Web o la Plataforma Palantir para realizar o promover cualquier fraude o tergiversación (incluido, entre otros, el suministro de información fraudulenta o engañosa en respuesta al Formulario de Envío de Pedidos); o (q) utilizar o acceder al Servicio con el fin de realizar o apoyar actividades o comunicaciones de spam, o actividades o comunicaciones de marketing que infrinjan la Ley de Control del Asalto de Pornografía y Marketing No Solicitados (15 U.S.C. § 7701 et seq.), la Ley de Protección del Consumidor Telefónico (47 U.S.C. § 227) y todas las demás leyes aplicables que prohíban el spam o que regulen de otro modo la transmisión de materiales y/o comunicaciones de marketing. Sin perjuicio de lo anterior, o de cualquier declaración en contrario en el presente documento, el Contenido de Terceros puede estar disponible con avisos y licencias de código abierto o similares de dichas comunidades y terceros que rigen el uso de dichas partes, y el Cliente acepta por el presente documento estar vinculado a dichas licencias y cumplirlas en su totalidad; no obstante, las disposiciones de renuncia de garantía y limitación de responsabilidad del presente Contrato se aplicarán a todo dicho Contenido de Terceros.
6. Confidencialidad. Cada una de las Partes (la "Parte Receptora") mantendrá estrictamente confidencial toda la Información Confidencial de la otra Parte (la "Parte Reveladora"), y no utilizará dicha Información Confidencial excepto a los efectos del presente Acuerdo, y no revelará dicha Información Confidencial a ningún tercero salvo a los directores, empleados, agentes, abogados, contables, subcontratistas de u otros representantes de la Parte Receptora que estén sujetos a obligaciones de confidencialidad al menos tan restrictivas como las del presente documento ("Representantes Autorizados"). La Parte Receptora empleará al menos el mismo grado de cuidado que utiliza para evitar la divulgación de su propia información confidencial, pero en ningún caso menos que un cuidado razonable. La Parte Receptora podrá, sin incumplir las obligaciones del Acuerdo, revelar Información Confidencial en la medida en que lo exija una orden judicial o gubernamental válida, o lo exija la legislación aplicable, siempre que la Parte Receptora: (a) notifique por escrito a la Parte Reveladora con una antelación razonable dicha revelación y (b) realice esfuerzos razonables para limitar la revelación y obtener, o ayudar a la Parte Reveladora a obtener, un tratamiento confidencial o una orden de protección que impida o limite la revelación, permitiendo al mismo tiempo a la Parte Reveladora participar en el procedimiento. "Información Confidencial" significa (i) en el caso de Palantir, la Plataforma Palantir (incluida cualquier información relacionada con la misma); (ii) en el caso del Cliente, los Datos del Cliente; y (iii) cualquier otra información que, por la naturaleza de la información revelada o por la forma de su revelación, una persona razonable entendería que es confidencial, en cada caso, en cualquier forma (incluidas, entre otras, la electrónica o la oral) y tanto si se ha facilitado antes, durante o después de la Fecha de Entrada en Vigor; No obstante, la Información Confidencial no incluirá ninguna información que (1) sea o pase a ser de dominio público por acción u omisión de la Parte Receptora o sus Representantes Autorizados; (2) sea conocida por la Parte Receptora en la Fecha de Entrada en Vigor o en el momento de su divulgación por la Parte Divulgadora (según conste en registros escritos) sin obligación de mantenerla confidencial, lo que ocurra primero; (3) haya sido divulgada legítimamente a la Parte Receptora antes de la Fecha de Entrada en Vigor por otra fuente sin que el tercero divulgador haya violado la confidencialidad y sin restricción alguna a su divulgación o uso; o (4) la Parte Receptora pueda documentar mediante pruebas escritas que dicha información fue desarrollada de forma independiente sin ningún uso o referencia a la Información Confidencial. La Parte Receptora será responsable de cualquier incumplimiento de esta Sección por parte de cualquier persona o entidad a la que la Parte Receptora esté autorizada a revelar Información Confidencial en virtud de esta Sección. Las obligaciones de la Parte Receptora con respecto a la Información Confidencial sobrevivirán a la rescisión del presente Acuerdo durante cinco (5) años; no obstante, las obligaciones de la Parte Receptora en virtud del presente Acuerdo sobrevivirán a la rescisión y continuarán a perpetuidad, o durante el tiempo que permita la legislación aplicable, con respecto a cualquier Información Confidencial que sea un secreto comercial en virtud de la legislación aplicable.
7. Tarifas y pago; impuestos. El Servicio se considera prestado en el momento en que se proporciona acceso al Cliente o en beneficio del Cliente. Si existen tarifas fijas establecidas en el Formulario de solicitud de pedido, dichas tarifas se facturarán y abonarán por adelantado, o de cualquier otra forma establecida en el Formulario de solicitud de pedido. Cualquier tarifa basada en el uso establecida en el Formulario de envío de pedido, incluso si se paga en exceso de cualquier uso incluido aplicable especificado en el Formulario de envío de pedido, se calculará de acuerdo con las tarifas de uso establecidas en el Formulario de envío de pedido (según corresponda) y se facturará y pagará trimestralmente a mes vencido, o según se establezca de otro modo en el Formulario de envío de pedido. Todos los pagos se realizarán mediante transferencia bancaria a una cuenta designada por Palantir en la divisa indicada en la factura correspondiente, o mediante cualquier otro método de pago acordado por las Partes (incluido lo especificado en el Formulario de envío de pedido) y según lo establecido en la factura correspondiente, en un plazo de treinta (30) días a partir de la fecha de emisión de la factura de Palantir . Todo pago atrasado estará sujeto a un cargo por servicio equivalente al 1,5% mensual de la cantidad adeudada o a la cantidad máxima de intereses permitida por la legislación aplicable, el menor de los dos. A menos que se indique lo contrario en el Formulario de envío de pedido, las tarifas no incluyen los Impuestos aplicables (excepto los impuestos sobre los ingresos netos de Palantir o medidos en función de dichos ingresos). El Cliente será responsable de todos los Impuestos derivados del presente Acuerdo de modo que, tras el pago de dichos Impuestos, el importe que Palantir reciba no sea inferior a las tarifas establecidas en el Formulario de Envío de Pedido. En caso de que se aplique un tratado de doble imposición que establezca un tipo de retención fiscal cero o reducido, el Cliente acepta (a) no retener impuestos en caso de un tipo de retención fiscal cero o (b) retener al tipo impositivo reducido de conformidad con el tratado de doble imposición.
8. Vigencia y terminación; suspensión.
8.1 Vigencia; Rescisión por conveniencia. A menos que se especifique lo contrario en el Formulario de envío de pedido, el presente Contrato entrará en vigor en la Fecha de entrada en vigor y seguirá vigente en hasta que se rescinda según lo dispuesto en el presente documento (el "Plazo"); no obstante, si el Cliente es una persona física que accede a una instancia del Servicio de un Usuario principal como Usuario autorizado (o equivalente, según se identifique en el Formulario de envío de pedido), el Plazo seguirá en vigor hasta que caduque o se rescinda el acceso del Usuario principal al Servicio. Sin perjuicio de lo anterior, si se especifica lo contrario en el Formulario de envío de pedido, por "Plazo" se entenderá el período comprendido entre la Fecha de entrada en vigor y el vencimiento del plazo especificado en el Formulario de envío de pedido. Palantir podrá rescindir este Acuerdo por conveniencia, por cualquier motivo o sin él, en cualquier momento, previa notificación al Cliente de dicha rescisión con sesenta (60) días de antelación.
8.2 Rescisión por causa justificada. Sin limitar los demás derechos de cualquiera de las Partes, cualquiera de ellas podrá resolver el presente Acuerdo por causa justificada (a) en caso de incumplimiento sustancial por la otra Parte de cualquiera de las disposiciones del presente Acuerdo y de no subsanación del incumplimiento (y notificación por escrito de dicha subsanación a la Parte no incumplidora) en el plazo de treinta (30) días a partir de la notificación por escrito de dicho incumplimiento por parte de la Parte no incumplidora o (b) si la otra Parte solicita protección en virtud de cualquier procedimiento de quiebra, suspensión de pagos o similar, o si dicho procedimiento se incoa contra dicha Parte y no se desestima en el plazo de noventa (90) días. Salvo cuando se especifique un recurso exclusivo en el presente Acuerdo, el ejercicio por cualquiera de las Partes del derecho a resolver en virtud de la presente disposición se entenderá sin perjuicio de cualesquiera otros recursos que puedan corresponderle en virtud del presente Acuerdo o de la ley. En caso de rescisión del presente Acuerdo por parte del Cliente por causa justificada de conformidad con la Cláusula 8.2(a) o por parte de Palantir debido al incumplimiento por parte del Cliente de los Requisitos de Cumplimiento de Palantir, tal y como se establece en la Cláusula 8.4(c) (Suspensión de los Servicios), Palantir proporcionará un reembolso prorrateado de las tarifas prepagadas por los Servicios no utilizados a partir de la fecha efectiva de rescisión
8.3 Efecto de la rescisión. Tras la rescisión o el vencimiento del presente Acuerdo, salvo que se establezca específicamente lo contrario a continuación, todos los derechos, el acceso y las licencias del Cliente concedidos a la Plataforma Palantir cesarán inmediatamente y el Cliente devolverá o destruirá inmediatamente todo el Software de Conexión de Datos, los Materiales de Muestra y la Documentación, así como cualquier otra Información Confidencial de Palantir y, previa solicitud por escrito, certificará por escrito a Palantir el cumplimiento de lo anterior en un plazo de diez (10) días a partir de dicha solicitud. Tras la rescisión o el vencimiento del presente Acuerdo, si así lo solicita el Cliente, éste tendrá acceso al Servicio durante treinta (30) días, de conformidad con las condiciones del presente Acuerdo, con el único fin de recuperar los Datos del Cliente. A partir de ese momento, Palantir eliminará todos los Datos del Cliente. Sin perjuicio de lo anterior, Palantir conservará, con sujeción a las demás condiciones del presente Acuerdo y únicamente con fines de seguridad, la información de uso y los metadatos relacionados con la seguridad del Servicio, excluidos los Datos del cliente (excepto la información relacionada con la seguridad, como direcciones IP, nombres de usuario, intentos de inicio de sesión y consultas de búsqueda), durante un período de dos (2) años a partir del último evento registrado. Ninguna rescisión o expiración del presente Acuerdo limitará o afectará a los derechos u obligaciones devengados con anterioridad a la fecha efectiva de rescisión o expiración (incluidas, entre otras, las obligaciones de pago). Las secciones 1, 4 (excluida la sección 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14 y 15 seguirán vigentes tras la rescisión o expiración del presente Contrato.
8.4 Suspensión de los Servicios. Si Palantir determina razonablemente que: (a) Usted no tiene autorización para vincular al Cliente a este Acuerdo en nombre del Cliente (incumpliendo la declaración y garantía expresas del preámbulo de este Acuerdo); (b) el uso del Servicio, la Plataforma de Palantir o el Sitio web por parte del Cliente infringe la legislación aplicable o incumple de algún otro modo un término sustancial de este Acuerdo (incluidas la Sección 3.2 (Protección de datos), la Sección 4 (Uso aceptable), la Sección 5.3 (Restricciones), la Sección 6 (Confidencialidad) y la Sección 7 (Tarifas y pagos)); (c) el Cliente no satisface los Requisitos de cumplimiento de Palantir ; o (d) el Cliente ha incumplido alguna de las garantías establecidas en la Sección 11, Palantir se reserva el derecho a deshabilitar, suspender o cancelar el acceso del Cliente a la totalidad o parte del Sitio web y/o la Plataforma Palantir
9. Indemnización.
9.1 Indemnización de Palantir. Palantir defenderá al Cliente frente a cualquier reclamación por infracción o violación de cualquier Derecho de Propiedad Intelectual presentada contra el Cliente por un tercero basándose en el uso por parte del Cliente de la Plataforma Palantir de conformidad con los términos de este Acuerdo, e indemnizará y eximirá al Cliente de los costes razonables, los honorarios de abogados y los daños y perjuicios, si los hubiera, que finalmente se concedan contra el Cliente en virtud de una orden no apelable de un tribunal de jurisdicción competente en dicha reclamación o acuerdo alcanzado por Palantir. Si el uso por parte del Cliente de cualquiera de los elementos de la Plataforma Palantir es, o en opinión de Palantir es probable que sea, prohibido por un tribunal de jurisdicción competente debido al tipo de infracción especificado anteriormente, o si así lo exige un acuerdo aprobado por Palantir por escrito, Palantir podrá, a su entera discreción (a) sustituir los productos o servicios por otros sustancialmente similares desde el punto de vista funcional; (b) obtener para el Cliente el derecho a seguir utilizando la Plataforma Palantir; o (c) si Palantir determina razonablemente que las opciones (a) y (b) son comercialmente impracticables, rescindir el presente Acuerdo y reembolsar al Cliente una parte prorrateada de las tarifas pagadas en virtud del presente Acuerdo por la Plataforma Palantir rescindida que refleje la parte restante del Periodo de vigencia activa en el momento de la rescisión. Las anteriores obligaciones de indemnización de Palantir no se aplicarán (i) si la Plataforma Palantir es modificada por el Cliente o los Usuarios, o bajo sus instrucciones, pero solo en la medida en que la supuesta infracción no se hubiera producido de no ser por dicha modificación; (ii) si la Plataforma Palantir se combina con productos no autorizados por Palantir, pero solo en la medida en que la supuesta infracción no se hubiera producido de no ser por dicha combinación; (iii) a cualquier uso no autorizado de la Plataforma Palantir, cualquier uso que no sea coherente con la Documentación, cualquier uso que infrinja la Sección 4 (Uso aceptable), o el uso durante cualquier periodo de suspensión (tal y como se establece en la Sección 8.4); (iv) a cualquier uso no autorizado de la Plataforma Palantir, cualquier uso que no sea coherente con la Documentación, cualquier uso que infrinja la Sección 4 (Uso aceptable), o el uso durante cualquier periodo de suspensión (tal y como se establece en la Sección 8.4).4); (iv) a cualquier Dato del Cliente; o (v) a cualquier producto o servicio ajeno a Palantir
9.2 Indemnización del Cliente. El Cliente defenderá a Palantir frente a cualquier reclamación de terceros presentada contra Palantir que surja o esté relacionada con (a) la infracción de la legislación aplicable por parte del Cliente, (b) los Datos del Cliente, (c) el incumplimiento de la DPA por parte del Cliente, (d) el incumplimiento de la Sección 4 (Uso aceptable) por parte del Cliente, (e) el incumplimiento de la Sección 5.3 (Restricciones) por parte del Cliente o (f) cualquier producto o servicio ofrecido por el Cliente.3 (Restricciones), o (f) cualquier producto o servicio ofrecido por el Cliente (excepto si dicha reclamación es atribuible al Servicio ofrecido por Palantir) e indemnizará y mantendrá indemne a Palantir frente a los costes, honorarios de abogados y daños y perjuicios relacionados, si los hubiera, emitidos por una autoridad competente o concedidos finalmente en virtud de una orden no recurrible.
9.3 Procedimiento de indemnización. Las obligaciones de la Parte indemnizadora estarán condicionadas a que la Parte indemnizada proporcione a la Parte indemnizadora: (a) la pronta notificación por escrito (que en ningún caso excederá de veinte (20) días) de cualquier reclamación, pleito o demanda de la que tenga conocimiento; (b) el derecho a asumir la defensa y el control exclusivos de cualquier asunto que sea objeto de indemnización (siempre que la Parte indemnizadora no resuelva ninguna reclamación a menos que exima incondicionalmente a la Parte indemnizada de toda responsabilidad y no admita culpa o acto ilícito por parte de la Parte indemnizada); (c) cooperación con cualquier solicitud razonable que ayude a la Parte indemnizadora en su defensa y solución (a cargo de la Parte indemnizadora). Esta Sección establece la única responsabilidad y obligación de cada Parte y el único y exclusivo recurso con respecto a cualquier reclamación de infracción de los Derechos de Propiedad Intelectual.
10.1 Garantía de Palantir. Palantir garantiza que durante el Periodo de vigencia de (a) el Servicio se prestará sustancialmente de acuerdo con la Documentación aplicable y (b) los Servicios profesionales se prestarán de forma profesional y diligente. En caso de incumplimiento de una de las garantías anteriores, el Cliente podrá notificar por escrito a Palantir la rescisión del presente Acuerdo, que será efectiva treinta (30) días después de la recepción de la notificación por parte de Palantir, a menos que Palantir pueda subsanar el incumplimiento antes de la fecha efectiva de rescisión. Esta garantía no se aplicará en la medida en que dicho incumplimiento esté causado por los Datos del Cliente o el uso indebido o la modificación no autorizada del Servicio (incluida, entre otras, la infracción por parte del Cliente de la Sección 4 (Uso aceptable)) o de cualquier hardware seleccionado por el Cliente y utilizado en relación con el Servicio. En caso de rescisión del presente Acuerdo en virtud del ejercicio por parte del Cliente de su derecho en virtud de esta Sección, el Cliente tendrá derecho a recibir de Palantir, como único y exclusivo recurso, el reembolso de una parte prorrateada de las tarifas pagadas en virtud del presente Acuerdo que refleje la parte restante del Plazo activa en el momento de la rescisión
10.2 descargo de responsabilidad. NINGUNA CANTIDAD PAGADA EN VIRTUD DEL PRESENTE DOCUMENTO ES REEMBOLSABLE O COMPENSABLE, SALVO QUE SE ESTABLEZCA EXPLÍCITAMENTE LO CONTRARIO EN EL PRESENTE DOCUMENTO. SALVO QUE SE ESTABLEZCA EXPRESAMENTE LO CONTRARIO EN EL PRESENTE DOCUMENTO, Y SÓLO EN LA MEDIDA MÁXIMA PERMITIDA POR LA LEGISLACIÓN APLICABLE, LA PLATAFORMA PALANTIR Y LOS SERVICIOS PROFESIONALES SE PROPORCIONAN "TAL CUAL" SIN NINGUNA OTRA GARANTÍA DE NINGÚN TIPO, Y PALANTIR Y SUS PROVEEDORES Y PRESTADORES DE SERVICIOS RENUNCIAN POR EL PRESENTE DOCUMENTO A TODAS LAS GARANTÍAS DE CUALQUIER TIPO, YA SEAN EXPRESAS O IMPLÍCITAS, ORALES O ESCRITAS, RELATIVAS A LA PLATAFORMA PALANTIR Y A LOS SERVICIOS PROFESIONALES PRESTADOS EN VIRTUD DEL PRESENTE DOCUMENTO O DE CUALQUIER OTRO MODO, INCLUIDAS, A TÍTULO MERAMENTE ENUNCIATIVO Y NO LIMITATIVO, LAS GARANTÍAS DE NO INFRACCIÓN, COMERCIABILIDAD, TITULARIDAD O IDONEIDAD PARA UN FIN DETERMINADO. SIN PERJUICIO DE LA LIMITACIÓN ANTERIOR, PALANTIR NO GARANTIZA QUE LA PLATAFORMA PALANTIR Y LOS SERVICIOS PROFESIONALES SATISFAGAN LOS REQUISITOS DEL CLIENTE NI GARANTIZA NINGÚN RESULTADO, CONSECUENCIA O CONCLUSIÓN, NI QUE EL FUNCIONAMIENTO DEL SERVICIO SEA ININTERRUMPIDO O ESTÉ LIBRE DE ERRORES. PALANTIR NO SE HACE RESPONSABLE DE LOS SERVICIOS DE TERCEROS (INCLUIDOS, ENTRE OTROS, GARANTÍAS DE TIEMPO DE ACTIVIDAD, INTERRUPCIONES O FALLOS), LOS DATOS DE LOS CLIENTES O CUALQUIER CONTENIDO DE TERCEROS. PALANTIR NO CONTROLA LA TRANSFERENCIA DE INFORMACIÓN O DATOS DEL CLIENTE A TRAVÉS DE LAS INSTALACIONES DE COMUNICACIONES, INTERNET O LOS SERVICIOS DE TERCEROS, Y EL SERVICIO PUEDE ESTAR SUJETO A RETRASOS Y OTROS PROBLEMAS INHERENTES AL USO DE DICHAS INSTALACIONES DE COMUNICACIONES. PALANTIR NO SE HACE RESPONSABLE DE LOS RETRASOS, FALLOS U OTROS DAÑOS DERIVADOS DE DICHOS PROBLEMAS.
11. Garantía del Cliente. El Cliente garantiza que (a) ha proporcionado todas las notificaciones necesarias y ha obtenido todos los consentimientos, autorizaciones, aprobaciones y/o acuerdos necesarios, según lo exigido por cualquier ley o política aplicable, y ha informado a Palantir de cualquier obligación aplicable al procesamiento de los Datos del Cliente por parte de Palantir, con el fin de permitir a Palantir procesar los Datos del Cliente, incluidos los datos personales, de acuerdo con el alcance, la finalidad y las instrucciones especificadas por el Cliente, y que el Cliente no dirigirá el procesamiento de los Datos del Cliente por parte de Palantir infringiendo ninguna ley o normativa (incluidos los requisitos de localización) ni los derechos de terceros; (b) no utilizará el Servicio para fines no autorizados o ilegales; y (c) no cargará ni importará Datos del cliente al Servicio que requieran documentación adicional sin ejecutar previamente dicha documentación. Todos los Datos del cliente que el Cliente integre, utilice o ponga a disposición de cualquier otra forma en el Servicio o a través de él, así como las conclusiones que se extraigan de los mismos, se realizan por cuenta y riesgo del Cliente, que será el único responsable de cualquier daño o pérdida que se derive de los mismos.
12. Limitaciones de responsabilidad. EN LA MEDIDA MÁXIMA PERMITIDA POR LA LEGISLACIÓN APLICABLE, Y SIN PERJUICIO DE CUALQUIER OTRA DISPOSICIÓN DEL PRESENTE ACUERDO, NINGUNA DE LAS PARTES SERÁ RESPONSABLE ANTE LA OTRA PARTE O SUS FILIALES POR (A) EL COSTE DE ADQUISICIÓN DE CUALQUIER PRODUCTO O SERVICIO SUSTITUTIVO, O EL COSTE DE SUSTITUCIÓN O RESTAURACIÓN DE CUALQUIER DATO DEL CLIENTE, (B) PÉRDIDAS ECONÓMICAS, BENEFICIOS ESPERADOS O PERDIDOS, INGRESOS O AHORROS PREVISTOS, (B) PÉRDIDAS ECONÓMICAS, BENEFICIOS ESPERADOS O PERDIDOS, INGRESOS O AHORROS PREVISTOS, PÉRDIDA DE NEGOCIO, PÉRDIDA DE CONTRATOS, PÉRDIDA O DAÑO A LA BUENA VOLUNTAD O REPUTACIÓN, Y/O (C) PÉRDIDAS O DAÑOS INDIRECTOS, ESPECIALES, INCIDENTALES, PUNITIVOS O CONSECUENTES, YA SEA QUE SURJAN DEL CUMPLIMIENTO O INCUMPLIMIENTO DE ESTE ACUERDO O DEL USO O IMPOSIBILIDAD DE USO DE LA PLATAFORMA PALANTIR, INCLUSO SI LA PARTE HA SIDO ADVERTIDA SOBRE LA POSIBILIDAD DE TALES PÉRDIDAS O DAÑOS. A EXCEPCIÓN DE LAS OBLIGACIONES DE LAS PARTES ESTABLECIDAS EN LAS SECCIONES 5 Y 9.2 DE ESTE ACUERDO Y LAS OBLIGACIONES DE PAGO DEL CLIENTE EN VIRTUD DEL PRESENTE, EN LA MEDIDA MÁXIMA PERMITIDA POR LA LEGISLACIÓN APLICABLE, CADA PARTE ACUERDA QUE LA RESPONSABILIDAD TOTAL MÁXIMA DE CUALQUIERA DE LAS PARTES Y SUS FILIALES FRENTE A LA OTRA PARTE Y SUS FILIALES POR TODAS LAS RECLAMACIONES DE CUALQUIER TIPO NO SUPERARÁ LA MAYOR DE LAS SIGUIENTES CANTIDADES A) LAS TARIFAS PAGADAS O PAGADERAS A PALANTIR POR EL CLIENTE EN VIRTUD DEL ACUERDO EN LOS DOCE (12) MESES ANTERIORES A LA RECLAMACIÓN POR EL SERVICIO O LOS SERVICIOS PROFESIONALES QUE DIERON LUGAR A DICHA RECLAMACIÓN O B) CIEN MIL DÓLARES (USD 100.000), Y QUE DICHA COMPENSACIÓN ES JUSTA Y ADECUADA . NO OBSTANTE LA FRASE ANTERIOR, SI EL CLIENTE NO DEBE ABONAR HONORARIOS DURANTE EL PERIODO DE VIGENCIA, A EXCEPCIÓN DE LAS OBLIGACIONES DE LAS PARTES ESTABLECIDAS EN LAS SECCIONES 5 Y 9.2 DEL PRESENTE ACUERDO Y LAS OBLIGACIONES DE PAGO DEL CLIENTE EN VIRTUD DEL PRESENTE, EN LA MEDIDA MÁXIMA PERMITIDA POR LA LEGISLACIÓN APLICABLE, CADA PARTE ACUERDA QUE LA RESPONSABILIDAD TOTAL MÁXIMA DE CUALQUIERA DE LAS PARTES Y SUS FILIALES FRENTE A LA OTRA PARTE Y SUS FILIALES POR TODAS LAS RECLAMACIONES DE CUALQUIER TIPO NO SUPERARÁ LOS CINCUENTA MIL DÓLARES (USD 50.000), Y QUE DICHA COMPENSACIÓN ES JUSTA Y ADECUADA. LAS LIMITACIONES ESTABLECIDAS EN ESTA SECCIÓN 12 SE APLICARÁN INDEPENDIENTEMENTE DE SI UNA ACCIÓN SE BASA EN UN CONTRATO, AGRAVIO (INCLUYENDO NEGLIGENCIA), RESPONSABILIDAD ESTRICTA O CUALQUIER OTRA TEORÍA LEGAL O EQUITATIVA.
13. RESOLUCIÓN DE DISPUTAS. CUALQUIER DISPUTA, CONTROVERSIA O RECLAMACIÓN DERIVADA O RELACIONADA CON EL PRESENTE CONTRATO, INCLUIDA LA ARBITRABILIDAD, QUE NO PUEDA RESOLVERSE TRAS CONVERSACIONES DE BUENA FE EN UN PLAZO DE SESENTA (60) DÍAS TRAS LA NOTIFICACIÓN DE UNA DISPUTA, SE RESOLVERÁ DEFINITIVAMENTE MEDIANTE ARBITRAJE. EL DERECHO APLICABLE SERÁ EL DERECHO SUSTANTIVO DEL ESTADO DE NUEVA YORK, SIN TENER EN CUENTA LAS DISPOSICIONES SOBRE CONFLICTOS DE LEYES DEL MISMO, Y EL ARBITRAJE SE ADMINISTRARÁ EN NUEVA YORK, NUEVA YORK, ESTADOS UNIDOS, DE CONFORMIDAD CON LAS NORMAS Y PROCEDIMIENTOS GENERALES DE ARBITRAJE DE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. ("JAMS") Y LAS NORMAS FEDERALES SOBRE PRUEBAS (SIN PERJUICIO DE LA NORMA 22(D) DE JAMS O DE CUALQUIER OTRA NORMA DE JAMS QUE DISPONGA LO CONTRARIO). LAS PARTES ACUERDAN ABORDAR EL ARBITRAJE ÚNICAMENTE DE FORMA INDIVIDUAL, Y ESTE ACUERDO NO PERMITE EL ARBITRAJE COLECTIVO NI NINGUNA RECLAMACIÓN PRESENTADA COMO DEMANDANTE O MIEMBRO COLECTIVO EN NINGÚN PROCEDIMIENTO DE ARBITRAJE COLECTIVO, REPRESENTATIVO, PAGA, CONJUNTO O REPRESENTATIVO. EL TRIBUNAL ARBITRAL NO PODRÁ CONSOLIDAR LAS DEMANDAS DE MÁS DE UNA PERSONA Y NO PODRÁ PRESIDIR NINGUNA FORMA DE PROCEDIMIENTO REPRESENTATIVO O COLECTIVO. SIN PERJUICIO DE LO ANTERIOR, CADA UNA DE LAS PARTES TENDRÁ DERECHO A INTERPONER EN CUALQUIER MOMENTO UNA DEMANDA ANTE UN TRIBUNAL COMPETENTE PARA OBTENER MEDIDAS CAUTELARES PRELIMINARES A LA ESPERA DE LA DECISIÓN FINAL DEL ÁRBITRO O ÁRBITROS, SIEMPRE QUE (A) LA PARTE QUE INTERPONGA LA DEMANDA SOLICITE UNA ORDEN PARA PRESENTAR LA DEMANDA BAJO SELLO (O AL MENOS ASÍ LO HAGA PARA CUALQUIER PRESENTACIÓN QUE CONTENGA INFORMACIÓN CONFIDENCIAL O SECRETOS COMERCIALES) CON EL FIN DE LIMITAR LA DIVULGACIÓN SEGÚN LO DISPUESTO EN LA SECCIÓN 6 DEL PRESENTE ACUERDO; Y (B) EL ÁRBITRO O ÁRBITROS SÓLO CONCEDERÁN UNA MEDIDA CAUTELAR PERMANENTE Y UNA INDEMNIZACIÓN POR DAÑOS Y PERJUICIOS.
14.1 Actualizaciones del presente Acuerdo. Palantir se reserva el derecho a modificar este Acuerdo en cualquier momento y lo actualizará en caso de que se produzcan dichas modificaciones. Palantir notificará al Cliente los cambios a posteriori de este Acuerdo mediante la publicación de un aviso en el Sitio web y/o el envío de un correo electrónico a la dirección de correo electrónico principal especificada en un Formulario de envío de pedido aplicable o en la Cuenta del Cliente. Cualquier modificación de este Acuerdo entrará en vigor treinta (30) días después de que Palantir envíe dicha notificación. El uso continuado de la Plataforma Palantir por parte del Cliente en los treinta (30) días posteriores a la fecha en que Palantir envíe la notificación anterior constituye la aceptación de dichas revisiones del presente Acuerdo. Para cualquier otra modificación, el uso continuado de la Plataforma Palantir por parte del Cliente constituye la aceptación de nuestras revisiones del presente Acuerdo. Palantir se reserva el derecho a modificar en cualquier momento y ocasionalmente (incluida la eliminación de funcionalidades o herramientas), de forma temporal o permanente, la Plataforma Palantir (o cualquier parte de la misma)
15. Varios. Palantir prestará el Servicio y los Servicios profesionales de conformidad con las leyes y normativas aplicables a la prestación por parte de Palantir de dicho Servicio y Servicios profesionales en general, incluidas, entre otras, las relativas a la protección de datos y las transferencias internacionales de datos personales, sin tener en cuenta la utilización específica del Servicio por parte del Cliente, excepto en la medida establecida en el Formulario de envío de pedido, y sujeto al cumplimiento del presente Acuerdo por parte del Cliente. Las Partes cumplirán el Anexo de AIP de Palantir disponible en https://palantir.pactsafe.io/aip-legal-3791.html, que se incorpora por referencia en el presente documento. Salvo previo consentimiento por escrito de Palantir, ni el presente Acuerdo ni el acceso o las licencias concedidos en virtud del mismo podrán ser cedidos, transferidos o sublicenciados por el Cliente, incluyendo, sin limitación, en virtud de un cambio de control del Cliente o de la venta de todos o prácticamente todos los activos del Cliente; cualquier intento de hacerlo será nulo. Palantir podrá ceder o delegar este Acuerdo, en su totalidad o en parte, a cualquier persona o entidad en cualquier momento, con o sin el consentimiento del Cliente. Palantir podrá rescindir este Acuerdo en caso de cambio de control del Cliente o de venta de todos o prácticamente todos los activos del Cliente. Palantir podrá subcontratar este Acuerdo o partes del mismo. Cualquier notificación requerida o permitida en virtud del presente Acuerdo deberá enviarse por escrito al Cliente a la(s) dirección(es) indicada(s) en el Formulario de envío de pedido y, si se realiza por correo electrónico, las notificaciones a Palantir deberán enviarse alegalnotices@palantir.com o 1200 17th Street Floor 15 Denver, CO 80202 (ATTN: Legal). Si alguna de las disposiciones de este Acuerdo fuera declarada inaplicable o inválida por un tribunal de jurisdicción competente, dicha disposición se limitará o eliminará en la medida mínima necesaria para que este Acuerdo siga siendo plenamente vigente y aplicable. Ninguna renuncia a un incumplimiento se considerará una renuncia a un incumplimiento posterior. El Servicio y los Servicios profesionales están sujetos al control de las leyes y reglamentos de exportación y sanciones de EE.UU., incluidos los Reglamentos de Administración de Exportaciones de EE.UU. ("EAR") administrados por la Oficina de Industria y Seguridad ("BIS") del Departamento de Comercio y los reglamentos de embargo y sanciones administrados por la Oficina de Control de Activos Extranjeros ("OFAC") del Departamento del Tesoro de EE.UU.. El Servicio controlado bajo 5D002.c.1, ENC. El Cliente se asegurará de que todas las exportaciones, reexportaciones, transferencias, usos finales y Usuarios del Servicio cumplan las leyes y normativas sobre exportación y sanciones de los Estados Unidos y otras jurisdicciones aplicables, incluidas, entre otras, las de la Oficina de Industria y Seguridad de los Estados Unidos y la Oficina de Control de Activos Extranjeros. El Cliente declara que no está sujeto a restricciones en virtud de ninguna lista de usuarios finales restringidos del gobierno de EE. UU., y que no es propiedad ni está controlado en un 50% o más, directa o indirectamente, por ninguna persona o entidad identificada en dichas listas. El Cliente notificará inmediatamente a Palantir si queda sujeto a alguna de dichas restricciones. El Cliente se abstendrá de realizar cualquier acción que provoque que Palantir infrinja las leyes y normativas aplicables en materia de exportación y sanciones. Excepto por la obligación de pagar dinero, ninguna de las Partes será responsable de ningún incumplimiento o retraso en virtud del presente Acuerdo debido a cualquier causa que escape a su control razonable , incluidos, entre otros, actos de guerra, casos fortuitos, terremotos, inundaciones, embargos, disturbios, sabotajes, escasez o conflicto laboral, actos gubernamentales o fallos de Internet, telecomunicaciones o del proveedor de servicios de alojamiento, ataques informáticos o actos malintencionados; siempre que la Parte que haya sufrido el retraso (a) notifique inmediatamente a la otra Parte dicha causa; y (b) realice esfuerzos comercialmente razonables para corregir rápidamente dicho incumplimiento o retraso en el cumplimiento. Palantir tiene derecho a suspender inmediatamente el acceso al Servicio: (a) si el Cliente incumple sustancialmente este Acuerdo; (b) para evitar un incidente de seguridad que afecte al Cliente, al Contenido del Cliente o al Servicio; o (c) si el acceso continuado infringe las leyes aplicables o si así se requiere en virtud de las leyes o normativas aplicables o de solicitudes u órdenes de autoridades gubernamentales, reguladoras o judiciales. No existen terceros beneficiarios en virtud del presente Acuerdo, ya sea de forma expresa o implícita. Para evitar cualquier duda, nada de lo dispuesto en el presente Acuerdo se interpretará como la creación de una empresa conjunta, empleo, asociación, alianza estratégica, alianza formal o relación de asociación estratégica entre las Partes. El presente Acuerdo constituye la declaración completa y exclusiva del entendimiento mutuo de las Partes y sustituye y anula todos los acuerdos y comunicaciones anteriores, tanto escritos como orales, relativos al objeto del presente Acuerdo. En caso de conflicto entre estas Condiciones de servicio y cualquier Formulario de envío de pedido o anexo, prevalecerán los términos de dicho Formulario de envío de pedido o anexo. Palantir no está afiliada en modo alguno a The Saul Zaentz Company d.b.a. Tolkien Enterprises ni al Patrimonio de J.R.R. Tolkien, ni cuenta con su respaldo o patrocinio.
ADENDA ESPECÍFICA POR PAÍS
Para los Clientes ubicados en cualquiera de los países identificados en este Anexo específico por país (el "Anexo") y para quienes las Condiciones de servicio de Palantir ("Condiciones de servicio") no se rijan por la legislación de Nueva York (por ejemplo, debido a que la disposición sobre elección de legislación de la Sección 13 de las Condiciones de servicio no sea efectiva en virtud de la legislación aplicable), las siguientes disposiciones específicas por país sustituirán o complementarán las disposiciones equivalentes de las Condiciones de servicio, tal y como se indica. Los términos en mayúsculas utilizados en el presente Anexo que no se definan en el mismo tendrán el mismo significado que se les atribuye en las Condiciones del servicio.
ESPAÑA
1. Condiciones en el idioma local. Una copia de estas Condiciones del servicio traducidas al español está disponible en: [ INSERTAR ENLACE ] (las "Condiciones en español"). Para evitar cualquier duda, en caso de conflicto o incoherencia entre las anteriores Condiciones en español y esta versión en inglés (disponible en https://palantir.pactsafe.io/aip-now-6493.html#aip-now-tos-899513) de las Condiciones del servicio, prevalecerá la versión en inglés. Una copia del DPA traducido al español está disponible en https://palantir.pactsafe.io/aip-now-6493.html#template-0mqvxmskw (el “DPA en español”). Para evitar cualquier duda, en caso de conflicto o inconsistencia entre el DPA en español anterior y la versión en inglés del DPA, prevalecerá y regirá la versión en inglés del DPA.
2. Resolución de conflictos. La sección 13 de las Condiciones de servicio se suprime en su totalidad y se sustituye por el texto siguiente:
"13.RESOLUCIÓN DE DISPUTAS. CUALQUIER DISPUTA, CONTROVERSIA O RECLAMACIÓN DERIVADA DE ESTE ACUERDO O RELACIONADA CON EL MISMO, INCLUIDA LA ARBITRABILIDAD, QUE NO PUEDA RESOLVERSE TRAS CONVERSACIONES DE BUENA FE EN UN PLAZO DE SESENTA (60) DÍAS TRAS LA NOTIFICACIÓN DE UNA DISPUTA, SE RESOLVERÁ DEFINITIVAMENTE DE LA SIGUIENTE MANERA. EL DERECHO APLICABLE SERÁ EL DERECHO SUSTANTIVO DE ESPAÑA, INDEPENDIENTEMENTE DE LAS DISPOSICIONES SOBRE CONFLICTOS DE LEYES. TODAS LAS DISPUTAS QUE SURJAN DE ESTE ACUERDO O EN RELACIÓN CON EL MISMO SERÁN RESUELTAS POR UN TRIBUNAL DE ESPAÑA CON JURISDICCIÓN COMPETENTE SOBRE EL LUGAR DE DOMICILIO DEL CLIENTE EN ESPAÑA (Y SI EL CLIENTE NO TIENE DOMICILIO EN ESPAÑA, SERÁN COMPETENTES LOS TRIBUNALES DE MADRID), CON PROCEDIMIENTOS EN INGLÉS."
[SPANISH] Data Protection Addendum (AIP Now)
Effective May 16th 2025
DownloadTable of Contents
Última modificación: Mayo 2024
AL SELECCIONAR "ACEPTO" (O SU EQUIVALENTE) CUANDO DICHA OPCIÓN DISPONIBLE, O AL INSTALAR, EJECUTAR, DESCARGAR, ACCEDER O UTILIZAR DE CUALQUIER OTRO MODO CUALQUIER PARTE DE LA TECNOLOGÍA PALANTIR (TAL Y COMO SE DEFINE EN EL ACUERDO), USTED CONFIRMA QUE ("USTED" O "SU" O "USUARIO AUTORIZADO") HA LEÍDO EL PRESENTE APD, COMPRENDE LOS TÉRMINOS DEL MISMO Y QUE USTED, EN SU CALIDAD DE PERSONA FÍSICA O COMERCIANTE INDIVIDUAL, O USTED Y LA ENTIDAD A LA QUE REPRESENTA CONSIENTEN INCONDICIONALMENTE EN QUEDAR VINCULADOS POR EL PRESENTE APD Y SE CONVIERTEN EN PARTE DEL MISMO. SI ACEPTA ESTAS CONDICIONES EN CALIDAD DE PERSONA FÍSICA O COMERCIANTE INDIVIDUAL, TAMBIÉN DECLARA Y GARANTIZA QUE NO ESTÁ UTILIZANDO LA TECNOLOGÍA PALANTIR EN NOMBRE O BAJO LAS INSTRUCCIONES DE NINGÚN OTRO TERCERO O ENTIDAD JURÍDICA. SI CELEBRA ESTE ACUERDO EN NOMBRE DE UNA ENTIDAD, COMO LA EMPRESA, ORGANIZACIÓN O INSTITUCIÓN EDUCATIVA PARA LA QUE TRABAJA, USTED DECLARA Y GARANTIZA QUE ESTÁ AUTORIZADO A ACEPTAR LOS TÉRMINOS DE ESTE ACUERDO EN NOMBRE DE LA ENTIDAD COMO SU REPRESENTANTE LEGAL AUTORIZADO. SI NO ACEPTA INCONDICIONALMENTE TODOS LOS TÉRMINOS DE ESTE DPA, NO SELECCIONE "ACEPTO" (O EQUIVALENTE) CUANDO DICHA OPCIÓN ESTÉ DISPONIBLE Y NO INSTALE, EJECUTE, DESCARGUE, ACCEDA NI UTILICE DE NINGÚN OTRO MODO NINGUNA PARTE DE LA TECNOLOGÍA DE PALANTIR.
LA ACEPTACIÓN DE PALANTIR ESTÁ EXPRESAMENTE CONDICIONADA A SU CONFORMIDAD CON TODOS LOS TÉRMINOS Y CONDICIONES DE ESTE DPA, CON EXCLUSIÓN DE TODOS LOS DEMÁS TÉRMINOS; SI ESTOS TÉRMINOS SE CONSIDERAN UNA OFERTA, LA ACEPTACIÓN ESTÁ EXPRESAMENTE LIMITADA A ESTOS TÉRMINOS.
El cliente que acepta los términos del presente APD ("Cliente") y la entidad de Palantir Technologies firmante del Acuerdo ("Palantir"; cada uno de los cuales es una "Parte" y colectivamente las "Partes"), han celebrado un acuerdo (como las Condiciones de servicio y el Formulario de pedido de Palantir) que rige el uso por parte del Cliente de la Tecnología de Palantir, incluido el Servicio, y la prestación de Servicios profesionales relacionados al Cliente por parte de Palantir, incluidos los anexos, formularios de pedido, pruebas y apéndices de los mismos (colectivamente, el "Acuerdo"). Esta DPA complementa, se incorpora y forma parte del Acuerdo y establece los derechos y las obligaciones de Palantir y del Cliente con respecto a los Datos Personales del Cliente procesados por Palantir en nombre del Cliente en virtud del Acuerdo. Todos los términos en mayúscula utilizados pero no definidos en el presente APD tendrán el significado previsto en el Acuerdo. En la medida en que exista algún conflicto de significado entre cualquiera de las disposiciones del Acuerdo y este APD, prevalecerán y prevalecerán los términos y condiciones de este APD.
1. DEFINICIONES
1.1 Los siguientes términos en mayúsculas tendrán el significado que se indica a continuación:
- "País Adecuado" se refiere a un país que puede importar Datos Personales y que la autoridad gobernante del país exportador considera que proporciona un nivel adecuado de protección de datos en virtud de las Leyes de Protección de Datos aplicables;
- "Afiliada" significa una entidad que, directa o indirectamente, posee o controla o es propiedad o está controlada por, o está bajo propiedad o control común con, una Parte. Tal y como se utiliza en el presente documento, por "control" se entiende el poder de dirigir, directa o indirectamente, la gestión o los asuntos de una entidad, y por "propiedad" se entiende la titularidad efectiva de más del cincuenta por ciento de las acciones con derecho a voto u otras participaciones con derecho a voto equivalentes de una entidad. Con respecto a Palantir, Afiliada incluirá, sin limitarse a ellas, todas las entidades enumeradas en el Anexo A, Parte II y cualesquiera otras filiales de Palantir en cada momento;
- "Finalizaciones" tiene el significado que se le da en el Anexo D del presente APD;
- "Responsable del Tratamiento" significa la entidad que determina los fines y medios del Tratamiento de Datos Personales e incluye, según proceda, el término "responsable del tratamiento" "empresa" y cualesquiera otros términos similares o equivalentes en virtud de las Leyes de Protección de Datos aplicables;
- "Datos Personales del Cliente" significa cualquier Dato Personal contenido en los Datos del Cliente que esté sujeto a las Leyes de Protección de Datos;
- "Incidente relacionado con los Datos" hace referencia a cualquier infracción, tal y como se define en las Leyes de Protección de Datos aplicables, de la seguridad de Palantir que provoque la destrucción accidental o ilegal, la pérdida, la alteración, la divulgación no autorizada o el acceso a los Datos Personales del Cliente en los sistemas gestionados o controlados de otro modo por Palantir;
- "Autoridad de Protección de Datos" significa una autoridad competente responsable de hacer cumplir la aplicación de las Leyes de Protección de Datos pertinentes, e incluye, según corresponda, cualquier autoridad de protección de datos, regulador de privacidad, autoridad de supervisión, Fiscal General, agencia estatal de privacidad o cualquier organismo gubernamental o agencia que haga cumplir las Leyes de Protección de Datos;
- "Leyes de protección de datos" hace referencia a todas las leyes y normativas aplicables, en su versión modificada en cada momento, relativas a la protección de datos, la privacidad del consumidor, las comunicaciones electrónicas y las leyes de marketing en la medida en que sean aplicables al Tratamiento de los Datos Personales del Cliente por parte de Palantir en virtud del Acuerdo, tales como:
- Ley de Privacidad del Consumidor de California, Cal. Civ. Code § 1798.100 et seq. ("CCPA");
- Ley de Derechos de Privacidad de California de 2020 ("CPRA");
- Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos y por el que se deroga la Directiva 95/46/CE ("RGPD UE");
- El GDPR de la UE modificado e incorporado a la legislación del Reino Unido en virtud de la Ley de la Unión Europea (Retirada) del Reino Unido de 2018 ("GDPR del Reino Unido"); y
- Ley federal suiza de protección de datos de 19 de junio de 1992, sustituida y/o actualizada periódicamente ("FDP").
- "Responsable de Protección de Datos" se refiere a la persona física o jurídica designada cuando sea necesario en virtud de las Leyes de Protección de Datos aplicables para garantizar el cumplimiento de las Leyes de Protección de Datos por parte de una organización y cooperar con las Autoridades de Protección de Datos;
- "Interesado" significa la persona identificada o identificable a la que se refieren los Datos Personales, e incluye, en su caso, el término "consumidor" y cualesquiera otros términos similares o equivalentes conforme a la Legislación Aplicable en materia de Protección de Datos
- "Fecha de entrada en vigor del APD" significa la Fecha de entrada en vigor del Acuerdo;
- "EEE" significa el Espacio Económico Europeo;
- "Cláusulas contractuales tipo de la UE": las cláusulas contractuales tipo para su uso en relación con las exportaciones de Datos Personales desde el EEE aprobadas por la Comisión Europea en virtud de la Decisión de Ejecución 2021/914 de la Comisión, u otras cláusulas que las sustituyan en su
- Por "Datos Personales" se entiende: (a) cualquier información relativa a (i) una persona física identificada o identificable y/o (ii) una persona jurídica identificada o identificable (cuando dicha información esté protegida de forma similar a los Datos Personales o a la información personalmente identificable en virtud de las Leyes de Protección de Datos aplicables), y (b) cualquier información tratada o que reciba un tratamiento similar a los "datos personales", la "información personal", la "información personalmente identificable" o cualquier término similar o equivalente en virtud de las Leyes de Protección de Datos aplicables;
- Por "tratamiento" se entenderá cualquier operación o conjunto de operaciones, efectuadas o no mediante procedimientos automatizados, y aplicadas a Datos Personales, como la recogida, registro, organización, estructuración, conservación, adaptación o modificación, extracción, consulta, utilización, comunicación por transmisión, difusión o cualquier otra forma de habilitación de acceso, cotejo o interconexión, así como su limitación, supresión o destrucción. Los términos "tratar", "procesar" y "procesado" se interpretarán en consecuencia;
- "Encargado del tratamiento" se refiere a la entidad que trata Datos Personales por cuenta de un Responsable del tratamiento, incluidos, según proceda, los términos "encargado del tratamiento", "proveedor de servicios" "contratista" y cualesquiera términos equivalentes o similares que aborden las mismas responsabilidades, o similares, en virtud de las Leyes de Protección de Datos aplicables, según proceda;
- "Solicitud" significa una petición de un Sujeto de Datos o de cualquier persona que actúe en su nombre para ejercer sus derechos en virtud de las Leyes de Protección de Datos
- "Transferencia restringida" significa una transferencia, o transferencia ulterior, de Datos Personales desde un país en el que dicha transferencia estaría restringida o prohibida por las Leyes de Protección de Datos aplicables (o por los términos de un acuerdo de transferencia de datos establecido para abordar las restricciones de transferencia de datos de las Leyes de Protección de Datos) sin aplicar salvaguardas como las Cláusulas Contractuales Tipo que se establecerán en virtud de la cláusula 14 a continuación;
- "Documentación de seguridad" hace referencia a la Documentación que describe las normas de seguridad que se aplican al Servicio y que proporciona Palantir o Palantir en su nombre cada cierto tiempo;
- "Vender" o "Venta" significa vender, alquilar, ceder, revelar, difundir, poner a disposición, transferir o comunicar de cualquier otro modo oralmente, por escrito o por medios electrónicos o de otro tipo, los Datos Personales de un Sujeto de Datos a un tercero a cambio de una contraprestación económica.
- "Servicio" tendrá el significado establecido en el Acuerdo y en el presente APD.
- "Compartir" significa compartir, alquilar, ceder, revelar, difundir, poner a disposición, transferir o comunicar de cualquier otro modo oralmente, por escrito o por medios electrónicos o de otro tipo, los Datos Personales de un Sujeto de Datos a un tercero para publicidad conductual de contexto cruzado, ya sea o no a cambio de una contraprestación monetaria u otra contraprestación valiosa, incluidas las transacciones en las que no se intercambia dinero;
- "Subprocesador" hace referencia a cualquier procesador o proveedor de servicios que procese datos personales en nombre de Palantir con el fin de prestar el Servicio, tal y como se establece en el Acuerdo, el Anexo A y cualquier otro anexo pertinente aplicable de este APD.
- Por "Cláusulas Contractuales Tipo" o "CEC" se entenderá (a) las cláusulas tipo de protección de datos aprobadas de conformidad con las Leyes de Protección de Datos del país exportador aplicable en cada momento para legitimar las exportaciones de Datos Personales desde dicho país, o bien (b) cuando el país exportador aplicable disponga de Leyes de Protección de Datos que regulen la exportación de datos personales pero no de cláusulas tipo de protección de datos aprobadas, se aplicarán las CEC de la UE -en cada caso incorporando las Complementaciones adecuadas, y cuando exista más de una forma de dichas cláusulas aprobadas con respecto a un país concreto, las cláusulas que se aplicarán serán: (i) con respecto a cualquier situación en la que el Cliente actúe como Controlador de los Datos Personales del Cliente, la forma de las cláusulas que se apliquen a las transferencias de Controlador a Procesador; y (ii) con respecto a cualquier situación en la que el Cliente actúe como Procesador de los Datos Personales del Cliente, la forma de las cláusulas que se apliquen a las transferencias de Procesador a Procesador;
- "Medidas técnicas y organizativas" se refiere a las medidas técnicas y organizativas acordadas por las Partes en el Acuerdo y a cualquier medida técnica y organizativa adicional implementada por Palantir de conformidad con sus obligaciones en virtud de las Leyes de Protección de Datos aplicables
2. PLAZO
2.1 El presente APD entrará en vigor a partir de la Fecha de entrada en vigor del APD y permanecerá vigente hasta la destrucción o devolución de todos los Datos Personales del Cliente por parte de Palantir de conformidad con el Acuerdo, momento en el que finalizará automáticamente.
3. ÁMBITO DE APLICACIÓN
Este APD se incorpora al Acuerdo y forma parte de él, y establece los derechos y las obligaciones de Palantir y del Cliente con respecto a los Datos Personales del Cliente procesados por Palantir en nombre del Cliente durante la prestación del Servicio. En la medida en que exista algún conflicto de significado entre cualquiera de las disposiciones de del Acuerdo y este APD, prevalecerán y prevalecerán las disposiciones de este APD.
4. PAPEL DE LAS PARTES
4.1 Por la presente, el Cliente y cualquier Filial del Cliente pertinente nombran y dan instrucciones a Palantir como Procesador o Subprocesador, según corresponda, de los Datos Personales del Cliente. En consecuencia, las Partes cumplirán con las Leyes de Protección de Datos aplicables según corresponda a sus respectivos Procesamientos de Datos Personales del Cliente en virtud del Acuerdo.
4.2 Entre las Partes, el Cliente será responsable como Controlador (o Procesador, si el Cliente está Procesando Datos Personales con el Servicio para un Controlador tercero) y Palantir será responsable como Procesador (o Subprocesador), con respecto a los Datos Personales del Cliente procesados en virtud del Acuerdo.
4.3 En caso de que el Cliente actúe como Procesador (o Subprocesador) con respecto a los Datos Personales del Cliente, el Cliente declara y garantiza a Palantir que está válidamente autorizado por el Controlador correspondiente para celebrar el Acuerdo y este APD y para proporcionar Instrucciones del Cliente (según se define a continuación) en nombre del Controlador en relación con los Datos Personales del Cliente.
4.4 En caso de que el Cliente sea un empleado de Palantir o de un Afiliado de Palantir, el Cliente reconoce que no actúa en nombre de Palantir ni de ningún Afiliado de Palantir y que actúa como Controlador separado e independiente en relación con el Tratamiento de los Datos Personales del Cliente a través de la Tecnología Palantir.
4.5 En caso de que el Cliente controle conjuntamente los Datos Personales del Cliente con un Tercero Controlador, el Cliente declara y garantiza que su Tratamiento de los Datos Personales del Cliente en relación con su uso de la Tecnología Palantir está debidamente autorizado por dicho Tercero Controlador y se lleva a cabo de conformidad con las Leyes de Protección de Datos aplicables.
4.6 En caso de que el Cliente introduzca un nuevo Usuario en la Tecnología Palantir (tanto si dicho Usuario actúa en su propio nombre como en nombre de un tercero), el Cliente se asegurará de que dicho Usuario celebre un acuerdo independiente directamente con Palantir en relación con dicho uso (incluidas las Condiciones de servicio de Palantir aplicables y cualquier DPA relacionado) y reconoce que el uso de la Tecnología Palantir por parte de dicho Usuario estará condicionado a que así lo haga.
4.7 El objeto y los detalles del tratamiento se describen en el Contrato y en el presente APD, incluido el Anexo B (objeto y detalles del tratamiento de los Datos Personales del Cliente) y cualquier otro anexo pertinente para los Servicios adicionales aplicables.
4.8 Palantir procesará las Peticiones y Salidas como Datos de Uso, tal y como se describe con más detalle en el Acuerdo y en la Política de Privacidad de AIP Now, para asegurar el Servicio, incluida la supervisión de abusos o actividades maliciosas de los Usuarios.
5.TRATAMIENTO DE DATOS PERSONALES POR PARTE DEL CLIENTE
5.1 El Cliente se asegurará de que cualquier Procesamiento de Datos Personales del Cliente a través del uso del Servicio por parte del Cliente, incluidas las instrucciones proporcionadas a Palantir en relación con dicho Procesamiento, cumpla con todas las Leyes de Protección de Datos aplicables.
5.2 El Cliente da instrucciones a Palantir para que Procese los Datos Personales del Cliente: (a) con el fin de prestar el Servicio especificado en el Acuerdo y la Documentación o cumplir de otro modo con sus obligaciones en virtud de los mismos; (b) según lo iniciado por el Cliente a través del uso del Servicio por parte del Cliente o los Usuarios de conformidad con el Acuerdo y la Documentación; y/o (c) de conformidad con cualquier instrucción adicional fuera del ámbito del Acuerdo o de este APD, según lo documentado en cualquier otra instrucción escrita dada por el Cliente y reconocida por Palantir por escrito como instrucciones a los efectos de este APD (colectivamente, "Instrucciones del Cliente"). El Cliente reconoce que cualquier Instrucción del Cliente adicional emitida en virtud del punto (c) anterior puede dar lugar a cargos o tarifas adicionales para el Cliente por parte de Palantir, que se abonarán de conformidad con los términos del Acuerdo.
5.3 El Cliente será el único responsable del Tratamiento legal de los Datos Personales del Cliente en relación con su uso de la Tecnología Palantir y/o su recepción de cualquier Servicio Profesional relacionado de conformidad con las Leyes de Protección de Datos aplicables, incluyendo, sin limitación, la exactitud, calidad y legalidad de los Datos Personales del Cliente, los medios por los que adquiere y utiliza los Datos Personales del Cliente y las Instrucciones del Cliente relativas al Tratamiento de los Datos Personales del Cliente. El Cliente declara y garantiza que tiene (o que su Responsable tiene) una base legal válida para el Tratamiento de los Datos Personales del Cliente y que ha proporcionado (o se ha asegurado de que se proporcionen) todas las notificaciones y ha obtenido (o se ha asegurado de que se proporcionen) todos los consentimientos (incluidos los Consentimientos), autorizaciones, aprobaciones y/o acuerdos (incluidos, cuando el Cliente sea un Procesador o Subprocesador, con y del/de los Responsable(s) aplicable(s))) requeridos por las leyes o políticas aplicables para permitir que Palantir reciba y Procese los Datos Personales del Cliente de conformidad con este APD, el Acuerdo y las Instrucciones del Cliente.
5.4 El Cliente será responsable de orientar a los Usuarios sobre el uso de los Servicios y, en particular, sobre el uso de los Datos Personales dentro de los Servicios.
5.5 Los Datos Personales del Cliente no incluirán:
5.5.1 identificadores relacionados con la administración pública (término definido en la legislación aplicable en materia de protección de datos) en la medida en que el tratamiento de dichos identificadores no esté permitido por la legislación aplicable en materia de protección de datos;
5.5.2 Datos personales relativos a menores (de conformidad con la mayoría de edad pertinente en las jurisdicciones aplicables), a menos que lo permita la legislación aplicable en materia de protección de datos, o en cumplimiento de la misma.
5.5.3 Datos Personales que estén bajo el Control de otro Responsable del Tratamiento, sin su autorización expresa.
6. TRATAMIENTO DE DATOS PERSONALES DE CLIENTES POR PALANTIR
6.1 Palantir tratará los Datos Personales del Cliente para los fines comerciales de la prestación de los servicios al Cliente, en concreto, la Tecnología Palantir y los Servicios Profesionales de conformidad con las Instrucciones del Cliente y cualquier otro fin para el que el Cliente proporcione autorización a través del Servicio, cuando dicha opción esté disponible ("Fines Comerciales"), de conformidad con los términos del Acuerdo y esta DPA, así como con los requisitos establecidos por las Leyes de Protección de Datos aplicables. Para evitar cualquier duda, el Cliente revela Datos personales del Cliente a Palantir únicamente para los Fines comerciales limitados y especificados que se establecen en el Acuerdo y en las Instrucciones para el cliente. Palantir procesará los Datos personales del Cliente de conformidad con las instrucciones del Cliente y deberá:
(a) designar y mantener un responsable de la protección de datos, tal como exige la legislación en materia de protección de datos, con el que podrá ponerse en contacto enprivacy@palantir.com ;
(b) no Venderá ni Compartirá los Datos Personales del Cliente ni retendrá, utilizará, revelará ni Procesará de ningún otro modo los Datos Personales del Cliente fuera de la relación comercial directa entre las Partes ni para ningún otro fin que no sea el cumplimiento de los Objetivos comerciales de conformidad con las Instrucciones del Cliente, a menos que esté obligado a hacerlo por la legislación o normativa aplicable o por solicitudes u órdenes de entidades judiciales, gubernamentales o reguladoras (incluidas, entre otras, las citaciones), en cuyo caso Palantir informará al Cliente de dicho requisito legal antes de que se produzca dicho Procesamiento, a menos que esté legalmente prohibido hacerlo;
(c) no combinará los Datos Personales del Cliente con los Datos Personales que reciba de otras fuentes o que recopile a partir de sus propias interacciones con un Sujeto de Datos, siempre que Palantir pueda combinar los Datos Personales del Cliente según sea necesario para llevar a cabo sus Fines Comerciales y no Venderá ni Compartirá los Datos Personales del Cliente;
(d) implementar Medidas Técnicas y Organizativas adecuadas para proteger la confidencialidad, integridad, disponibilidad y resistencia de los sistemas de Palantir que procesan Datos Personales del Cliente. Palantir podrá actualizar las Medidas técnicas y organizativas de vez en cuando, siempre que dichas actualizaciones no sean menos protectoras que las Medidas técnicas y organizativas originales. En la medida en que dicha asistencia requiera que Palantir adopte medidas adicionales a las impuestas a Palantir por las Leyes de Protección de Datos o a las exigidas específicamente en virtud del Acuerdo; o en la medida en que las medidas técnicas y organizativas pertinentes sean necesarias como resultado de un acto u omisión por parte del Cliente o de una Parte que actúe en nombre del Cliente en incumplimiento del presente Acuerdo o de las Leyes de protección de datos, la obligación de Palantir de prestar dicha asistencia estará sujeta al pago por parte del Cliente de los honorarios razonables de Palantir en relación con dicha asistencia adicional; Las obligaciones de seguridad de Palantir en virtud del presente Acuerdo de colaboración en materia de datos se aplican sin perjuicio de las obligaciones de seguridad propias del Cliente en virtud de las Leyes de protección de datos aplicables;
(e) Garantizar que todas las personas autorizadas por Palantir para Procesar los Datos Personales del Cliente, incluidos los Subprocesadores (tal y como se definen a continuación), estén sujetas a obligaciones de confidencialidad coherentes con las establecidas en esta DPA, el Acuerdo o que, de otro modo, sean suficientes para cumplir los requisitos de las Leyes de Protección de Datos;
(f) tomar medidas razonables para devolver o destruir los Datos Personales del Cliente, cuando ya no sean necesarios a efectos de la prestación de los Servicios correspondientes a la terminación del Contrato, a menos que el almacenamiento se exija de otro modo en virtud de las Leyes de Protección de Datos aplicables; y
(g) procesar los Datos Personales del Cliente de forma coherente con el mismo nivel de protección de la privacidad que se exige al Cliente en virtud de las Leyes de Protección de Datos aplicables.
6.2 El Cliente dará instrucciones a Palantir en relación con el objeto y la duración del Tratamiento, la naturaleza y la finalidad del Tratamiento, el tipo de Datos Personales y las categorías de Sujetos de Datos, teniendo en cuenta las tareas y responsabilidades específicas del Encargado del Tratamiento en el contexto del Tratamiento que se llevará a cabo y el riesgo para los derechos y libertades del Sujeto de Datos como parte de las Instrucciones del Cliente. Sin perjuicio de lo dispuesto en el presente documento, el Cliente se asegurará de que sus actos u omisiones, incluso en relación con las Instrucciones del Cliente a Palantir, no supongan un incumplimiento de las Leyes de Protección de Datos por parte de Palantir.
6.3 El Cliente ha evaluado el nivel de seguridad adecuado para el Tratamiento en el contexto de sus obligaciones en virtud de las Leyes de Protección de Datos y acepta que las Medidas Técnicas y Organizativas son coherentes con dicha evaluación. Asimismo, el Cliente reconoce que Palantir no puede evaluar, y no tiene conocimiento de, los Datos Personales específicos proporcionados por el Cliente a Palantir o puestos a disposición de Palantir por parte del Cliente en relación con los Servicios y que, en consecuencia, las Medidas técnicas y organizativas propuestas por Palantir son de naturaleza genérica y Palantir no puede evaluar si reflejan o no los riesgos particulares que plantean los Datos Personales.
7. SUBPROCESADORES
7.1 El Cliente autoriza específicamente la contratación como Subprocesadores de (a) las entidades enumeradas en el Anexo A y/o en los anexos de Servicios adicionales específicos aplicables de este DPA y (b) todas las Filiales de Palantir en cada momento, siempre que, antes de permitir que dichos Subprocesadores procesen cualquier Dato Personal del Cliente, Palantir celebre un acuerdo por escrito con el Subprocesador en el que se impongan condiciones que sean coherentes con las establecidas en este DPA o que, de otro modo, sean suficientes para cumplir los requisitos de las Leyes de Protección de Datos.
7.2 Con sujeción a lo dispuesto en la Sección 7.3, el Cliente autoriza de forma general a Palantir a contratar Subprocesadores adicionales ("Subprocesadores Adicionales"), siempre que, antes de permitir que dicho Subprocesador Adicional procese Datos Personales del Cliente, Palantir celebre un acuerdo por escrito con el Subprocesador Adicional en el que se impongan condiciones que sean coherentes con las establecidas en el presente APD o que, de otro modo, sean suficientes para cumplir los requisitos de las Leyes de Protección de Datos.
7.3 Al menos 30 días antes de que Palantir inicie el uso de un Subprocesador Adicional en relación con la prestación de Servicios al Cliente, la lista actualizada de Subprocesadores para el Servicio estará disponible en el Anexo A, también accesible abajo, y Palantir proporcionará al Cliente un mecanismo para obtener notificación de dicha actualización. Las Partes acuerdan que esta notificación satisface los requisitos de notificación de la Sección 28.2 del GDPR y la Cláusula 9 del CCE. Cuando el Cliente indique por escrito que se opone al Tratamiento de los Datos Personales del Cliente por parte de dicho Subprocesador adicional de , las Partes tratarán de resolver las dudas del Cliente y, cuando sea necesario, el Cliente podrá ejercer sus derechos aplicables para rescindir el Acuerdo
7.4 En la medida en que lo exija la Ley de Protección de Datos, Palantir seguirá siendo responsable ante el Cliente del cumplimiento de las obligaciones del Subprocesador en relación con esta Sección 7 ("Responsabilidad de Protección de Datos del Subprocesador"), y Palantir podrá volver a cumplir o procurar el cumplimiento de dichas obligaciones, y el Cliente reconoce que dicho cumplimiento disminuirá cualquier reclamación que el Cliente tenga contra Palantir con respecto a cualquier Responsabilidad de Protección de Datos del Subprocesador.
8. AUDITORÍA
8.1 Palantir utiliza auditores externos para verificar la idoneidad de sus medidas de seguridad. Esta auditoría es realizada al menos una vez al año por auditores externos independientes y acreditados, a elección y expensas de Palantir, y de conformidad con la norma Service Organization Controls 2 (SOC2) o normas del sector sustancialmente equivalentes, y tiene como resultado la generación de un informe de auditoría ("Informe") que será Información Confidencial de Palantir. Asimismo, se certifica que el Servicio y las operaciones cumplen las normas y acreditaciones establecidas en la pestaña "cumplimiento y acreditación" en: https://www.palantir.com/information-security/ ("Acreditaciones").
8.2 Cuando el Cliente lo solicite por escrito, Palantir le proporcionará un resumen confidencial del Informe, la documentación que demuestre el cumplimiento de las Acreditaciones y la Información de Responsabilidad descrita en la Sección 10 de este APD para que el Cliente pueda verificar razonablemente el cumplimiento por parte de Palantir de las obligaciones de seguridad y protección de datos en virtud de este APD. Sin perjuicio de la Sección 8.3, si las Leyes de Protección de Datos, las Cláusulas Contractuales Estándar o el Acuerdo exigen que Palantir proporcione al Cliente acceso a las instalaciones o a la información de Palantir además del Informe y la Información de Responsabilidad, Palantir permitirá al Cliente auditar el cumplimiento por parte de Palantir de los términos y condiciones del presente APD en lo que respecta a los Datos Personales del Cliente en la medida en que lo exijan expresamente el Acuerdo, las Cláusulas Contractuales Estándar o las Leyes de Protección de Datos.
8.3 Para solicitar una auditoría de las instalaciones de Palantir en virtud de la presente Cláusula 8 (y cuando dicha auditoría esté autorizada en virtud de la Cláusula 8.2), el Cliente deberá notificarlo a Palantir y las Partes deberán acordar, tan pronto como sea razonablemente posible pero siempre por adelantado, las fechas razonables, la duración y el alcance de la auditoría, la identidad y las cualificaciones del auditor, así como los controles de seguridad y confidencialidad necesarios para acceder a la información o los Procesos en el ámbito de dicha auditoría. Palantir podrá rechazar la solicitud o negarse seguir cualquier instrucción solicitada por el Cliente en relación con las auditorías. En la medida en que Palantir rechace una solicitud de auditoría y dicha auditoría sea inequívocamente necesaria en virtud de las Leyes de Protección de Datos aplicables o del APD, el Cliente tendrá derecho a rescindir el Acuerdo de conformidad con el Acuerdo. El Cliente asumirá los costes razonables de Palantir en el cumplimiento de cualquier requisito en virtud de esta Sección. El alcance de cualquier auditoría realizada en virtud de la presente Sección 8 se limitará a los sistemas e instalaciones de Palantir utilizados para Tratar los Datos Personales del Cliente y la Documentación directamente relacionada con dicho Tratamiento.
8.4 Toda la información proporcionada o puesta a disposición del Cliente, su auditor o cualquier otro tercero autorizado en virtud del presente APD a tener acceso a la información anterior conformidad con la presente Sección 8 será Información Confidencial de Palantir.
8.5 En caso de que Palantir confirme un incumplimiento sustancial de los términos del presente Acuerdo, el Cliente podrá tomar las medidas razonables para subsanarlo, lo que incluye, entre otras cosas, exigir la suspensión de todo el Procesamiento de los Datos Personales del Cliente hasta que el Cliente determine que se ha subsanado el incumplimiento. En caso de que Palantir determine que ya no puede cumplir con sus obligaciones en virtud del presente Acuerdo, Palantir notificará de inmediato al Cliente dicha determinación.
9. RELACIONES CON LAS AUTORIDADES DE PROTECCIÓN DE DATOS Y EVALUACIONES DE IMPACTO SOBRE LA PROTECCIÓN DE DATOS
9.1 Palantir cooperará razonablemente, previa solicitud razonable y a expensas del Cliente, con cualquier Autoridad de Protección de Datos en el desempeño de sus funciones, teniendo en cuenta la naturaleza del Tratamiento realizado por Palantir y la información de que dispone.
9.2 Teniendo en cuenta la naturaleza del Servicio y la información de la que dispone Palantir, Palantir ayudará al Cliente a cumplir con las obligaciones del Cliente con respecto a las evaluaciones de impacto sobre la protección de datos (incluida una "evaluación de riesgos", una "evaluación de impacto sobre la privacidad", una "evaluación de protección de datos" o cualquier documentación equivalente) y la consulta previa o la presentación obligatoria a una Autoridad de Protección de Datos cuando sea aplicable en virtud de las Leyes de Protección de Datos, proporcionando el Informe, la Información de Responsabilidad y la Documentación.
10. RENDICIÓN DE CUENTAS
En la medida en que lo exijan las Leyes de Protección de Datos, Palantir mantendrá registros electrónicos de todas las categorías de actividades de Tratamiento llevadas a cabo en nombre del Cliente, que contendrán:
(a) el nombre y los datos de contacto de los encargados y subencargados del tratamiento;
(b) detalles de los tipos de tratamiento que se llevan a cabo;
(c) detalles de cualquier transferencia de Datos Personales del Cliente a un territorio u organización internacional fuera del EEE o del Reino Unido, y documentación de las salvaguardias adecuadas (si procede); y
(d) una descripción general de las medidas de seguridad técnicas y organizativas utilizadas en relación con el tratamiento,
en conjunto, la "Información sobre Responsabilidad".
11. DERECHOS DEL INTERESADO
11.1 Con respecto a los Datos Personales del Cliente, cuando Palantir reciba directamente una Solicitud de un Sujeto de Datos, o de cualquier persona autorizada a actuar en su nombre, cualquier reclamación o queja en relación con sus derechos en virtud de las Leyes de Protección de Datos, y siempre que Palantir pueda identificar razonablemente a partir de la información proporcionada que la solicitud, reclamación o queja está relacionada con el Cliente y los Datos Personales del Cliente, entonces, a menos que lo prohíba la legislación aplicable, Palantir remitirá la solicitud, reclamación o queja al Cliente.
11.2 El Servicio proporciona al Cliente controles, incluidas características y funcionalidades de seguridad, que el Cliente puede utilizar para recuperar, corregir, eliminar o restringir los Datos Personales del Cliente . El Cliente puede utilizar estos controles como medidas técnicas y organizativas para cumplir con sus obligaciones en virtud de las Leyes de Protección de Datos, para responder a las solicitudes de los Titulares de los Datos.
12. DATOS INCIDENTE
12.1 Palantir notificará al Cliente sin demoras indebidas después de tener conocimiento (o cuando así lo exijan las Leyes de protección de datos aplicables) de que existen motivos razonables para creer que se ha producido un Incidente de datos y proporcionará al Cliente toda la información que deba incluirse en virtud de las Leyes de protección de datos aplicables. Para evitar cualquier duda, una Incidencia de datos no incluirá actos u omisiones que no vulneren la seguridad de Palantir o la seguridad de cualquier Subprocesador; escaneos de puertos, pruebas de penetración autorizadas y ataques de denegación de servicio; o cualquier acceso o Tratamiento de Datos Personales del Cliente que sea coherente con las Instrucciones del Cliente. La notificación o respuesta de Palantir a un Incidente de datos de conformidad con esta Sección 12.1. no se interpretará como un reconocimiento por parte de Palantir de culpa o responsabilidad alguna con respecto al Incidente de datos.
12.2 Palantir proporcionará al Cliente cooperación y asistencia razonables para hacer frente a un Incidente de datos, en particular en relación con (a) la adopción de medidas comercialmente razonables para resolver cualquier problema de privacidad o seguridad de datos que afecte a cualquier Dato personal del Cliente; y (b) la prestación al Cliente de la asistencia necesaria y solicitada para que el Cliente pueda realizar las notificaciones oportunas a las personas afectadas por el Incidente de datos o a una Autoridad de supervisión en la medida en que sea razonablemente posible; siempre y cuando, el Cliente mantenga y siga una política eficaz de respuesta ante incidentes cibernéticos, que incluirá el uso del privilegio profesional legal, de litigio o de cliente-abogado, trabaje de buena fe con Palantir en relación con el Incidente de datos o, en el caso de que el Cliente actúe como particular o comerciante individual, siempre y cuando el Cliente mantenga y siga respuestas eficaces y necesarias ante incidentes y medidas de mitigación razonablemente esperadas de cualquier particular o comerciante individual y acuerde con Palantir la forma y el método de cualquier anuncio público en relación con el Incidente de datos.
12.3 Cualquier información proporcionada por Palantir en virtud de la presente Sección 12 será Información Confidencial de Palantir y la notificación o respuesta de Palantir a un Incidente de Datos en virtud de la presente Sección 12 no se interpretará como un reconocimiento por parte de Palantir o, si procede, de sus Subprocesadores de cualquier falta o responsabilidad con respecto a la prestación de cualquier Servicio o Servicio Profesional (según corresponda).
13. TRANSFERS DE DATOS
13.1 Palantir podrá Tratar Datos Personales en países distintos del país en el que esté establecido el Cliente en el que Palantir o sus Subprocesadores mantengan instalaciones, empleados o infraestructuras.
13.2 Cuando el Tratamiento de Datos Personales del Cliente en el curso de la prestación del Servicio implique una Transferencia Restringida de Datos Personales del Cliente por o en nombre del Cliente, desde un país que imponga restricciones a la transferencia de Datos Personales a países que no se consideren un País Adecuado, entonces:
(a) Por el presente, las Partes suscribirán un conjunto de CCE. Los CCE aplicables y los Complementos requeridos, según proceda, que figuran en el Anexo D, se considerarán incorporados al presente APD en y serán de aplicación entre el Cliente (como Exportador) y Palantir (como Importador)
(b) Palantir proporcionará las salvaguardas adecuadas, cumpliendo con los requisitos de los CEC respecto a las transferencias ulteriores, en relación con las transferencias de Datos Personales entre las Filiales de Palantir con el fin de prestar los Servicios; y
(c) Palantir se asegurará de que cualquier transferencia de Datos Personales del Cliente entre Palantir y cualquier Subprocesador tercero de Palantir esté sujeta a términos contractuales entre Palantir y el Subprocesador tercero correspondiente que proporcionen las salvaguardas adecuadas y contengan cláusulas equivalentes a los CEC.
13.3 Nada de lo dispuesto en este APD o en el Acuerdo modifica los derechos u obligaciones de Palantir o del cliente en virtud de las Cláusulas Contractuales Tipo.
14. RESPONSABILIDAD
14.1 Sin perjuicio de lo dispuesto en el apartado 14.2, la responsabilidad total combinada de cualquiera de las Partes y sus Afiliadas frente a la otra Parte y sus Afiliadas en virtud o en relación con el Contrato y las Cláusulas Contractuales Tipo combinadas será el límite de responsabilidad, y estará sujeta a las limitaciones de responsabilidad, establecido en el Contrato para la Parte correspondiente.
14.2 Nada de lo dispuesto en el presente APD sirve para modificar, inaplicar o enmendar los términos del Acuerdo relativos a la responsabilidad, incluidas, entre otras, cualesquiera exclusiones y/o limitaciones de responsabilidad.
14.3 El Cliente se asegurará de que todos los Datos del Cliente que cargue en el transcurso de la prestación del Servicio sean precisos y cumplan con todas las leyes aplicables. El Cliente defenderá e indemnizará a Palantir por todos y cada uno de los daños, responsabilidades, sanciones, multas y gastos (incluidos los de terceros) derivados del incumplimiento por parte del Cliente de la presente disposición o de cualquier ley aplicable en relación con los Datos del Cliente.
15. LEY APLICABLE Y JURISDICCIÓN
15.1 Las Partes modificarán los términos del presente DPA tan pronto como sea posible si dicha modificación es necesaria para que las partes cumplan con cualquier Ley de Protección de Datos, o con el fin de implementar o adherirse a las Cláusulas Contractuales Tipo o cualquier otro mecanismo de cumplimiento permitido en virtud de las Leyes de Protección de Datos.
15.2 Este APD, y cualquier disputa o reclamación (incluyendo cualquier disputa o reclamación no contractual) que surja de o en conexión con él, o su objeto o formación, se regirá e interpretará de acuerdo con las leyes que rigen el Acuerdo. Si es o se convierte en un requisito que, en virtud de las Leyes de Protección de Datos u otras leyes aplicables, este APD deba regirse por (a) las leyes de un estado miembro de la Unión Europea (y aún no se rige por ellas), este APD se regirá e interpretará de conformidad con las leyes de Irlanda; (b) las leyes del Reino Unido, este APD se regirá e interpretará de acuerdo con las leyes de Inglaterra y Gales, y/o (c) las leyes de cualquier otra jurisdicción, entonces este APD se regirá e interpretará de acuerdo con las leyes de dicha jurisdicción, pero sólo en la medida necesaria para satisfacer dichas leyes.
15.3 Las Partes acuerdan irrevocablemente que el foro establecido en el Acuerdo tendrá jurisdicción exclusiva para resolver cualquier controversia que pueda surgir de o en relación con el presente APD y los documentos que se suscriban en virtud del mismo y que, en consecuencia, cualquier procedimiento derivado del presente APD o relacionado con el mismo se interpondrá en dicho foro, salvo que cuando un requisito obligatorio de la Ley de Protección de Datos u otras leyes aplicables exija que los litigios derivados del presente APD o relacionados con el mismo y cualquier documento que se celebre en virtud del mismo se resuelvan en (a) un Estado miembro de la Unión Europea, en cuyo caso dichos litigios se resolverán en Irlanda; (b) el Reino Unido, en cuyo caso los litigios se resolverán en Inglaterra y Gales; y/o (c) cualquier otro foro alternativo, en cuyo caso los litigios se resolverán en dicho foro alternativo, en la medida en que la ley lo permita. Cada una de las Partes se somete irrevocablemente a la jurisdicción de dicho foro y renuncia a cualquier objeción a los procedimientos en cualquiera de dichos foros sobre la base de la jurisdicción o sobre la base de que los procedimientos se han iniciado en un foro inconveniente.
16. CONDICIONES GENERALES
16.1Si alguna disposición de este APD fuera inválida o inaplicable, el resto del APD seguirá siendo válido y vigente. La disposición inválida o inaplicable será (i) modificada en la medida necesaria para garantizar su validez y aplicabilidad, preservando al mismo tiempo la intención de las Partes en la medida de lo posible, o, cuando no sea posible, (ii) interpretada como si la parte inválida o inaplicable nunca hubiera estado contenida en ella.
16.2Palantir podrá notificar al Cliente por escrito de vez en cuando cualquier modificación del presente Acuerdo de colaboración en materia de protección de datos, incluidas las relativas a las transferencias transfronterizas, que sean necesarias como consecuencia de un cambio en las Leyes de protección de datos. Cualquiera de estas modificaciones requeridas entrará en vigor en la fecha en que transcurran 25 días laborables desde la fecha en que Palantir envíe dicha notificación por escrito al Cliente.
Anexo A
Lista de subprocesadores autorizados
PARTE I - Subprocesadores
Para cumplir con sus obligaciones en virtud de las Condiciones de Servicio de Palantir y el Acuerdo de Protección de Datos de Palantir (o el acuerdo alternativo por escrito entre el Cliente y Palantir, si procede), Palantir Technologies Inc. y sus Filiales pueden utilizar procesadores de datos de terceros ("Subprocesadores de Terceros") y Filiales de Palantir para procesar los Datos Personales del Cliente. Los términos en mayúscula utilizados pero no definidos aquí tendrán el significado que se les atribuye en el Acuerdo.
Por la presente, el Cliente autoriza específicamente a los siguientes terceros a realizar trabajos en calidad de Subprocesadores Terceros a efectos del Acuerdo.
| Subprocesadores terceros autorizados | ||||
| Subprocesador | Propósito | Dirección registrada | Ubicación | Mecanismo de transferencia |
| Amazon Web Services, Inc. | Alojamiento e infraestructura en la nube, servicios de alerta y notificación cifrada y servicios de IA | 410 Terry Avenue North, Seattle, WA 98109, EE.UU. | Según lo seleccionado por el Cliente en la Orden de Pedido o, en su caso, en otras partes del Contrato. | Cláusulas contractuales tipo |
| Corporación Microsoft | Alojamiento e infraestructura en la nube y servicios de IA (Microsoft Azure) | Una vía Microsoft Redmond, WA 98052, EE.UU. | La ubicación a efectos de la prestación del servicio de alojamiento en la nube es la seleccionada por el Cliente en el Formulario de pedido o, según proceda, en otras partes del Contrato. La ubicación a efectos de la prestación de los servicios de IA es el este de EE. UU., el centro-sur de EE. UU., el oeste de Europa y otras regiones de Azure a medida que estén disponibles. | Cláusulas contractuales tipo |
| Google LLC | Alojamiento e infraestructura en la nube (Google Cloud Platform) y servicios de IA. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, EE.UU. | La ubicación a efectos de la prestación del servicio de alojamiento en la nube es la seleccionada por el Cliente en el Formulario de pedido o, según proceda, en otras partes del Acuerdo. La ubicación a efectos de la prestación de los servicios de IA son todas las regiones disponibles para las funciones de IA Generativa en Google Vertex AI y otras regiones a medida que estén disponibles. | Cláusulas contractuales tipo |
| Proofpoint, Inc. | Servicio de alerta y notificación encriptada. | 892 Ross Drive, Sunnyvale, CA 94089, EE.UU. | Según lo seleccionado por el Cliente en la Orden de Pedido o, en su caso, en otras partes del Contrato. | Cláusulas contractuales tipo |
| Corporación Microsoft | Autenticación del usuario como proveedor de identidad (cuando el Cliente lo seleccione como proveedor de identidad). | Una vía Microsoft Redmond, WA 98052, EE.UU. | Estados Unidos | Cláusulas contractuales tipo |
| OpenAI LLC | Servicios de IA | 3180 18th Street, San Francisco, CA 94110, EE.UU. | La ubicación a efectos de la prestación del servicio de IA puede ser Estados Unidos y otras regiones a medida que estén disponibles. | Cláusulas contractuales tipo |
| Oracle America, Inc. | Infraestructura y alojamiento en la nube. | 500 Oracle Parkway, Redwood Shores, CA 94065 | Según lo seleccionado por el Cliente en la Orden de Pedido o, en su caso, en otras partes del Acuerdo. | Cláusulas contractuales tipo |
PARTE II - Afiliados de Palantir
Siempre que Palantir garantice un nivel adecuado de protección de datos de conformidad con las Leyes de Protección de Datos y el presente Acuerdo, el Cliente autoriza específicamente a las Filiales de Palantir enumeradas aquí y actualizadas periódicamente a actuar como Subprocesador(es) de Palantir, incluido el Procesamiento de Datos Personales del Cliente a los efectos del Acuerdo para la prestación de Servicios y/o Servicios Profesionales al Cliente. Cuando sea necesario, Palantir y sus respectivas Filiales habrán suscrito las Cláusulas Contractuales Estándar. Dicho Procesamiento, cuando proceda, se realizará bajo el control y la dirección de Palantir y se llevará a cabo en sistemas gestionados o controlados de otro modo por Palantir.
ANEXO B
Objeto y detalles del tratamiento de los datos personales del cliente
Palantir Privacidad Contacto
Categorías de interesados cuyos datos personales pueden ser objeto de tratamiento
Los Sujetos de Datos incluyen a las personas sobre las que se proporcionan Datos Personales a Palantir a través del Servicio (según corresponda) o de otro modo por parte del Cliente o de los Usuarios del Cliente (o por orden de éstos).
Categorías de datos personales de clientes
Datos Personales del Cliente proporcionados a Palantir para su Procesamiento (incluido a través del Servicio) por o bajo la dirección del Cliente o de los Usuarios del Cliente
Objeto del tratamiento
La prestación del Servicio y de los Servicios Profesionales por parte de Palantir y el cumplimiento de sus obligaciones en virtud del Acuerdo.
Naturaleza y finalidad del tratamiento
Palantir tratará los Datos Personales del Cliente de conformidad con los términos de esta DPA con el fin de proporcionar el Servicio y los Servicios Profesionales al Cliente, o según lo exija la legislación aplicable.
Duración del tratamiento
Continua durante la duración del Acuerdo, más el período comprendido entre la expiración del Acuerdo y la devolución o eliminación de todos los Datos Personales del Cliente por parte de Palantir de conformidad con el Acuerdo (incluida esta DPA), las Instrucciones del Cliente y la legislación aplicable.
Objeto, naturaleza y duración del tratamiento por los subencargados del tratamiento
Según lo establecido en el Anexo A. La duración de la sub-transformación es la establecida inmediatamente arriba.
ANEXO C - SERVICIOS APOLLO
El siguiente término en mayúsculas tendrá el significado que se indica a continuación:
"Servicios Apollo" hace referencia al Servicio específico seleccionado por el Cliente en el Formulario de pedido para la solución SaaS de despliegue continuo de extremo a extremo, que permite a los Usuarios gestionar de forma centralizada varias versiones de la Tecnología Palantir en entornos independientes y según se describe exclusivamente en el presente Anexo C para los Servicios Apollo, excluyendo la aplicación del Anexo A y el Anexo B del presente DPA;
ANEXO C-1
Lista de subprocesadores autorizados
PARTE I - Subprocesadores
Por la presente, el Cliente autoriza específicamente a los siguientes terceros a realizar trabajos como Subprocesadores de Terceros con el fin de prestar los Servicios Apollo al Cliente en virtud del Acuerdo.
| Subprocesadores terceros autorizados | ||||
| Subprocesador | Propósito | Dirección registrada | Ubicación | Mecanismo de transferencia |
| Amazon Web Services, Inc. | Alojamiento e infraestructura en la nube, servicios de alerta y notificación cifrada | 410 Terry Avenue North, Seattle, WA 98109, EE.UU. | Según lo seleccionado por el Cliente en la Orden de Pedido o, en su caso, en otras partes del Acuerdo. | Cláusulas contractuales tipo |
| Corporación Microsoft | Autenticación del usuario como proveedor de identidad (cuando el Cliente lo seleccione como proveedor de identidad). | Una vía Microsoft Redmond, WA 98052, EE.UU. | Estados Unidos | Cláusulas contractuales tipo |
PARTE II - Afiliados de Palantir
Tal y como se describe en la "PARTE II - Afiliadas de Palantir" del Anexo A.
ANEXO C-2
Objeto y detalles del tratamiento de los datos personales del cliente
Para la prestación de los Servicios Apollo, se aplicará lo siguiente:
Categorías de interesados cuyos datos personales pueden ser objeto de tratamiento
Los Sujetos de Datos incluyen a las personas sobre las que se proporcionan Datos Personales a Palantir a través del Servicio Apollo o de otro modo por parte del Cliente o de los Usuarios del Cliente (o por orden de éstos).
Categorías de datos personales de clientes
Datos Personales del Cliente proporcionados a Palantir para su Procesamiento a través del Servicio Apollo por el Cliente o los Usuarios del Cliente, o bajo sus instrucciones. Las categorías de Datos Personales del Cliente incluyen los datos de identificación de los Usuarios: nombre, direcciones, direcciones de correo electrónico e identificaciones.
Objeto del tratamiento
La prestación del Servicio Apollo por parte de Palantir en virtud del Acuerdo.
Naturaleza y finalidad del tratamiento
Palantir tratará los Datos Personales del Cliente detallados anteriormente de conformidad con los términos de esta DPA con el fin de configurar las cuentas de los Usuarios de Apollo, proporcionar el Servicio Apollo al Cliente, incluido el análisis de entornos gestionados en busca de vulnerabilidades, o según lo exija la legislación aplicable
Duración del tratamiento
Continua durante la duración del Acuerdo, más el período comprendido entre la expiración del Acuerdo y la devolución o eliminación de todos los Datos Personales del Cliente por parte de Palantir de conformidad con el Acuerdo (incluida esta DPA), las Instrucciones del Cliente y la legislación aplicable.
Objeto, naturaleza y duración del tratamiento por los subencargados del tratamiento
Según lo establecido en el Anexo A. La duración de la sub-transformación es la establecida inmediatamente arriba.
ANEXO D
Adiciones a las cláusulas contractuales tipo
El siguiente término en mayúsculas tendrá el significado que se indica a continuación:
"Adenda del Reino Unido" significa la adenda de transferencia internacional de datos a los CCE de la UE emitida por el Comisionado de Información del Reino Unido en virtud de la s. 119A de la Ley de Protección de Datos de 2018, o cualquier otra adenda que pueda modificar o reemplazar la adenda de vez en cuando.
"Finalizaciones
(i) en relación con los SCC de la UE en relación con las exportaciones del EEE:
a) se suprime la redacción facultativa de las cláusulas 7 y 11
b) en la Cláusula 8.9 de dichas CEC, se añade el siguiente párrafo después del apartado (d):
"e) No obstante lo anterior, cualquier auditoría tendrá un alcance y un parámetro limitados a los sistemas que traten los datos personales pertinentes.
Cuando las auditorías incluyan inspecciones, se llevarán a cabo con una antelación razonable. Las partes acordarán mutuamente el alcance, el calendario, la duración y los requisitos de control y prueba de la auditoría, siempre que este requisito de acuerdo no permita al importador de datos retrasar injustificadamente la realización de la auditoría.
Cualquier auditoría realizada en virtud de la presente cláusula (i) correrá a cargo del exportador de datos solicitante, y dichos gastos incluirán cualquier coste relacionado razonable del importador de datos, incluida la compensación por las horas trabajadas por el personal del importador de datos; (ii) si el exportador de datos desea contratar a un auditor independiente, sólo podrá realizarla una parte aprobada previamente por el importador de datos, aprobación que no podrá denegarse injustificadamente; y (iii) estará sujeta a un acuerdo de confidencialidad."
c) en la cláusula 9, se suprime la opción 1 y el plazo no será inferior a 30 días;
d) se mantiene la redacción aplicable para la cláusula 13(a) de las CEC de la UE (según lo determinado por las instrucciones entre corchetes en dichas CEC) y se suprimen las dos alternativas restantes
e) en la Cláusula 17 de las CEC de la UE, se suprime la Opción 2 y se completa la Opción 1 con los detalles de las leyes de Irlanda y en la Cláusula 18(b) de las CEC de la UE se completa con los detalles de los tribunales de Irlanda;
f) las partes que figuran en el Anexo 1 se completarán con los nombres del Cliente como exportador y de Palantir como importador, las transferencias serán las descritas en el Anexo B y en cualquier otro anexo pertinente para los Servicios adicionales aplicables en virtud del presente APD y la autoridad supervisora será la autoridad supervisora irlandesa; en el Anexo II, la lista de medidas técnicas y organizativas de serán las Medidas técnicas y organizativas y, en el Anexo III, la lista de subprocesadores será la que figura en el Anexo A; y
g) en caso de que las CEC de la UE sean sustituidas respecto a las vigentes en la Fecha de Entrada en Vigor, se realizarán las adiciones a las CEC revisadas que más se aproximen a las establecidas anteriormente.
(ii) en relación con los CEC de la UE en relación con las exportaciones de otras jurisdicciones distintas del EEE, se aplicarán los complementos establecidos en (i)(a)-(g), salvo que:
a) en la Cláusula 17 de dichas CEC de la UE, la segunda frase se sustituye por lo siguiente: "Las Partes acuerdan que ésta será la ley inglesa", salvo cuando se exija otra ley rectora de las CEC de la UE como requisito obligatorio de la Ley de Protección de Datos del país pertinente, en cuyo caso la Cláusula 17 se completará con los detalles de la ley que dicha Ley de Protección de Datos exige que se aplique a dichas CEC de la UE;
b) La Cláusula 18(b) se sustituye por la siguiente "18(b) Las Partes acuerdan que serán los tribunales de Inglaterra y Gales", salvo cuando otro país, estado o territorio deba tener jurisdicción sobre las CEC de la UE como requisito obligatorio de la Ley de Protección de Datos del país correspondiente, en cuyo caso la Cláusula 18(b) de dichas CEC de la UE se completará con los detalles del país, estado o territorio que dicha Ley de Protección de Datos exige que tenga jurisdicción sobre las CEC de la UE;
c) las referencias en el CEC de la UE a "un tercero situado fuera de la Unión Europea" se sustituyen por referencias a "un tercero situado fuera del país o territorio en el que esté establecido el exportador de datos
d) las referencias en dicho CCE de la UE al "Estado miembro" se sustituyen por referencias al "país o territorio en el que esté establecido el exportador de datos
e) todas las referencias al GDPR en dicho CCE de la UE se sustituyen por referencias a la Ley de Protección de Datos del país pertinente y las referencias a disposiciones o conceptos del GDPR se sustituyen por referencias a las disposiciones o conceptos de dicha Ley de Protección de Datos más estrechamente relacionados con el término pertinente tal como se entiende en el GDPR
f) todas las referencias a los Estados miembros de la Unión Europea o a la Unión Europea se sustituyen por referencias al país de establecimiento del exportador;
g) salvo cuando sea obligatorio en virtud de la correspondiente Ley de Protección de Datos, se suprimirán e ignorarán todas las referencias en el CEC de la UE a (a) derechos de los interesados u otros derechos de terceros beneficiarios o (b) a obligaciones o responsabilidad frente a los interesados u otros terceros; y
h) en la medida en que cualquiera de las referencias a las CEC de la UE mencionadas anteriormente en los puntos (i) a (viii) sea sustituida en cualquier disposición modificada o cláusula o instrumento sustitutivo o aprobado posteriormente tras la Fecha de Entrada en Vigor, las modificaciones previstas anteriormente en los puntos (ii)(a)-(h) se adaptarán y/o completarán si procede y en la medida en que proceda para reflejar el efecto de las primeras lo más fielmente posible.
(iii) en relación con las CEC relativas a las exportaciones desde el Reino Unido, se aplicarán las CEC de la UE modificadas por (i) el "Apéndice del Reino Unido a las Cláusulas Contractuales Tipo de la Comisión de la UE" del Comisario de Información, que se encuentra en https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdfhttps://ico.org.uk/media/about-the-ico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf, o (ii) el apéndice sustitutivo de las Cláusulas Contractuales Tipo de la UE que el Comisario de Información pueda publicar de vez en cuando (estos apéndices se conocen como "CEC del Reino Unido"), con los siguientes puntos completados (o en el caso de (ii) los puntos que más se aproximen a los siguientes):
a) en la medida en que no estén cubiertos por lo anterior, se aplicarán los complementos establecidos en (i)(a)-(g), salvo que:
b) La Tabla 1 se completará con los nombres del Cliente como exportador y de Palantir como importador;
c) en el cuadro 2, el módulo de las CEC de la UE seleccionado se determinará de conformidad con la definición de CEC que figura a continuación;
d) en el Cuadro 4 se seleccionará la opción "ninguna de las partes",
(iv) en relación con las SCC relativas a las exportaciones desde Suiza, se aplicarán las SCC de la UE (incorporando las finalizaciones establecidas en (i)(a)-(g) anteriores), modificadas por (a) la decisión orientativa de la FDPIC de 27 de agosto de 2021 que se encuentra en https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222 y que establece las modificaciones que deben introducirse en las SCC de la UE con respecto a las transferencias sujetas al FADP suizo o (b) la decisión sustitutiva de la FDPIC relativa a las modificaciones que deben introducirse en las SCC de la UE de vez en cuando (estas modificaciones se conocen como las "SCC suizas");
(v) en lo que respecta a los SCC en relación con las exportaciones de cualquier otro país, se llevarán a cabo las finalizaciones establecidas en (i)(a)-(g) anteriores u otras finalizaciones que se aproximen lo más posible al mismo resultado que dichas finalizaciones
Con respecto a cualquier transferencia de Datos Personales que pueda producirse en el transcurso de la prestación del Servicio, se aplicarán las condiciones del Módulo 2 (Responsable del tratamiento a Responsable del tratamiento), tal y como se establece a continuación en el Anexo 1 del Documento D, en la medida en que el Cliente sea Responsable del tratamiento de los Datos Personales del Cliente. Las condiciones del Módulo 3 (Encargado del tratamiento a Encargado del tratamiento), según lo dispuesto a continuación en el Anexo 2 del Anexo D, se aplicarán en la medida en que el Cliente sea Encargado del tratamiento (o subencargado del tratamiento) de los Datos personales del cliente. Tanto para el Módulo 2 como para el Módulo 3 de las Cláusulas Contractuales Tipo, la elección de términos específicos y/o la adición de la información requerida se aplicarán de la siguiente manera:
(a) Se mantiene la redacción aplicable a la cláusula 13(a) de las Cláusulas Contractuales Tipo (tal y como se determina en las instrucciones entre corchetes de las Cláusulas Contractuales Tipo) y se suprimen las dos alternativas restantes;
(b) los detalles de los Subencargados del Tratamiento que el importador de datos tiene intención de contratar, tal y como figuran en el Anexo A y/o en cualquier otro anexo pertinente para los Servicios adicionales aplicables, respectivamente, del presente Acuerdo , constituyen la "lista acordada" de Subencargados del Tratamiento a la que se hace referencia en la Cláusula 9(a) de las Cláusulas Contractuales Tipo.
ANEXO 1 A LA PRUEBA
CLÁUSULAS CONTRACTUALES TIPO
CLÁUSULAS CONTRACTUALES TIPO
Módulo 2: De controlador a procesador
SECCIÓN I
Artículo 1
Objeto y ámbito de aplicación
(a) El objeto de las presentes cláusulas contractuales tipo es garantizar el cumplimiento de los requisitos del Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos (Reglamento general de protección de datos) ([1] ) para la transferencia de datos a un tercer país.
(b) Las Partes:
(i) la(s) persona(s) física(s) o jurídica(s), autoridad(es) pública(s), agencia(s) u otro(s) organismo(s) (en lo sucesivo, "entidad(es)") que transfiere(n) los datos personales, enumerados en el anexo I.A (en lo sucesivo, "exportador(es) de datos"), y
(ii) la(s) entidad(es) de un tercer país que reciba(n) los datos personales del exportador de datos, directa o indirectamente a través de otra entidad que también sea Parte en las presentes cláusulas, enumerada en el anexo I.A (en lo sucesivo, "importador de datos")
han aceptado las presentes cláusulas contractuales tipo (en adelante: "Cláusulas").
(c) Las presentes Cláusulas se aplican a la transferencia de datos personales tal como se especifica en el Anexo I.B.
(d) El Apéndice de las presentes Cláusulas que contiene los Anexos en él mencionados forma parte integrante de las presentes Cláusulas.
Artículo 2
Efecto e invariabilidad de las cláusulas
(a) Las presentes Cláusulas establecen garantías adecuadas, incluidos derechos exigibles de los interesados y recursos jurídicos efectivos, de conformidad con el artículo 46, apartado 1, y el artículo 46, apartado 2, letra c), del Reglamento (UE) 2016/679 y, con respecto a las transferencias de datos de responsables a encargados y/o encargados a encargados, cláusulas contractuales tipo de conformidad con el artículo 28, apartado 7, del Reglamento (UE) 2016/679, siempre que no se modifiquen, salvo para seleccionar el Módulo o Módulos adecuados o para añadir o actualizar información en el Apéndice. La presente no impide a las Partes incluir las cláusulas contractuales tipo establecidas en las presentes Cláusulas en un contrato más amplio y/o añadir otras cláusulas o garantías adicionales, siempre que no contradigan, directa o indirectamente, las presentes Cláusulas ni perjudiquen los derechos o libertades fundamentales de los interesados.
(b) Las presentes Cláusulas se entienden sin perjuicio de las obligaciones a las que esté sujeto el exportador de datos en virtud del Reglamento (UE) 2016/679.
Artículo 3
Terceros beneficiarios
(a) Los interesados podrán invocar y hacer valer las presentes Cláusulas, como terceros beneficiarios, frente al exportador de datos y/o al importador de datos, con las siguientes excepciones:
(i) Cláusula 1, Cláusula 2, Cláusula 3, Cláusula 6, Cláusula 7;
(ii) Cláusula 8.1(b), 8.9(a), (c), (d) y (e)
(iii) Cláusula 9(a), (c), (d) y (e)
(iv) Cláusula 12(a), (d) y (f);
(v) Art. 13;
(vi) Cláusula 15.1(c), (d) y (e);
(vii) Cláusula 16(e);
(viii) Cláusula 18(a) y (b).
(b) La letra a) se entiende sin perjuicio de los derechos de los interesados en virtud del Reglamento (UE) 2016/679.
Artículo 4
Interpretación
(a) Cuando en las presentes Cláusulas se utilicen términos definidos en el Reglamento (UE) 2016/679, dichos términos tendrán el mismo significado que en dicho Reglamento.
(b) Las presentes Cláusulas se leerán e interpretarán a la luz de lo dispuesto en el Reglamento (UE) 2016/679.
(c) Las presentes Cláusulas no se interpretarán de forma contraria a los derechos y obligaciones previstos en el Reglamento (UE) 2016/679.
Artículo 5
Jerarquía
En caso de contradicción entre estas Cláusulas y las disposiciones de los acuerdos relacionados entre las Partes, existentes en el momento de acordar estas Cláusulas o celebrados con posterioridad, prevalecerán estas Cláusulas.
Artículo 6
Descripción de la(s) transferencia(s)
Los detalles de la(s) transferencia(s), y en particular las categorías de datos personales que se transfieren y los fines para los que se transfieren, se especifican en el Anexo I.B.
Artículo 7
Cláusula de atraque
[se ha dejado en blanco intencionadamente]
SECCIÓN II - OBLIGACIONES DE LAS PARTES
Artículo 8
Protección de datos
El exportador de datos garantiza que ha realizado esfuerzos razonables para determinar que el importador de datos es capaz, mediante la aplicación de medidas técnicas y organizativas adecuadas, de cumplir las obligaciones que le incumben en virtud de las presentes cláusulas.
8.1 Instrucciones
(a) El importador de datos tratará los datos personales únicamente siguiendo instrucciones documentadas del exportador de datos. El exportador de datos podrá dar dichas instrucciones durante toda la vigencia del contrato.
(b) El importador de datos informará inmediatamente al exportador de datos si no puede seguir dichas instrucciones.
8.2 Limitación de la finalidad
El importador de datos tratará los datos personales únicamente para los fines específicos de la transferencia, tal como se establece en el anexo I.B, salvo que reciba instrucciones adicionales del exportador de datos.
8.3 Transparencia
Previa solicitud, el exportador de datos pondrá gratuitamente a disposición del interesado una copia de las presentes cláusulas, incluido el apéndice completado por las Partes. En la medida en que sea necesario para proteger secretos comerciales u otra información confidencial, incluidas las medidas descritas en el anexo II y los datos personales, el exportador de datos podrá suprimir parte del texto del apéndice de las presentes cláusulas antes de compartir una copia, pero facilitará un resumen significativo cuando, de otro modo, el interesado no pudiera comprender su contenido o ejercer sus derechos. Previa solicitud, las Partes comunicarán al interesado los motivos de las supresiones, en la medida de lo posible sin revelar la información suprimida. La presente cláusula se entiende sin perjuicio de las obligaciones del exportador de datos en virtud de los artículos 13 y 14 del Reglamento (UE) 2016/679.
8.4 Precisión
Si el importador de datos tiene conocimiento de que los datos personales que ha recibido son inexactos o han quedado obsoletos, informará al exportador de datos sin demora injustificada. En este caso, el importador de datos cooperará con el exportador de datos para borrar o rectificar los datos.
8.5 Duración del tratamiento y supresión o devolución de los datos
El tratamiento por parte del importador de datos sólo tendrá lugar durante el período especificado en el anexo I.B. Una vez finalizada la prestación de los servicios de tratamiento, el importador de datos, a elección del exportador de datos, suprimirá todos los datos personales tratados por cuenta del exportador de datos y certificará al exportador de datos que así lo ha hecho, o devolverá al exportador de datos todos los datos personales tratados por cuenta suya y suprimirá las copias existentes. Hasta que se supriman o devuelvan los datos, el importador de datos seguirá garantizando el cumplimiento de las presentes cláusulas. En caso de que la legislación local aplicable al importador de datos prohíba la devolución o supresión de los datos personales, el importador de datos garantiza que seguirá velando por el cumplimiento de las presentes Cláusulas y que sólo los tratará en la medida y durante el tiempo que exija dicha legislación local. Esto se entiende sin perjuicio de la Cláusula 14, en particular el requisito de que el importador de datos, en virtud de la Cláusula 14(e), notifique al exportador de datos durante toda la duración del contrato si tiene motivos para creer que está o ha pasado a estar sujeto a leyes o prácticas que no se ajustan a los requisitos de la Cláusula 14(a).
8.6 Seguridad del tratamiento
(a) El importador de datos y, durante la transmisión, también el exportador de datos aplicarán las medidas técnicas y organizativas apropiadas para garantizar la seguridad de los datos, incluida la protección contra quebrantamientos de la seguridad que provoquen la destrucción, accidental o ilícita, la pérdida, la alteración, la difusión o el acceso no autorizados, de dichos datos (en lo sucesivo, "violación de los datos personales"). Al evaluar el nivel adecuado de seguridad, las Partes tendrán debidamente en cuenta el estado de la técnica, los costes de aplicación, la naturaleza, el alcance, el contexto y la finalidad o finalidades del tratamiento, así como los riesgos que entraña el tratamiento para los interesados. Las Partes considerarán, en particular, la posibilidad de recurrir al cifrado o a la seudonimización, incluso durante la transmisión, cuando la finalidad del tratamiento pueda cumplirse de ese modo. En caso de seudonimización, la información adicional para atribuir los datos personales a un interesado específico permanecerá, siempre que sea posible, bajo el control exclusivo del exportador de datos. En cumplimiento de sus obligaciones en virtud del presente apartado, el importador de datos aplicará, como mínimo, las medidas técnicas y organizativas especificadas en el anexo II. El importador de datos llevará a cabo controles periódicos para garantizar que dichas medidas siguen proporcionando un nivel de seguridad adecuado.
(b) El importador de datos sólo concederá acceso a los datos personales a los miembros de su personal en la medida estrictamente necesaria para la ejecución, gestión y supervisión del contrato. Garantizará que las personas autorizadas a tratar los datos personales se hayan comprometido a mantener la confidencialidad o estén sometidas a una obligación legal adecuada de confidencialidad.
(c) En caso de violación de datos personales relativos a datos personales tratados por el importador de datos con arreglo a las presentes cláusulas, el importador de datos adoptará las medidas adecuadas para hacer frente a la violación, incluidas medidas para mitigar sus efectos adversos. El importador de datos también notificará al exportador de datos sin demora injustificada tras haber tenido conocimiento de la violación. Dicha notificación contendrá los datos de un punto de contacto en el que pueda obtenerse más información, una descripción de la naturaleza de la violación (incluidas, cuando sea posible, las categorías y el número aproximado de interesados y registros de datos personales afectados), sus consecuencias probables y las medidas adoptadas o propuestas para hacer frente a la violación, incluidas, en su caso, medidas para mitigar sus posibles efectos adversos. Cuando, y en la medida en que, no sea posible facilitar toda la información al mismo tiempo, la notificación inicial contendrá la información de que se disponga en ese momento y posteriormente, a medida que se disponga de ella, se facilitará sin demora indebida información adicional .
(d) El importador de datos cooperará con el exportador de datos y le prestará asistencia para que este pueda cumplir las obligaciones que le incumben en virtud del Reglamento (UE) 2016/679, en particular la notificación a la autoridad de control competente y a los interesados afectados, teniendo en cuenta la naturaleza del tratamiento y la información de que disponga el importador de datos.
8.7 Datos sensibles
Cuando la transferencia incluya datos personales que revelen el origen racial o étnico, las opiniones políticas, las convicciones religiosas o filosóficas, o la afiliación sindical, datos genéticos o datos biométricos destinados a identificar de manera unívoca a una persona física, datos relativos a la salud o a la vida sexual u orientación sexual de una persona, o datos relativos a condenas e infracciones penales (en lo sucesivo, "datos sensibles"), el importador de datos aplicará las restricciones específicas y/o las garantías adicionales descritas en el anexo I.B.
8.8 Transferencias ulteriores
El importador de datos sólo revelará los datos personales a un tercero siguiendo instrucciones documentadas del exportador de datos. Además, los datos sólo podrán ser revelados a un tercero situado fuera de la Unión Europea ([2] ) (en el mismo país que el importador de datos o en otro tercer país, en lo sucesivo "transferencia ulterior") si el tercero está o acepta quedar vinculado por las presentes Cláusulas, en virtud del Módulo correspondiente, o si:
(i) la transferencia ulterior es a un país que se beneficia de una decisión de adecuación de conformidad con el artículo 45 del Reglamento (UE) 2016/679 que cubre la transferencia ulterior;
(ii) el tercero garantiza de otro modo las garantías adecuadas de conformidad con los artículos 46 o 47 del Reglamento (UE) 2016/679 con respecto al tratamiento en cuestión;
(iii) la transferencia ulterior es necesaria para el establecimiento, ejercicio o defensa de reclamaciones legales en el contexto de procedimientos administrativos, reglamentarios o judiciales específicos; o
(iv) la transferencia ulterior es necesaria para proteger los intereses vitales del interesado o de otra persona física.
Toda transferencia ulterior está sujeta al cumplimiento por parte del importador de datos de todas las demás salvaguardias previstas en las presentes cláusulas, en particular la limitación de la finalidad.
8.9 Documentación y conformidad
(a) El importador de datos atenderá rápida y adecuadamente las consultas del exportador de datos relacionadas con el tratamiento previsto en las presentes cláusulas.
(b) Las Partes deberán poder demostrar el cumplimiento de estas Cláusulas. En particular, el importador de datos conservará la documentación adecuada sobre las actividades de tratamiento realizadas en nombre del exportador de datos.
(c) El importador de datos pondrá a disposición del exportador de datos toda la información necesaria para demostrar el cumplimiento de las obligaciones establecidas en las presentes cláusulas y, a petición del exportador de datos, permitirá y contribuirá a las auditorías de las actividades de tratamiento cubiertas por las presentes cláusulas, a intervalos razonables o si existen indicios de incumplimiento. A la hora de decidir sobre una revisión o auditoría, el exportador de datos podrá tener en cuenta las certificaciones pertinentes que posea el importador de datos.
(d) El exportador de datos podrá optar por realizar la auditoría por sí mismo o encargarla a un auditor independiente. Las auditorías podrán incluir inspecciones en los locales o instalaciones físicas del importador de datos y, en su caso, se llevarán a cabo con una antelación razonable.
(e) Las Partes pondrán a disposición de la autoridad de control competente, previa solicitud, la información mencionada en las letras b) y c), incluidos los resultados de cualquier auditoría.
Artículo 9
Uso de subprocesadores
(a) OPCIÓN 2 AUTORIZACIÓN GENERAL POR ESCRITO: El importador de datos cuenta con la autorización general del exportador de datos para la contratación de uno o varios subencargados del tratamiento a partir de una lista acordada. El importador de datos informará específicamente por escrito al exportador de datos de cualquier cambio previsto en dicha lista mediante la adición o sustitución de subencargados del tratamiento con al menos 14 días de antelación, dando así al exportador de datos tiempo suficiente para poder oponerse a dichos cambios antes de la contratación del subencargado o subencargados del tratamiento. El importador de datos facilitará al exportador de datos la información necesaria para que éste pueda ejercer su derecho de oposición.
(b) Cuando el importador de datos contrate a un subencargado del tratamiento para llevar a cabo actividades específicas de tratamiento (en nombre del exportador de datos), lo hará mediante un contrato escrito que establezca, en esencia, las mismas obligaciones de protección de datos que las que vinculan al importador de datos en virtud de las presentes cláusulas, incluso en lo que respecta a los derechos de terceros beneficiarios para los interesados. ([3] ) Las Partes acuerdan que, mediante el cumplimiento de esta Cláusula, el importador de datos cumple sus obligaciones en virtud de la Cláusula 8.8. El importador de datos velará por que el subencargado del tratamiento cumpla las obligaciones a las que está sujeto el importador de datos en virtud de las presentes cláusulas.
(c) El importador de datos facilitará, a petición del exportador de datos, una copia de dicho acuerdo de subencargado del tratamiento y de cualquier modificación posterior al exportador de datos. En la medida necesaria para proteger los secretos comerciales u otra información confidencial, incluidos los datos personales, el importador de datos podrá redactar el texto del acuerdo antes de compartir una copia.
(d) El importador de datos seguirá siendo plenamente responsable ante el exportador de datos del cumplimiento de las obligaciones del subencargado del tratamiento en virtud de su contrato con el importador de datos. El importador de datos notificará al exportador de datos cualquier incumplimiento por parte del subencargado del tratamiento de sus obligaciones en virtud de dicho contrato.
(e) El importador de datos acordará con el subencargado del tratamiento una cláusula de tercero beneficiario en virtud de la cual -en caso de que el importador de datos haya desaparecido de facto, haya dejado de existir según la legislación de o se haya declarado insolvente- el exportador de datos tendrá derecho a rescindir el contrato de subencargado del tratamiento y a ordenar al subencargado que borre o devuelva los datos personales.
Artículo 10
Derechos del interesado
(a) El importador de datos notificará sin demora al exportador de datos cualquier solicitud que haya recibido de un interesado. No responderá por sí mismo a dicha solicitud a menos que haya sido autorizado para ello por el exportador de datos.
(b) El importador de datos asistirá al exportador de datos en el cumplimiento de sus obligaciones de responder a las solicitudes de los interesados para el ejercicio de sus derechos con arreglo al Reglamento (UE) 2016/679. A este respecto, las Partes establecerán en el anexo II las medidas técnicas y organizativas adecuadas, teniendo en cuenta la naturaleza del tratamiento, mediante las cuales se prestará la asistencia, así como el ámbito y el alcance de la asistencia requerida.
(c) En el cumplimiento de sus obligaciones en virtud de las letras a) y b), el importador de datos deberá atenerse a las instrucciones del exportador de datos.
Artículo 11
Reparación
(a) El importador de datos informará a los interesados en un formato transparente y fácilmente accesible, mediante notificación individual o en su sitio web, de un punto de contacto autorizado para tramitar las reclamaciones. Tratará sin demora las reclamaciones que reciba de un interesado.
(b) En caso de litigio entre un interesado y una de las Partes en lo que respecta al cumplimiento de las presentes cláusulas, dicha Parte hará todo lo posible por resolver la cuestión de forma amistosa y en el momento oportuno. Las Partes se mantendrán mutuamente informadas sobre dichos litigios y, en su caso, cooperarán para resolverlos.
(c) Cuando el interesado invoque un derecho de tercero beneficiario con arreglo a la cláusula 3, el importador de datos aceptará la decisión del interesado de:
(i) presentar una reclamación ante la autoridad de control del Estado miembro de su residencia habitual o de su lugar de trabajo, o ante la autoridad de control competente con arreglo a la cláusula 13;
(ii) someter el litigio a los tribunales competentes en el sentido de la cláusula 18.
(d) Las Partes aceptan que el interesado pueda estar representado por un organismo, organización o asociación sin ánimo de lucro en las condiciones establecidas en el artículo 80, apartado 1, del Reglamento (UE) 2016/679.
(e) El importador de datos acatará una decisión que sea vinculante con arreglo a la legislación aplicable de la UE o de los Estados miembros.
(f) El importador de datos acepta que la elección realizada por el interesado no perjudicará sus derechos sustantivos y procesales a interponer recursos de conformidad con la legislación aplicable.
Artículo 12
Responsabilidad
(a)Cada Parte será responsable frente a la/s otra/s Parte/s de los daños y perjuicios que cause a la/s otra/s por cualquier incumplimiento de estas Cláusulas.
(b)El importador de datos será responsable ante el interesado, y éste tendrá derecho a ser indemnizado, por cualquier daño material o moral que el importador de datos o su subencargado le cause por vulnerar los derechos de terceros beneficiarios previstos en las presentes cláusulas.
(c)No obstante lo dispuesto en la letra b), el exportador de datos será responsable ante el interesado, y este tendrá derecho a recibir una indemnización, por cualquier daño material o moral que el exportador de datos o el importador de datos (o su subencargado del tratamiento) cause al interesado por vulnerar los derechos de terceros beneficiarios en virtud de las presentes cláusulas. Esto se entiende sin perjuicio de la responsabilidad del exportador de datos y, cuando el exportador de datos sea un encargado del tratamiento que actúe en nombre de un responsable del tratamiento, de la responsabilidad del responsable del tratamiento en virtud del Reglamento (UE) 2016/679 o del Reglamento (UE) 2018/1725, según proceda.
(d)Las Partes acuerdan que si el exportador de datos es considerado responsable en virtud de la letra c) de los daños causados por el importador de datos (o su subencargado del tratamiento), tendrá derecho a reclamar al importador de datos la parte de la indemnización correspondiente a la responsabilidad del importador de datos por los daños.
(e)Cuando más de una Parte sea responsable de cualquier daño causado al interesado como consecuencia de un incumplimiento de las presentes Cláusulas, todas las Partes responsables serán solidariamente responsables y el interesado tendrá derecho a interponer una acción judicial contra cualquiera de dichas Partes.
(f)Las Partes acuerdan que si una Parte es considerada responsable en virtud del apartado (e), tendrá derecho a reclamar a la otra Parte o Partes la parte de la indemnización correspondiente a su responsabilidad por el daño.
(g)El importador de datos no podrá invocar la conducta de un subencargado del tratamiento para eludir su propia responsabilidad.
Artículo 13
Supervisión
(a) [Cuando el exportador de datos esté establecido en un Estado miembro de la UE:] Actuará como autoridad de control competente la autoridad de control responsable de garantizar el cumplimiento por parte del exportador de datos del Reglamento (UE) 2016/679 en lo que respecta a la transferencia de datos, tal como se indica en el anexo I.C.
[Cuando el exportador de datos no esté establecido en un Estado miembro de la UE, pero entre en el ámbito territorial de aplicación del Reglamento (UE) 2016/679 de conformidad con su artículo 3, apartado 2, y haya designado a un representante con arreglo al artículo 27, apartado 1, del Reglamento (UE) 2016/679:]. La autoridad de supervisión del Estado miembro en el que esté establecido el representante en el sentido del artículo 27, apartado 1, del Reglamento (UE) 2016/679, tal como se indica en el anexo I.C, actuará como autoridad de supervisión competente.
[Cuando el exportador de datos no esté establecido en un Estado miembro de la UE, pero entre en el ámbito territorial de aplicación del Reglamento (UE) 2016/679 de conformidad con su artículo 3, apartado 2, sin que, no obstante, tenga que designar a un representante con arreglo al artículo 27, apartado 2, del Reglamento (UE) 2016/679:]. Actuará como autoridad de control competente la autoridad de control de uno de los Estados miembros en los que se encuentren los interesados cuyos datos personales se transfieran en virtud de las presentes Cláusulas en relación con la oferta de bienes o servicios a los mismos, o cuyo comportamiento se controle, según se indica en el anexo I.C.
(b) El importador de datos acepta someterse a la jurisdicción de la autoridad de control competente y cooperar con ella en cualquier procedimiento destinado a garantizar el cumplimiento de las presentes cláusulas. En particular, el importador de datos acepta responder a las investigaciones, someterse a auditorías y cumplir las medidas adoptadas por la autoridad de control, incluidas las medidas correctivas y compensatorias. Facilitará a la autoridad de control una confirmación por escrito de que se han adoptado las medidas necesarias.
SECCIÓN III - LEGISLACIÓN LOCAL Y OBLIGACIONES EN CASO DE ACCESO DE LAS AUTORIDADES PÚBLICAS
Artículo 14
Leyes y prácticas locales que afectan al cumplimiento de las Cláusulas
(a) Las Partes garantizan que no tienen motivos para creer que las leyes y prácticas del tercer país de destino aplicables al tratamiento de los datos personales por parte del importador de datos, incluido cualquier requisito de revelación de datos personales o medidas que autoricen el acceso de las autoridades públicas, impidan al importador de datos cumplir las obligaciones que le incumben en virtud de las presentes cláusulas. Esto se basa en el entendimiento de que las leyes y prácticas que respetan la esencia de los derechos y libertades fundamentales y no exceden de lo necesario y proporcionado en una sociedad democrática para salvaguardar uno de los objetivos enumerados en el artículo 23, apartado 1, del Reglamento (UE) 2016/679, no están en contradicción con las presentes Cláusulas.
(b) Las Partes declaran que, al otorgar la garantía prevista en la letra a), han tenido debidamente en cuenta, en particular, los siguientes elementos:
(i)las circunstancias específicas de la transferencia, incluida la longitud de la cadena de tratamiento, el número de agentes implicados y los canales de transmisión utilizados; las transferencias ulteriores previstas; el tipo de destinatario; la finalidad del tratamiento; las categorías y el formato de los datos personales transferidos; el sector económico en el que se produce la transferencia; el lugar de almacenamiento de los datos transferidos;
(ii)la legislación y las prácticas del tercer país de destino -incluidas las que exigen la comunicación de datos a las autoridades públicas o autorizan el acceso de dichas autoridades- pertinentes a la luz de las circunstancias específicas de la transferencia, y las limitaciones y garantías aplicables ([4] );
(iii)todas las garantías contractuales, técnicas u organizativas pertinentes establecidas para complementar las garantías previstas en las presentes cláusulas, incluidas las medidas aplicadas durante la transmisión y el tratamiento de los datos personales en el país de destino.
(c) El importador de datos garantiza que, al llevar a cabo la evaluación prevista en la letra b), ha hecho todo lo posible por facilitar al exportador de datos la información pertinente y se compromete a seguir cooperando con el exportador de datos para garantizar el cumplimiento de las presentes Cláusulas.
(d) Las Partes acuerdan documentar la evaluación prevista en la letra b) y ponerla a disposición de la autoridad de control competente a petición de ésta.
(e) El importador de datos se compromete a notificar sin demora al exportador de datos si, tras haber aceptado las presentes cláusulas y durante la vigencia del contrato, tiene motivos para creer que está o ha estado sujeto a leyes o prácticas que no se ajustan a los requisitos de la letra a), incluso a raíz de un cambio en la legislación del tercer país o de una medida (como una solicitud de divulgación) que indique una aplicación de dicha legislación en la práctica que no se ajusta a los requisitos de la letra a).
(f) Tras una notificación con arreglo a la letra e), o si el exportador de datos tiene motivos para creer que el importador de datos ya no puede cumplir sus obligaciones con arreglo a las presentes cláusulas, el exportador de datos determinará sin demora las medidas adecuadas (por ejemplo, medidas técnicas u organizativas para garantizar la seguridad y la confidencialidad) que deberán adoptar el exportador de datos y/o el importador de datos para hacer frente a la situación. El exportador de datos suspenderá la transferencia de datos si considera que no pueden garantizarse las salvaguardias adecuadas para dicha transferencia, o si así se lo ordena la autoridad de control competente. En este caso, el exportador de datos tendrá derecho a rescindir el contrato, en la medida en que se refiera al tratamiento de datos personales con arreglo a las presentes Cláusulas. Si el contrato implica a más de dos Partes, el exportador de datos podrá ejercer este derecho de rescisión únicamente con respecto a la Parte pertinente, a menos que las Partes hayan acordado otra cosa. Cuando el contrato se rescinda en virtud de la presente Cláusula, se aplicarán las letras d) y e) de la Cláusula 16.
Artículo 15
Obligaciones del importador de datos en caso de acceso de las autoridades públicas
15.1 Notificación
(a) El importador de datos se compromete a notificar sin demora al exportador de datos y, cuando sea posible, al interesado (en caso necesario, con la ayuda del exportador de datos) si:
(i) reciba una solicitud jurídicamente vinculante de una autoridad pública, incluidas las autoridades judiciales, con arreglo a la legislación del país de destino, para la divulgación de los datos personales transferidos en virtud de las presentes cláusulas; dicha notificación incluirá información sobre los datos personales solicitados, la autoridad solicitante, la base jurídica de la solicitud y la respuesta proporcionada; o bien
(ii) tenga conocimiento de cualquier acceso directo por parte de las autoridades públicas a los datos personales transferidos en virtud de las presentes cláusulas de conformidad con la legislación del país de destino; dicha notificación incluirá toda la información de que disponga el importador.
(b) Si la legislación del país de destino prohíbe al importador de datos notificar al exportador de datos y/o al interesado, el importador de datos acuerda hacer todo lo posible para obtener una dispensa de la prohibición, con vistas a comunicar toda la información posible, lo antes posible. El importador de datos acepta documentar sus mejores esfuerzos para poder demostrarlos a petición del exportador de datos.
(c) Cuando lo permita la legislación del país de destino, el importador de datos se compromete a facilitar al exportador de datos, a intervalos regulares durante la vigencia del contrato, toda la información pertinente posible sobre las solicitudes recibidas (en particular, número de solicitudes, tipo de datos solicitados, autoridad/es solicitante/s, si se han impugnado las solicitudes y el resultado de dichas impugnaciones, etc.).
(d) El importador de datos se compromete a conservar la información contemplada en las letras a) a c) durante la vigencia del contrato y a ponerla a disposición de la autoridad de control competente a petición de ésta.
(e) Las letras a) a c) se entienden sin perjuicio de la obligación del importador de datos, de conformidad con la letra e) de la cláusula 14 y la cláusula 16, de informar sin demora al exportador de datos cuando no pueda cumplir dichas cláusulas.
15.2 Revisión de la legalidad y minimización de datos
(a) El importador de datos se compromete a revisar la legalidad de la solicitud de divulgación, en particular si se mantiene dentro de los poderes otorgados a la autoridad pública solicitante, y a impugnar la solicitud si, tras una cuidadosa evaluación, llega a la conclusión de que existen motivos razonables para considerar que la solicitud es ilegal con arreglo a la legislación del país de destino, a las obligaciones aplicables en virtud del Derecho internacional y a los principios de cortesía internacional. El importador de datos deberá, en las mismas condiciones, hacer uso de las posibilidades de recurso. Cuando impugne una solicitud, el importador de datos solicitará medidas cautelares con vistas a suspender los efectos de la solicitud hasta que la autoridad judicial competente se haya pronunciado sobre el fondo de la misma. No revelará los datos personales solicitados hasta que se le requiera para ello con arreglo a las normas procesales aplicables. Estos requisitos se entienden sin perjuicio de las obligaciones del importador de datos con arreglo a la letra e) de la cláusula 14.
(b) El importador de datos acepta documentar su evaluación jurídica y cualquier impugnación de la solicitud de divulgación y, en la medida en que lo permita la legislación del país de destino , poner la documentación a disposición del exportador de datos. También la pondrá a disposición de la autoridad de control competente a petición de ésta.
(c) El importador de datos se compromete a proporcionar la cantidad mínima de información permitida al responder a una solicitud de divulgación, sobre la base de una interpretación razonable de la solicitud.
SECCIÓN IV - DISPOSICIONES FINALES
Artículo 16
Incumplimiento de las cláusulas y rescisión
(a) El importador de datos informará sin demora al exportador de datos en caso de que, por cualquier motivo, no pueda cumplir las presentes cláusulas.
(b) En caso de que el importador de datos incumpla estas cláusulas o no pueda cumplirlas, el exportador de datos suspenderá la transferencia de datos personales al importador de datos hasta que se garantice de nuevo el cumplimiento o se rescinda el contrato. Todo ello sin perjuicio de lo dispuesto en la letra f) de la cláusula 14.
(c) El exportador de datos tendrá derecho a rescindir el contrato, en la medida en que se refiera al tratamiento de datos personales con arreglo a las presentes Cláusulas, cuando:
(i) el exportador de datos haya suspendido la transferencia de datos personales al importador de datos de conformidad con el apartado (b) y no se restablezca el cumplimiento de las presentes Cláusulas en un plazo razonable y, en cualquier caso, en el plazo de un mes a partir de la suspensión;
(ii) el importador de datos incumple de forma sustancial o persistente las presentes cláusulas; o
(iii) el importador de datos incumple una decisión vinculante de un tribunal competente o de una autoridad de control en relación con las obligaciones que le incumben en virtud de las presentes cláusulas.
En estos casos, informará de dicho incumplimiento a la autoridad de control competente. Cuando el contrato implique a más de dos Partes, el exportador de datos podrá ejercer este derecho de rescisión únicamente con respecto a la Parte pertinente, salvo que las Partes hayan acordado otra cosa.
(d) Los datos personales que se hayan transferido antes de la terminación del contrato con arreglo a la letra c) se devolverán inmediatamente al exportador de datos, a elección de éste, o se suprimirán en su totalidad. Lo mismo se aplicará a cualquier copia de los datos. El importador de datos certificará la supresión de los datos al exportador de datos. Hasta que los datos sean suprimidos o devueltos, el importador de datos seguirá garantizando el cumplimiento de las presentes cláusulas. En caso de que la legislación local aplicable al importador de datos prohíba la devolución o supresión de los datos personales transferidos, el importador de datos garantiza que seguirá velando por el cumplimiento de las presentes cláusulas y que sólo tratará los datos en la medida y durante el tiempo que exija dicha legislación local.
(e) Cualquiera de las Partes podrá revocar su acuerdo de quedar vinculada por las presentes Cláusulas cuando (i) la Comisión Europea adopte una decisión de conformidad con el artículo 45, apartado 3, del Reglamento (UE) 2016/679 que cubra la transferencia de datos personales a los que se aplican las presentes Cláusulas; o (ii) el Reglamento (UE) 2016/679 pase a formar parte del marco jurídico del país al que se transfieren los datos personales. Esto se entiende sin perjuicio de otras obligaciones aplicables al tratamiento en cuestión en virtud del Reglamento (UE) 2016/679.
Artículo 17
Legislación aplicable
Las presentes Cláusulas se regirán por la legislación de uno de los Estados miembros de la UE, siempre que dicha legislación permita los derechos de terceros beneficiarios. Las Partes acuerdan que esta será la legislación de Irlanda.
Artículo 18
Elección de foro y jurisdicción
(a) Cualquier litigio derivado de las presentes cláusulas será resuelto por los tribunales de un Estado miembro de la UE.
(b) Las Partes acuerdan que serán los tribunales de Irlanda.
(c) El interesado también podrá emprender acciones legales contra el exportador de datos y/o el importador de datos ante los tribunales del Estado miembro en el que tenga su residencia habitual.
ANEX
ANEXO I
A. LISTA DE LAS PARTES
Exportador(es) de datos:
Nombre: Nombre del Cliente tal y como figura en el Acuerdo.
Dirección: Dirección del Cliente que figura en el Acuerdo.
Nombre, cargo y datos de contacto de la persona de contacto: Punto de contacto para el Cliente según lo establecido en el Acuerdo.
Actividades relevantes para los datos transferidos en virtud de las presentes Cláusulas: Cliente en virtud del Acuerdo
Función (controlador/procesador): Controlador
Importador(es) de datos
Nombre: Nombre de Palantir tal como figura en el Acuerdo.
Dirección: Dirección de Palantir que figura en el Acuerdo.
Nombre, cargo y datos de la persona de contacto: Responsable de protección de datos, dpo@palantir.com
Actividades relevantes para los datos transferidos en virtud de las presentes Cláusulas: Proveedor en virtud del Acuerdo
Función (controlador/procesador): Procesador
B. DESCRIPCIÓN DE LA TRANSFERENCIA
Categorías de interesados cuyos datos personales se transfieren
Según lo descrito en "Categorías de interesados cuyos datos personales pueden ser objeto de tratamiento" en el Anexo B y cualquier otro anexo pertinente para los Servicios adicionales aplicables.
Categorías de datos personales transferidos
Según lo descrito en "Categorías de Datos Personales del Cliente" en el Anexo B y en cualquier otro anexo pertinente para los Servicios adicionales aplicables.
Datos sensibles transferidos (si procede) y restricciones o salvaguardias aplicadas que tengan plenamente en cuenta la naturaleza de los datos y los riesgos que entrañan, como por ejemplo una estricta limitación de la finalidad, restricciones de acceso (incluido el acceso únicamente del personal que haya seguido una formación especializada), mantenimiento de un registro de acceso a los datos, restricciones para las transferencias ulteriores o medidas de seguridad adicionales.
Datos personales que revelen el origen racial o étnico, opiniones políticas, creencias religiosas o filosóficas, o afiliación sindical, datos genéticos, datos biométricos, datos de salud, datos relativos a la vida sexual de una persona física u orientación sexual en la medida en que los Datos Personales del Cliente incluyan dichos datos sensibles y sean proporcionados a Palantir para su Tratamiento (incluido a través del Servicio) por o bajo la dirección del Cliente o de los Usuarios del Cliente. En ese caso, el Cliente identificará claramente dichos datos sensibles a Palantir por escrito antes de proporcionar dichos datos sensibles. Las salvaguardas y restricciones aplicadas se describen en el Anexo II.
La frecuencia de la transferencia (por ejemplo, si los datos se transfieren de forma puntual o continua).
De forma continua.
Naturaleza del tratamiento
Según lo descrito en el apartado "Naturaleza y finalidad del tratamiento" del Anexo B y, en su caso, cualquier otro anexo pertinente para los Servicios adicionales aplicables.
Finalidad o finalidades de la transferencia y el tratamiento posterior de los datos
Según lo descrito en el apartado "Naturaleza y finalidad del tratamiento" del Anexo B y, en su caso, cualquier otro anexo pertinente para los Servicios adicionales aplicables.
El período durante el cual se conservarán los datos personales o, si esto no fuera posible, los criterios utilizados para determinar dicho período.
Tal y como se describe en el apartado "Duración de la tramitación" del Anexo B y, en su caso, en cualquier otro anexo pertinente para los Servicios adicionales aplicables.
Para las transferencias a (sub)procesadores, especifique también el objeto, la naturaleza y la duración del tratamiento
Tal y como se describe en el apartado "Objeto, naturaleza y duración del tratamiento por parte de los subencargados del tratamiento" del Anexo B y, en su caso, cualquier otro anexo pertinente para los Servicios adicionales aplicables.
C. AUTORIDAD DE CONTROL COMPETENTE
Identifique a la autoridad o autoridades de control competentes de conformidad con la cláusula 13.
La autoridad supervisora determinada de conformidad con la cláusula 13 y especificada en https://edpb.europa.eu/about-edpb/about-edpb/members_en (actualizada periódicamente).
ANEXO II
MEDIDAS TÉCNICAS Y ORGANIZATIVAS, INCLUIDAS LAS MEDIDAS TÉCNICAS Y ORGANIZATIVAS PARA GARANTIZAR LA SEGURIDAD DE LOS DATOS
Descripción de las medidas técnicas y organizativas aplicadas por el importador o importadores de datos (incluidas las certificaciones pertinentes) para garantizar un nivel de seguridad adecuado, teniendo en cuenta la naturaleza, el alcance, el contexto y la finalidad del tratamiento, así como los riesgos para los derechos y libertades de las personas físicas.
Las características y funcionalidades de seguridad a disposición del Cliente descritas en la cláusula 4.1 de la DPA, documentadas con mayor detalle en la Documentación de Seguridad, y las medidas técnicas y organizativas descritas en la cláusula 4.3(c) de la DPA.
Para las transferencias a (sub)encargados del tratamiento, describa también las medidas técnicas y organizativas específicas que deberá adoptar el (sub)encargado del tratamiento para poder prestar asistencia al responsable del tratamiento y, para las transferencias de un encargado del tratamiento a un subencargado, al exportador de datos.
Los controles a disposición del Cliente descritos en la cláusula 4.1 de la DPA, tal y como se documentan con mayor detalle en la Documentación de Seguridad.
ANEXO 2 A LA PRUEBA D
CLÁUSULAS CONTRACTUALES TIPO
CLÁUSULAS CONTRACTUALES TIPO
Módulo 3: de procesador a procesador
SECCIÓN I
Artículo 1
Objetivo y ámbito de aplicación
(a) El objeto de las presentes cláusulas contractuales tipo es garantizar el cumplimiento de los requisitos del Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos (Reglamento general de protección de datos) ([5] ) para la transferencia de datos personales a un tercer país.
(b) Las Partes:
(i) la(s) persona(s) física(s) o jurídica(s), autoridad(es) pública(s), agencia(s) u otro(s) organismo(s) (en lo sucesivo, "entidad(es)") que transfiere(n) los datos personales, enumerados en el anexo I.A (en lo sucesivo, "exportador(es) de datos"), y
(ii) la(s) entidad(es) de un tercer país que reciba(n) los datos personales del exportador de datos, directa o indirectamente a través de otra entidad que también sea Parte en las presentes cláusulas, enumerada en el anexo I.A (en lo sucesivo, "importador de datos")
han aceptado las presentes cláusulas contractuales tipo (en adelante: "Cláusulas").
(c) Las presentes Cláusulas se aplican a la transferencia de datos personales tal como se especifica en el Anexo I.B.
(d) El Apéndice de las presentes Cláusulas que contiene los Anexos en él mencionados forma parte integrante de las presentes Cláusulas.
Artículo 2
Efecto e invariabilidad de las cláusulas
(a) Las presentes Cláusulas establecen garantías adecuadas, incluidos derechos exigibles de los interesados y recursos jurídicos efectivos, de conformidad con el artículo 46, apartado 1, y el artículo 46, apartado 2, letra c), del Reglamento (UE) 2016/679 y, con respecto a las transferencias de datos de responsables a encargados y/o encargados a encargados, cláusulas contractuales tipo de conformidad con el artículo 28, apartado 7, del Reglamento (UE) 2016/679, siempre que no se modifiquen, salvo para seleccionar el Módulo o Módulos adecuados o para añadir o actualizar información en el Apéndice. La presente no impide a las Partes incluir las cláusulas contractuales tipo establecidas en las presentes Cláusulas en un contrato más amplio y/o añadir otras cláusulas o garantías adicionales, siempre que no contradigan, directa o indirectamente, las presentes Cláusulas ni perjudiquen los derechos o libertades fundamentales de los interesados.
(b) Las presentes Cláusulas se entienden sin perjuicio de las obligaciones a las que esté sujeto el exportador de datos en virtud del Reglamento (UE) 2016/679.
Artículo 3
Terceros beneficiarios
(a) Los interesados podrán invocar y hacer valer las presentes Cláusulas, como terceros beneficiarios, frente al exportador de datos y/o al importador de datos, con las siguientes excepciones:
(i) Cláusula 1, Cláusula 2, Cláusula 3, Cláusula 6, Cláusula 7;
(ii) Cláusula 8.1(a), (c) y (d) y Cláusula 8.9(a), (c), (d), (e), (f) y (g)
(iii) Cláusula 9(a), (c), (d) y (e);
(iv) Cláusula 12(a), (d) y (f);
(v) Art. 13;
(vi) Cláusula 15.1(c), (d) y (e);
(vii) Cláusula 16(e);
(viii) Cláusula 18(a) y (b).
(b) La letra a) se entiende sin perjuicio de los derechos de los interesados en virtud del Reglamento (UE) 2016/679.
Artículo 4
Interpretación
(a) Cuando en las presentes Cláusulas se utilicen términos definidos en el Reglamento (UE) 2016/679, dichos términos tendrán el mismo significado que en dicho Reglamento.
(b) Las presentes Cláusulas se leerán e interpretarán a la luz de lo dispuesto en el Reglamento (UE) 2016/679.
(c) Las presentes Cláusulas no se interpretarán de forma contraria a los derechos y obligaciones previstos en el Reglamento (UE) 2016/679.
Artículo 5
Jerarquía
En caso de contradicción entre estas Cláusulas y las disposiciones de los acuerdos relacionados entre las Partes, existentes en el momento de acordar estas Cláusulas o celebrados con posterioridad, prevalecerán estas Cláusulas.
Artículo 6
Descripción de la(s) transferencia(s)
Los detalles de la(s) transferencia(s), y en particular las categorías de datos personales que se transfieren y los fines para los que se transfieren, se especifican en el Anexo I.B.
Artículo 7
Cláusula de atraque
[Se ha dejado en blanco intencionadamente]
SECCIÓN II - OBLIGACIONES DE LAS PARTES
Artículo 8
Protección de datos
El exportador de datos garantiza que ha realizado esfuerzos razonables para determinar que el importador de datos es capaz, mediante la aplicación de medidas técnicas y organizativas adecuadas, de cumplir las obligaciones que le incumben en virtud de las presentes cláusulas.
8.1 Instrucciones
(a) El exportador de datos ha informado al importador de datos de que actúa como encargado del tratamiento siguiendo las instrucciones de su(s) responsable(s), que el exportador de datos pondrá a disposición del importador de datos antes del tratamiento.
(b) El importador de datos tratará los datos personales únicamente siguiendo instrucciones documentadas del responsable del tratamiento, comunicadas al importador de datos por el exportador de datos, y cualesquiera instrucciones documentadas adicionales del exportador de datos. Dichas instrucciones adicionales no entrarán en conflicto con las instrucciones del responsable del tratamiento. El responsable del tratamiento o el exportador de datos podrán dar instrucciones documentadas adicionales en relación con el tratamiento de datos a lo largo de la duración del contrato.
(c) El importador de datos informará inmediatamente al exportador de datos en caso de que no pueda seguir dichas instrucciones. Cuando el importador de datos no pueda seguir las instrucciones del responsable del tratamiento, el exportador de datos informará inmediatamente al responsable del tratamiento.
(d) El exportador de datos garantiza que ha impuesto al importador de datos las mismas obligaciones en materia de protección de datos que las establecidas en el contrato u otro acto jurídico con arreglo al Derecho de la Unión o de los Estados miembros entre el responsable del tratamiento y el exportador de datos ( ).
8.2 Limitación de la finalidad
El importador de datos tratará los datos personales únicamente para la finalidad o finalidades específicas de la transferencia, tal como se establece en el anexo I.B., salvo que reciba instrucciones adicionales del responsable del tratamiento, comunicadas al importador de datos por el exportador de datos, o del exportador de datos.
8.3 Transparencia
Previa solicitud, el exportador de datos pondrá gratuitamente a disposición del interesado una copia de las presentes cláusulas, incluido el apéndice completado por las Partes. En la medida necesaria para proteger secretos comerciales u otra información confidencial, incluidos los datos personales, el exportador de datos podrá suprimir parte del texto del apéndice antes de compartir una copia, pero facilitará un resumen significativo cuando, de otro modo, el interesado no pudiera comprender su contenido o ejercer sus derechos. Previa solicitud, las Partes comunicarán al interesado los motivos de las supresiones, en la medida de lo posible sin revelar la información suprimida.
8.4 Precisión
Si el importador de datos tiene conocimiento de que los datos personales que ha recibido son inexactos o han quedado obsoletos, informará al exportador de datos sin demora injustificada. En tal caso, el importador de datos cooperará con el exportador de datos para rectificar o suprimir los datos.
8.5 Duración del tratamiento y supresión o devolución de los datos
El tratamiento por parte del importador de datos sólo tendrá lugar durante el período especificado en el anexo I.B. Una vez finalizada la prestación de los servicios de tratamiento, el importador de datos, a elección del exportador de datos, suprimirá todos los datos personales tratados por cuenta del responsable del tratamiento y certificará al exportador de datos que así lo ha hecho, o devolverá al exportador de datos todos los datos personales tratados por cuenta suya y suprimirá las copias existentes. Hasta que se supriman o devuelvan los datos, el importador de datos seguirá garantizando el cumplimiento de las presentes cláusulas. En caso de que la legislación local aplicable al importador de datos prohíba la devolución o supresión de los datos personales, el importador de datos garantiza que seguirá velando por el cumplimiento de las presentes Cláusulas y que sólo los tratará en la medida y durante el tiempo que exija dicha legislación local. Esto se entiende sin perjuicio de la Cláusula 14, en particular del requisito de que el importador de datos, en virtud de la Cláusula 14(e), notifique al exportador de datos durante toda la vigencia del contrato si tiene motivos para creer que está o ha pasado a estar sujeto a leyes o prácticas que no se ajustan a los requisitos de la Cláusula 14(a).
8.6 Seguridad del tratamiento
(a) El importador de datos y, durante la transmisión, también el exportador de datos aplicarán las medidas técnicas y organizativas apropiadas para garantizar la seguridad de los datos, incluida la protección contra quebrantamientos de la seguridad que provoquen la destrucción, accidental o ilícita, la pérdida, la alteración, la difusión o el acceso no autorizados, de dichos datos (en lo sucesivo, "violación de los datos personales"). Al evaluar el nivel adecuado de seguridad, tendrán debidamente en cuenta el estado de la técnica, los costes de aplicación, la naturaleza, el alcance, el contexto y la finalidad o finalidades del tratamiento, así como los riesgos que entrañe el tratamiento para el interesado. Las Partes considerarán, en particular, la posibilidad de recurrir al cifrado o a la seudonimización, incluso durante la transmisión, cuando la finalidad del tratamiento pueda cumplirse de ese modo. En caso de seudonimización, la información adicional para atribuir los datos personales a un interesado concreto permanecerá, siempre que sea posible, bajo el control exclusivo del exportador de datos o del responsable del tratamiento. En cumplimiento de sus obligaciones en virtud del presente apartado, el importador de datos aplicará, como mínimo, las medidas técnicas y organizativas especificadas en el anexo II. El importador de datos llevará a cabo controles periódicos para garantizar que dichas medidas siguen proporcionando un nivel de seguridad adecuado.
(b) El importador de datos sólo concederá acceso a los datos a los miembros de su personal en la medida estrictamente necesaria para la ejecución, gestión y supervisión del contrato. Garantizará que las personas autorizadas a tratar los datos personales se hayan comprometido a mantener la confidencialidad o estén sometidas a una obligación legal adecuada de confidencialidad.
(c) En caso de violación de datos personales relativos a datos personales tratados por el importador de datos con arreglo a las presentes cláusulas, el importador de datos adoptará las medidas adecuadas para hacer frente a la violación, incluidas medidas para mitigar sus efectos adversos. El importador de datos notificará asimismo, sin dilaciones indebidas, al exportador de datos y, cuando proceda y sea factible, al responsable del tratamiento, tras haber tenido conocimiento de la violación. Dicha notificación contendrá los datos de un punto de contacto en el que pueda obtenerse más información, una descripción de la naturaleza de la violación (incluidas, cuando sea posible, las categorías y el número aproximado de interesados y registros de datos personales afectados), sus consecuencias probables y las medidas adoptadas o propuestas para hacer frente a la violación de los datos, incluidas las medidas para atenuar sus posibles efectos adversos. Cuando, y en la medida en que, no sea posible facilitar toda la información al mismo tiempo, la notificación inicial contendrá la información de que se disponga en ese momento y, posteriormente, a medida que se vaya disponiendo de ella, se facilitará más información sin dilaciones indebidas.
(d) El importador de datos cooperará con el exportador de datos y le prestará asistencia para que este pueda cumplir las obligaciones que le incumben en virtud del Reglamento (UE) 2016/679, en particular notificar a su responsable del tratamiento para que este pueda a su vez notificar a la autoridad de control competente y a los interesados afectados, teniendo en cuenta la naturaleza del tratamiento y la información de que disponga el importador de datos.
8.7 Datos sensibles
Cuando la transferencia incluya datos personales que revelen el origen racial o étnico, las opiniones políticas, las convicciones religiosas o filosóficas, o la afiliación sindical, datos genéticos o datos biométricos destinados a identificar de manera unívoca a una persona física, datos relativos a la salud o a la vida sexual u orientación sexual de una persona, o datos relativos a condenas e infracciones penales (en lo sucesivo, "datos sensibles"), el importador de datos aplicará las restricciones específicas y/o las garantías adicionales establecidas en el anexo I.B.
8.8 Transferencias ulteriores
El importador de datos sólo revelará los datos personales a un tercero siguiendo instrucciones documentadas del responsable del tratamiento, comunicadas al importador de datos por el exportador de datos. Además, los datos sólo podrán comunicarse a un tercero situado fuera de la Unión Europea ([6] ) (en el mismo país que el importador de datos o en otro tercer país, en lo sucesivo "transferencia ulterior") si el tercero está o acepta estar vinculado por las presentes Cláusulas, en virtud del Módulo correspondiente, o si:
(i) la transferencia ulterior es a un país que se beneficia de una decisión de adecuación de conformidad con el artículo 45 del Reglamento (UE) 2016/679 que cubre la transferencia ulterior;
(ii) el tercero garantiza de otro modo las garantías adecuadas de conformidad con los artículos 46 o 47 del Reglamento (UE) 2016/679;
(iii) la transferencia ulterior es necesaria para el establecimiento, ejercicio o defensa de reclamaciones legales en el contexto de procedimientos administrativos, reglamentarios o judiciales específicos; o
(iv) la transferencia ulterior es necesaria para proteger los intereses vitales del interesado o de otra persona física.
Toda transferencia ulterior está sujeta al cumplimiento por parte del importador de datos de todas las demás salvaguardias previstas en las presentes cláusulas, en particular la limitación de la finalidad.
8.9 Documentación y conformidad
(a) El importador de datos atenderá rápida y adecuadamente las consultas del exportador de datos o del responsable del tratamiento relacionadas con el tratamiento previsto en las presentes cláusulas.
(b) Las Partes deberán poder demostrar el cumplimiento de estas Cláusulas. En particular, el importador de datos conservará la documentación adecuada sobre las actividades de tratamiento realizadas por cuenta del responsable del tratamiento.
(c) El importador de datos pondrá toda la información necesaria para demostrar el cumplimiento de las obligaciones establecidas en las presentes cláusulas a disposición del exportador de datos, que la facilitará al responsable del tratamiento.
(d) El importador de datos permitirá y contribuirá a que el exportador de datos realice auditorías de las actividades de tratamiento contempladas en las presentes cláusulas, a intervalos razonables o si existen indicios de incumplimiento. Lo mismo se aplicará cuando el exportador de datos solicite una auditoría siguiendo instrucciones del responsable del tratamiento. A la hora de decidir sobre una auditoría, el exportador de datos podrá tener en cuenta las certificaciones pertinentes que posea el importador de datos.
(e) Cuando la auditoría se lleve a cabo siguiendo instrucciones del responsable del tratamiento, el exportador de datos pondrá los resultados a disposición del responsable del tratamiento.
(f) El exportador de datos podrá optar por realizar la auditoría por sí mismo o encargarla a un auditor independiente. Las auditorías podrán incluir inspecciones en los locales o instalaciones físicas del importador de datos y, en su caso, se llevarán a cabo con una antelación razonable.
(g) Las Partes pondrán a disposición de la autoridad de control competente, previa solicitud, la información mencionada en las letras b) y c), incluidos los resultados de cualquier auditoría.
Artículo 9
Uso de subprocesadores
(a) OPCIÓN 2 AUTORIZACIÓN GENERAL POR ESCRITO: El importador de datos cuenta con la autorización general del responsable del tratamiento para la contratación de subencargados del tratamiento de una lista acordada. El importador de datos informará específicamente al responsable del tratamiento por escrito de cualquier cambio previsto en dicha lista mediante la adición o sustitución de subencargados del tratamiento con al menos 14 días de antelación, dando así al responsable del tratamiento tiempo suficiente para poder oponerse a dichos cambios antes de la contratación del subencargado o subencargados del tratamiento. El importador de datos facilitará al responsable del tratamiento la información necesaria para que éste pueda ejercer su derecho de oposición. El importador de datos informará al exportador de datos de la contratación del subencargado o subencargados del tratamiento.
(b) Cuando el importador de datos contrate a un subencargado del tratamiento para llevar a cabo actividades de tratamiento específicas (en nombre del responsable del tratamiento), deberá hacerlo mediante un contrato escrito que establezca, en esencia, las mismas obligaciones de protección de datos que las que vinculan al importador de datos en virtud de las presentes Cláusulas, incluso en lo que respecta a los derechos de terceros beneficiarios para los interesados. ([7] ) Las Partes acuerdan que, mediante el cumplimiento de la presente Cláusula, el importador de datos cumple sus obligaciones en virtud de la Cláusula 8.8. El importador de datos velará por que el subencargado del tratamiento cumpla las obligaciones a las que está sujeto el importador de datos en virtud de las presentes cláusulas.
(c) El importador de datos facilitará, a petición del exportador de datos o del responsable del tratamiento, una copia de dicho acuerdo de subencargado del tratamiento y de cualquier modificación posterior. En la medida necesaria para proteger los secretos comerciales u otra información confidencial, incluidos los datos personales, el importador de datos podrá redactar el texto del acuerdo antes de compartir una copia.
(d) El importador de datos seguirá siendo plenamente responsable ante el exportador de datos del cumplimiento de las obligaciones del subencargado del tratamiento en virtud de su contrato con el importador de datos. El importador de datos notificará al exportador de datos cualquier incumplimiento por parte del subencargado del tratamiento de sus obligaciones en virtud de dicho contrato.
(e) El importador de datos acordará con el subencargado del tratamiento una cláusula de tercero beneficiario en virtud de la cual -en caso de que el importador de datos haya desaparecido de hecho, haya dejado de existir jurídicamente o se haya declarado insolvente- el exportador de datos tendrá derecho a rescindir el contrato de subencargado del tratamiento y a ordenar al subencargado que borre o devuelva los datos personales.
Artículo 10
Derechos del interesado
(a) El importador de datos notificará sin demora al exportador de datos y, en su caso, al responsable del tratamiento cualquier solicitud que haya recibido de un interesado, sin responder a dicha solicitud a menos que haya sido autorizado para ello por el responsable del tratamiento.
(b) El importador de datos asistirá, en su caso en cooperación con el exportador de datos, al responsable del tratamiento en el cumplimiento de sus obligaciones de responder a las solicitudes de los interesados para el ejercicio de sus derechos con arreglo al Reglamento (UE) 2016/679 o al Reglamento (UE) 2018/1725, según proceda. A este respecto, las Partes establecerán en el anexo II las medidas técnicas y organizativas adecuadas, teniendo en cuenta la naturaleza del tratamiento, mediante las cuales se prestará la asistencia, así como el ámbito y el alcance de la asistencia requerida.
(c) En el cumplimiento de sus obligaciones con arreglo a los apartados (a) y (b), el importador de datos se atendrá a las instrucciones del responsable del tratamiento, comunicadas por el exportador de datos.
Artículo 11
Reparación
(a) El importador de datos informará a los interesados en un formato transparente y fácilmente accesible, mediante notificación individual o en su sitio web, de un punto de contacto autorizado para tramitar las reclamaciones. Tratará sin demora las reclamaciones que reciba de un interesado.
(b) En caso de litigio entre un interesado y una de las Partes en lo que respecta al cumplimiento de las presentes cláusulas, dicha Parte hará todo lo posible por resolver la cuestión de forma amistosa y en el momento oportuno. Las Partes se mantendrán mutuamente informadas sobre dichos litigios y, en su caso, cooperarán para resolverlos.
(c) Cuando el interesado invoque un derecho de tercero beneficiario con arreglo a la cláusula 3, el importador de datos aceptará la decisión del interesado de:
(i) presentar una reclamación ante la autoridad de control del Estado miembro de su residencia habitual o de su lugar de trabajo, o ante la autoridad de control competente con arreglo a la cláusula 13;
(ii) someter el litigio a los tribunales competentes en el sentido de la cláusula 18.
(d) Las Partes aceptan que el interesado pueda estar representado por un organismo, organización o asociación sin ánimo de lucro en las condiciones establecidas en el artículo 80, apartado 1, del Reglamento (UE) 2016/679.
(e) El importador de datos acatará una decisión que sea vinculante con arreglo a la legislación aplicable de la UE o de los Estados miembros.
(f) El importador de datos acepta que la elección realizada por el interesado no perjudicará sus derechos sustantivos y procesales a interponer recursos de conformidad con la legislación aplicable.
Artículo 12
Responsabilidad
(a) Cada Parte será responsable frente a la/s otra/s Parte/s de los daños y perjuicios que cause a la/s otra/s por cualquier incumplimiento de estas Cláusulas.
(b) El importador de datos será responsable ante el interesado, y éste tendrá derecho a ser indemnizado, por cualquier daño material o moral que el importador de datos o su subencargado le cause por vulnerar los derechos de terceros beneficiarios previstos en las presentes cláusulas.
(c) No obstante lo dispuesto en la letra b), el exportador de datos será responsable ante el interesado, y este tendrá derecho a recibir una indemnización, por cualquier daño material o moral que el exportador de datos o el importador de datos (o su subencargado del tratamiento) cause al interesado por vulnerar los derechos de terceros beneficiarios en virtud de las presentes cláusulas. Esto se entiende sin perjuicio de la responsabilidad del exportador de datos y, cuando el exportador de datos sea un encargado del tratamiento que actúe en nombre de un responsable del tratamiento, de la responsabilidad del responsable del tratamiento en virtud del Reglamento (UE) 2016/679 o del Reglamento (UE) 2018/1725, según proceda.
(d) Las Partes acuerdan que si el exportador de datos es considerado responsable en virtud del apartado (c) de los daños causados por el importador de datos (o su subencargado del tratamiento), tendrá derecho a reclamar al importador de datos la parte de la indemnización correspondiente a la responsabilidad del importador de datos por los daños.
(e) Cuando más de una Parte sea responsable de cualquier daño causado al interesado como consecuencia de un incumplimiento de las presentes Cláusulas, todas las Partes responsables serán solidariamente responsables y el interesado tendrá derecho a interponer una acción judicial contra cualquiera de dichas Partes.
(f) Las Partes acuerdan que si una Parte es considerada responsable en virtud del apartado (e), tendrá derecho a reclamar a la otra Parte o Partes la parte de la indemnización correspondiente a su responsabilidad por el daño.
(g) El importador de datos no podrá invocar la conducta de un subencargado del tratamiento para eludir su propia responsabilidad.
Artículo 13
Supervisión
(a) [Cuando el exportador de datos esté establecido en un Estado miembro de la UE:] Actuará como autoridad de control competente la autoridad de control responsable de garantizar el cumplimiento por parte del exportador de datos del Reglamento (UE) 2016/679 en lo que respecta a la transferencia de datos, tal como se indica en el anexo I.C.
[Cuando el exportador de datos no esté establecido en un Estado miembro de la UE, pero entre en el ámbito territorial de aplicación del Reglamento (UE) 2016/679 de conformidad con su artículo 3, apartado 2, y haya designado a un representante con arreglo al artículo 27, apartado 1, del Reglamento (UE) 2016/679:]. La autoridad de supervisión del Estado miembro en el que esté establecido el representante en el sentido del artículo 27, apartado 1, del Reglamento (UE) 2016/679, tal como se indica en el anexo I.C, actuará como autoridad de supervisión competente.
[Cuando el exportador de datos no esté establecido en un Estado miembro de la UE, pero entre en el ámbito territorial de aplicación del Reglamento (UE) 2016/679 de conformidad con su artículo 3, apartado 2, sin que, no obstante, tenga que designar a un representante con arreglo al artículo 27, apartado 2, del Reglamento (UE) 2016/679:]. Actuará como autoridad de control competente la autoridad de control de uno de los Estados miembros en los que se encuentren los interesados cuyos datos personales se transfieran en virtud de las presentes Cláusulas en relación con la oferta de bienes o servicios a los mismos, o cuyo comportamiento se controle, según se indica en el anexo I.C.
(b)El importador de datos acepta someterse a la jurisdicción de la autoridad de control competente y cooperar con ella en cualquier procedimiento destinado a garantizar el cumplimiento de las presentes cláusulas. En particular, el importador de datos acepta responder a las investigaciones, someterse a auditorías y cumplir las medidas adoptadas por la autoridad de control, incluidas las medidas correctivas y compensatorias. Facilitará a la autoridad de control una confirmación por escrito de que se han adoptado las medidas necesarias.
SECCIÓN III - LEGISLACIÓN LOCAL Y OBLIGACIONES EN CASO DE ACCESO DE LAS AUTORIDADES PÚBLICAS
Artículo 14
Leyes y prácticas locales que afectan al cumplimiento de las Cláusulas
(a) Las Partes garantizan que no tienen motivos para creer que las leyes y prácticas del tercer país de destino aplicables al tratamiento de los datos personales por parte del importador de datos, incluido cualquier requisito de revelar datos personales o medidas que autoricen el acceso de las autoridades públicas, impidan al importador de datos cumplir sus obligaciones en virtud de las presentes cláusulas. Esto se basa en el entendimiento de que las leyes y prácticas que respetan la esencia de los derechos y libertades fundamentales y no exceden de lo necesario y proporcionado en una sociedad democrática para salvaguardar uno de los objetivos enumerados en el artículo 23, apartado 1, del Reglamento (UE) 2016/679, no están en contradicción con las presentes Cláusulas.
(b) Las Partes declaran que, al otorgar la garantía prevista en la letra a), han tenido debidamente en cuenta, en particular, los siguientes elementos:
(i) las circunstancias específicas de la transferencia, incluida la longitud de la cadena de tratamiento, el número de agentes implicados y los canales de transmisión utilizados; las transferencias ulteriores previstas; el tipo de destinatario; la finalidad del tratamiento; las categorías y el formato de los datos personales transferidos; el sector económico en el que se produce la transferencia; el lugar de almacenamiento de los datos transferidos;
(ii) la legislación y las prácticas del tercer país de destino -incluidas las que exigen la comunicación de datos a las autoridades públicas o autorizan el acceso de dichas autoridades- pertinentes a la luz de las circunstancias específicas de la transferencia, y las limitaciones y garantías aplicables ([8] );
(iii) todas las garantías contractuales, técnicas u organizativas pertinentes establecidas para complementar las garantías previstas en las presentes cláusulas, incluidas las medidas aplicadas durante la transmisión y el tratamiento de los datos personales en el país de destino.
(c) El importador de datos garantiza que, al llevar a cabo la evaluación prevista en la letra b), ha hecho todo lo posible por facilitar al exportador de datos la información pertinente y se compromete a seguir cooperando con el exportador de datos para garantizar el cumplimiento de las presentes Cláusulas.
(d) Las Partes acuerdan documentar la evaluación prevista en la letra b) y ponerla a disposición de la autoridad de control competente a petición de ésta.
(e) El importador de datos se compromete a notificar sin demora al exportador de datos si, tras haber aceptado las presentes cláusulas y durante la vigencia del contrato, tiene motivos para creer que está o ha pasado a estar sujeto a leyes o prácticas que no se ajustan a los requisitos de la letra a), incluso a raíz de un cambio en la legislación del tercer país o de una medida (como una solicitud de divulgación) que indique una aplicación de dicha legislación en la práctica que no se ajusta a los requisitos de la letra a). El exportador de datos remitirá la notificación al responsable del tratamiento.
(f) Tras una notificación con arreglo a la letra e), o si el exportador de datos tiene motivos para creer que el importador de datos ya no puede cumplir sus obligaciones con arreglo a las presentes cláusulas , el exportador de datos determinará sin demora las medidas adecuadas (por ejemplo, medidas técnicas u organizativas para garantizar la seguridad y la confidencialidad) que deberán adoptar el exportador de datos y/o el importador de datos para hacer frente a la situación, si procede en consulta con el responsable del tratamiento. El exportador de datos suspenderá la transferencia de datos si considera que no pueden garantizarse las salvaguardias adecuadas para dicha transferencia, o si así se lo ordena el responsable del tratamiento o la autoridad de control competente. En este caso, el exportador de datos tendrá derecho a rescindir el contrato, en la medida en que se refiera al tratamiento de datos personales con arreglo a las presentes Cláusulas. Si el contrato implica a más de dos Partes, el exportador de datos podrá ejercer este derecho de resolución únicamente con respecto a la Parte pertinente, salvo que las Partes hayan acordado otra cosa. Cuando el contrato se rescinda en virtud de la presente Cláusula, se aplicarán las letras d) y e) de la Cláusula 16.
Artículo 15
Obligaciones del importador de datos en caso de acceso de las autoridades públicas
15.1 Notificación
(a) El importador de datos se compromete a notificar sin demora al exportador de datos y, cuando sea posible, al interesado (en caso necesario, con la ayuda del exportador de datos) si:
(i)reciba una solicitud jurídicamente vinculante de una autoridad pública, incluidas las autoridades judiciales, con arreglo a la legislación del país de destino, para la divulgación de los datos personales transferidos en virtud de las presentes cláusulas; dicha notificación incluirá información sobre los datos personales solicitados, la autoridad solicitante, la base jurídica de la solicitud y la respuesta proporcionada; o bien
(ii)tenga conocimiento de cualquier acceso directo por parte de las autoridades públicas a los datos personales transferidos en virtud de las presentes cláusulas de conformidad con la legislación del país de destino; dicha notificación incluirá toda la información de que disponga el importador.
El exportador de datos remitirá la notificación al responsable del tratamiento.
(b) Si la legislación del país de destino prohíbe al importador de datos notificar al exportador de datos y/o al interesado, el importador de datos se compromete a hacer todo lo posible para obtener una dispensa de la prohibición, con vistas a comunicar toda la información posible, lo antes posible. El importador de datos se compromete a documentar sus mejores esfuerzos para poder demostrarlos a petición del exportador de datos.
(c) Cuando la legislación del país de destino lo permita, el importador de datos se compromete a facilitar al exportador de datos, a intervalos regulares durante la vigencia del contrato, toda la información pertinente posible sobre las solicitudes recibidas (en particular, el número de solicitudes, el tipo de datos solicitados, la autoridad o autoridades solicitantes, si se han impugnado las solicitudes y el resultado de dichas impugnaciones, etc.). El exportador de datos transmitirá la información al responsable del tratamiento.
(d) El importador de datos se compromete a conservar la información contemplada en las letras a) a c) durante la vigencia del contrato y a ponerla a disposición de la autoridad de control competente a petición de ésta.
(e) Los apartados (a) a (c) se entienden sin perjuicio de la obligación del importador de datos, de conformidad con la Cláusula 14(e) y la Cláusula 16, de informar sin demora al exportador de datos cuando no pueda cumplir estas Cláusulas.
15.2 Revisión de la legalidad y minimización de datos
(a) El importador de datos se compromete a revisar la legalidad de la solicitud de divulgación, en particular si se mantiene dentro de los poderes otorgados a la autoridad pública solicitante, y a impugnar la solicitud si, tras una cuidadosa evaluación, llega a la conclusión de que existen motivos razonables para considerar que la solicitud es ilegal con arreglo a la legislación del país de destino, a las obligaciones aplicables en virtud del Derecho internacional y a los principios de cortesía internacional. El importador de datos deberá, en las mismas condiciones, hacer uso de las posibilidades de recurso. Cuando impugne una solicitud, el importador de datos solicitará medidas cautelares con vistas a suspender los efectos de la solicitud hasta que la autoridad judicial competente se haya pronunciado sobre el fondo de la misma. No revelará los datos personales solicitados hasta que se le requiera para ello con arreglo a las normas procesales aplicables. Estos requisitos se entienden sin perjuicio de las obligaciones del importador de datos con arreglo a la letra e) de la cláusula 14.
(b) El importador de datos se compromete a documentar su evaluación jurídica y cualquier impugnación de la solicitud de divulgación y, en la medida en que lo permita la legislación del país de destino, a poner la documentación a disposición del exportador de datos. También la pondrá a disposición de la autoridad de control competente a petición de ésta. El exportador de datos pondrá la evaluación a disposición del responsable del tratamiento.
(c) El importador de datos se compromete a proporcionar la cantidad mínima de información permitida al responder a una solicitud de divulgación, sobre la base de una interpretación razonable de la solicitud.
SECCIÓN IV - DISPOSICIONES FINALES
Artículo 16
Incumplimiento de las cláusulas y rescisión
(a) El importador de datos informará sin demora al exportador de datos en caso de que, por cualquier motivo, no pueda cumplir las presentes cláusulas.
(b) En caso de que el importador de datos incumpla estas cláusulas o no pueda cumplirlas, el exportador de datos suspenderá la transferencia de datos personales al importador de datos hasta que se garantice de nuevo el cumplimiento o se rescinda el contrato. Todo ello sin perjuicio de lo dispuesto en la letra f) de la cláusula 14.
(c) El exportador de datos tendrá derecho a rescindir el contrato, en la medida en que se refiera al tratamiento de datos personales con arreglo a las presentes Cláusulas, cuando:
(i) el exportador de datos haya suspendido la transferencia de datos personales al importador de datos de conformidad con el apartado (b) y no se restablezca el cumplimiento de las presentes Cláusulas en un plazo razonable y, en cualquier caso, en el plazo de un mes a partir de la suspensión;
(ii) el importador de datos incumple de forma sustancial o persistente las presentes cláusulas; o
(iii) el importador de datos incumple una decisión vinculante de un tribunal competente o de una autoridad de control en relación con las obligaciones que le incumben en virtud de las presentes cláusulas.
En estos casos, informará de dicho incumplimiento a la autoridad de control competente y al responsable del tratamiento. Cuando el contrato implique a más de dos Partes, el exportador de datos podrá ejercer este derecho de rescisión únicamente con respecto a la Parte pertinente, salvo que las Partes hayan acordado otra cosa.
(d) Los datos personales que se hayan transferido antes de la terminación del contrato con arreglo a la letra c) se devolverán inmediatamente al exportador de datos, a elección de éste, o se suprimirán en su totalidad. Lo mismo se aplicará a cualquier copia de los datos. El importador de datos certificará la supresión de los datos al exportador de datos. Hasta que los datos sean suprimidos o devueltos, el importador de datos seguirá garantizando el cumplimiento de las presentes cláusulas. En caso de que la legislación local aplicable al importador de datos prohíba la devolución o supresión de los datos personales transferidos, el importador de datos garantiza que seguirá velando por el cumplimiento de las presentes cláusulas y que sólo tratará los datos en la medida y durante el tiempo que exija dicha legislación local.
(e) Cualquiera de las Partes podrá revocar su acuerdo de quedar vinculada por las presentes Cláusulas cuando (i) la Comisión Europea adopte una decisión de conformidad con el artículo 45, apartado 3, del Reglamento (UE) 2016/679 que cubra la transferencia de datos personales a los que se aplican las presentes Cláusulas; o (ii) el Reglamento (UE) 2016/679 pase a formar parte del marco jurídico del país al que se transfieren los datos personales. Esto se entiende sin perjuicio de otras obligaciones aplicables al tratamiento en cuestión en virtud del Reglamento (UE) 2016/679.
Artículo 17
Legislación aplicable
Las presentes Cláusulas se regirán por la legislación de uno de los Estados miembros de la UE, siempre que dicha legislación permita los derechos de terceros beneficiarios. Las Partes acuerdan que esta será la legislación de Irlanda.
Artículo 18
Elección de foro y jurisdicción
(a) Cualquier litigio derivado de las presentes cláusulas será resuelto por los tribunales de un Estado miembro de la UE.
(b) Las Partes acuerdan que serán los tribunales de Irlanda.
(c) El interesado también podrá emprender acciones legales contra el exportador de datos y/o el importador de datos ante los tribunales del Estado miembro en el que tenga su residencia habitual.
(d) Las Partes acuerdan someterse a la jurisdicción de dichos tribunales.
ANEXO
ANEXO I
A. LISTA DE LAS PARTES
Exportador(es) de datos:
Nombre: Nombre del Cliente tal y como figura en el Acuerdo.
Dirección: Dirección del Cliente que figura en el Acuerdo.
Nombre, cargo y datos de contacto de la persona de contacto: Punto de contacto para el Cliente según lo establecido en el Acuerdo.
Actividades relevantes para los datos transferidos en virtud de las presentes Cláusulas: Cliente en virtud del Acuerdo
Función (controlador/procesador): Procesador
Importador(es) de datos:
Nombre: Nombre de Palantir tal y como figura en el Acuerdo.
Dirección: Dirección de Palantir que figura en el Acuerdo.
Nombre, cargo y datos de la persona de contacto: Responsable de protección de datos, dpo@palantir.com
Actividades relevantes para los datos transferidos en virtud de las presentes Cláusulas: Proveedor en virtud del Acuerdo
Función (controlador/procesador): Procesador
B. DESCRIPCIÓN DE LA TRANSFERENCIA
Categorías de interesados cuyos datos personales se transfieren
Según lo descrito en "Categorías de interesados cuyos datos personales pueden ser objeto de tratamiento" en el Anexo B y, en su caso, en cualquier otro anexo pertinente para los Servicios adicionales aplicables.
Categorías de datos personales transferidos
Según lo descrito en "Categorías de Datos Personales del Cliente" en el Anexo B y, en su caso, en cualquier otro anexo pertinente para los Servicios adicionales aplicables.
Datos sensibles transferidos (si procede) y restricciones o salvaguardias aplicadas que tengan plenamente en cuenta la naturaleza de los datos y los riesgos que entrañan, como por ejemplo una estricta limitación de la finalidad, restricciones de acceso (incluido el acceso únicamente del personal que haya seguido una formación especializada), mantenimiento de un registro de acceso a los datos, restricciones para las transferencias ulteriores o medidas de seguridad adicionales.
Datos personales que revelen el origen racial o étnico, opiniones políticas, creencias religiosas o filosóficas, o afiliación sindical, datos genéticos, datos biométricos, datos de salud, datos relativos a la vida sexual de una persona física u orientación sexual en la medida en que los Datos Personales del Cliente incluyan dichos datos sensibles y sean proporcionados a Palantir para su Tratamiento (incluido a través del Servicio) por o bajo la dirección del Cliente o de los Usuarios del Cliente. En ese caso, el Cliente identificará claramente dichos datos sensibles a Palantir por escrito antes de proporcionar dichos datos sensibles. Las salvaguardas y restricciones aplicadas se describen en el Anexo II.
La frecuencia de la transferencia (por ejemplo, si los datos se transfieren de forma puntual o continua).
De forma continua.
Naturaleza del tratamiento
Según lo descrito en el apartado "Naturaleza y finalidad del tratamiento" del Anexo B y, en su caso, cualquier otro anexo pertinente para los Servicios adicionales aplicables.
Finalidad o finalidades de la transferencia y el tratamiento posterior de los datos
Según lo descrito en el apartado "Naturaleza y finalidad del tratamiento" del Anexo B y, en su caso, cualquier otro anexo pertinente para los Servicios adicionales aplicables.
El período durante el cual se conservarán los datos personales o, si esto no fuera posible, los criterios utilizados para determinar dicho período.
Tal y como se describe en el apartado "Duración de la tramitación" del Anexo B y, en su caso, en cualquier otro anexo pertinente para los Servicios adicionales aplicables.
Para las transferencias a (sub)procesadores, especifique también el objeto, la naturaleza y la duración del tratamiento
Tal y como se describe en el apartado "Objeto, naturaleza y duración del tratamiento por parte de los subencargados del tratamiento" del Anexo B y, en su caso, cualquier otro anexo pertinente para los Servicios adicionales aplicables.
C. AUTORIDAD DE CONTROL COMPETENTE
Identifique a la autoridad o autoridades de control competentes de conformidad con la cláusula 13.
La autoridad supervisora determinada de conformidad con la cláusula 13 y especificada en https://edpb.europa.eu/about-edpb/about-edpb/members_en (actualizada periódicamente).
ANEXO II
MEDIDAS TÉCNICAS Y ORGANIZATIVAS, INCLUIDAS LAS MEDIDAS TÉCNICAS Y ORGANIZATIVAS PARA GARANTIZAR LA SEGURIDAD DE LOS DATOS
Descripción de las medidas técnicas y organizativas aplicadas por el importador o importadores de datos (incluidas las certificaciones pertinentes) para garantizar un nivel de seguridad adecuado, teniendo en cuenta la naturaleza, el alcance, el contexto y la finalidad del tratamiento, así como los riesgos para los derechos y libertades de las personas físicas.
Las características y funcionalidades de seguridad a disposición del Cliente descritas en la DPA, tal y como se documentan con más detalle en la Documentación de Seguridad, y las medidas técnicas y organizativas descritas en la DPA.
Para las transferencias a (sub)encargados del tratamiento, describa también las medidas técnicas y organizativas específicas que deberá adoptar el (sub)encargado del tratamiento para poder prestar asistencia al responsable del tratamiento y, para las transferencias de un encargado del tratamiento a un subencargado, al exportador de datos.
Los controles a disposición del Cliente descritos en la DPA, tal y como se documentan con más detalle en la Documentación de Seguridad.
- Cuando el exportador de datos sea un encargado del tratamiento sujeto al Reglamento (UE) 2016/679 que actúe en nombre de una institución u organismo de la Unión como responsable del tratamiento, la confianza en las presentes Cláusulas al contratar a otro encargado (subtratamiento) no sujeto al Reglamento (UE) 2016/679 también garantiza el cumplimiento del artículo 29, apartado 4, del Reglamento (UE) 2018/1725 del Parlamento Europeo y del Consejo, de 23 de octubre de 2018, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales por las instituciones de la Unión, órganos y organismos de la Unión y sobre la libre circulación de estos datos, y por el que se derogan el Reglamento (CE) n.º 45/2001 y la Decisión n.º 1247/2002/CE (DO L 295 de 21.11.2018, p. 39), en la medida en que estas Cláusulas y las obligaciones de protección de datos establecidas en el contrato u otro acto jurídico entre el responsable y el encargado del tratamiento de conformidad con el artículo 29, apartado 3, del Reglamento (UE) 2018/1725 estén alineadas. Este será el caso, en particular, cuando el responsable y el encargado del tratamiento se basen en las cláusulas contractuales tipo incluidas en la Decisión 2021/915. ↑
- El Acuerdo sobre el Espacio Económico Europeo (Acuerdo EEE) prevé la ampliación del mercado interior de la Unión Europea a los tres Estados del EEE: Islandia, Liechtenstein y Noruega. La legislación de la Unión en materia de protección de datos, incluido el Reglamento (UE) 2016/679, está cubierta por el Acuerdo EEE y se ha incorporado a su anexo XI. Por lo tanto, cualquier divulgación por parte del importador de datos a un tercero situado en el EEE no se considera una transferencia ulterior a efectos de las presentes cláusulas. ↑
- Este requisito podrá satisfacerse si el subencargado del tratamiento se adhiere a las presentes cláusulas en virtud del módulo correspondiente, de conformidad con la cláusula 7. ↑
- En lo que respecta al impacto de dichas leyes y prácticas en el cumplimiento de estas Cláusulas, pueden considerarse diferentes elementos como parte de una evaluación general. Dichos elementos pueden incluir la experiencia práctica pertinente y documentada con casos anteriores de solicitudes de revelación de información por parte de las autoridades públicas, o la ausencia de tales solicitudes, que abarquen un marco temporal suficientemente representativo. Esto se refiere, en particular, a los registros internos u otra documentación, elaborada de forma continua de conformidad con la diligencia debida y certificada a nivel de la alta dirección, siempre que esta información pueda compartirse legalmente con terceros. Cuando se confíe en esta experiencia práctica para llegar a la conclusión de que no se impedirá al importador de datos cumplir con estas Cláusulas, deberá apoyarse en otros elementos pertinentes y objetivos, y corresponderá a las Partes considerar cuidadosamente si estos elementos juntos tienen suficiente peso, en términos de su fiabilidad y representatividad, para apoyar esta conclusión. En particular, las Partes han de tener en cuenta si su experiencia práctica se ve corroborada y no contradicha por información fiable, públicamente disponible o accesible de otro modo, sobre la existencia o ausencia de solicitudes dentro del mismo sector y/o la aplicación de la ley en la práctica, como la jurisprudencia y los informes de organismos de supervisión independientes. ↑
- Cuando el exportador de datos sea un encargado del tratamiento sujeto al Reglamento (UE) 2016/679 que actúe en nombre de una institución u organismo de la Unión como responsable del tratamiento, la confianza en las presentes Cláusulas al contratar a otro encargado (subtratamiento) no sujeto al Reglamento (UE) 2016/679 también garantiza el cumplimiento del artículo 29, apartado 4, del Reglamento (UE) 2018/1725 del Parlamento Europeo y del Consejo, de 23 de octubre de 2018, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales por las instituciones de la Unión, órganos y organismos de la Unión y sobre la libre circulación de estos datos, y por el que se derogan el Reglamento (CE) n.º 45/2001 y la Decisión n.º 1247/2002/CE (DO L 295 de 21.11.2018, p. 39), en la medida en que estas Cláusulas y las obligaciones de protección de datos establecidas en el contrato u otro acto jurídico entre el responsable y el encargado del tratamiento de conformidad con el artículo 29, apartado 3, del Reglamento (UE) 2018/1725 estén alineadas. Este será el caso, en particular, cuando el responsable y el encargado del tratamiento se basen en las cláusulas contractuales tipo incluidas en la Decisión 2021/915. ↑
- El Acuerdo sobre el Espacio Económico Europeo (Acuerdo EEE) prevé la ampliación del mercado interior de la Unión Europea a los tres Estados del EEE: Islandia, Liechtenstein y Noruega. La legislación de la Unión en materia de protección de datos, incluido el Reglamento (UE) 2016/679, está cubierta por el Acuerdo EEE y se ha incorporado a su anexo XI. Por lo tanto, cualquier divulgación por parte del importador de datos a un tercero situado en el EEE no se considera una transferencia ulterior a efectos de las presentes cláusulas. ↑
- Este requisito podrá satisfacerse si el subencargado del tratamiento se adhiere a las presentes cláusulas en virtud del módulo correspondiente, de conformidad con la cláusula 7. ↑
- En lo que respecta al impacto de dichas leyes y prácticas en el cumplimiento de estas Cláusulas, se pueden considerar diferentes elementos como parte de una evaluación general. Dichos elementos pueden incluir la experiencia práctica pertinente y documentada con casos anteriores de solicitudes de revelación de información por parte de las autoridades públicas, o la ausencia de tales solicitudes, que abarquen un marco temporal suficientemente representativo. Esto se refiere, en particular, a los registros internos u otra documentación, elaborada de forma continua de conformidad con la diligencia debida y certificada a nivel de la alta dirección, siempre que esta información pueda compartirse legalmente con terceros. Cuando se confíe en esta experiencia práctica para llegar a la conclusión de que no se impedirá al importador de datos cumplir con estas Cláusulas, deberá apoyarse en otros elementos pertinentes y objetivos, y corresponderá a las Partes considerar cuidadosamente si estos elementos juntos tienen suficiente peso, en términos de su fiabilidad y representatividad, para apoyar esta conclusión. En particular, las Partes han de tener en cuenta si su experiencia práctica se ve corroborada y no contradicha por información fiable, públicamente disponible o accesible de otro modo, sobre la existencia o ausencia de solicitudes en el mismo sector y/o la aplicación de la ley en la práctica, como la jurisprudencia y los informes de organismos de supervisión independientes. ↑
[FRENCH] Terms of Service (AIP Now)
Effective May 23rd 2025
DownloadTable of Contents
PALANTIR AIP NOW CONDITIONS D'UTILISATION
EN SÉLECTIONNANT "I ACCEPT" (OU L'ÉQUIVALENT) LORSQU'UNE TELLE OPTION EST DISPONIBLE, OU EN INSTALLANT, EXÉCUTANT, TÉLÉCHARGEANT, ACCÉDANT OU UTILISANT DE TOUTE AUTRE MANIÈRE TOUTE PARTIE DE LA PLATEFORME PALANTIR (TELLE QUE DÉFINIE CI-DESSOUS), VOUS CONFIRMEZ QUE VOUS ("VOUS" OU "VOTRE" OU "UTILISATEUR AUTORISÉ") AVEZ LU LE PRÉSENT ACCORD (TEL QUE DÉFINI CI-DESSOUS), QUE VOUS COMPRENEZ LES TERMES DE L'ACCORD, ET QUE VOUS ET (LE CAS ÉCHÉANT) L'ENTITÉ QUE VOUS REPRÉSENTEZ CONSENTEZ INCONDITIONNELLEMENT À ÊTRE LIÉS PAR ET DEVENEZ PARTIE À CET ACCORD, QUI, POUR ÉVITER TOUT DOUTE, CONTIENT LA SECTION 13 CONCERNANT L'ARBITRAGE OBLIGATOIRE ET CONTRAIGNANT DES LITIGES, LA SECTION 4 CONCERNANT L'UTILISATION ACCEPTABLE, ET LA SECTION 9.2 CONCERNANT LES INDEMNITÉS DU CLIENT. SI VOUS CONCLUEZ LE PRÉSENT ACCORD AU NOM D'UNE ENTITÉ, TELLE QUE LA SOCIÉTÉ, L'ORGANISATION OU L'ÉTABLISSEMENT D'ENSEIGNEMENT POUR LEQUEL VOUS TRAVAILLEZ, VOUS DÉCLAREZ ET GARANTISSEZ QUE VOUS ÊTES AUTORISÉ À ACCEPTER LES CONDITIONS DU PRÉSENT ACCORD AU NOM DE L'ENTITÉ EN TANT QUE REPRÉSENTANT LÉGAL AUTORISÉ. SI VOUS N'ACCEPTEZ PAS INCONDITIONNELLEMENT TOUS LES TERMES DE CET ACCORD, NE SÉLECTIONNEZ PAS "J'ACCEPTE" LORSQUE CETTE OPTION EST DISPONIBLE ET N'INSTALLEZ PAS, N'EXÉCUTEZ PAS, NE TÉLÉCHARGEZ PAS, N'ACCÉDEZ PAS OU N'UTILISEZ PAS DE QUELQUE MANIÈRE QUE CE SOIT TOUTE PARTIE DE LA PLATEFORME PALANTIR.
L'ACCEPTATION DE PALANTIR EST EXPRESSÉMENT CONDITIONNÉE PAR VOTRE CONSENTEMENT À TOUS LES TERMES ET CONDITIONS DE CET ACCORD, À L'EXCLUSION DE TOUS LES AUTRES TERMES ; SI CES TERMES SONT CONSIDÉRÉS COMME UNE OFFRE, L'ACCEPTATION EST EXPRESSÉMENT LIMITÉE À CES TERMES.
PALANTIR AIP NOW N'EST ACTUELLEMENT DISPONIBLE QUE POUR LES CLIENTS ET LES UTILISATEURS SITUÉS AUX ÉTATS-UNIS, AU CANADA, EN RÉPUBLIQUE D'INDE, EN RÉPUBLIQUE FÉDÉRALE D'ALLEMAGNE, PAYS-BAS, EN ESPAGNE, EN AUTRICHE, EN SUISSE, EN FRANCE OU AU ROYAUME-UNI. EN CONSÉQUENCE, VOUS DEVEZ PRÉSENTER UNE PIÈCE D'IDENTITÉ (SUR LE FORMULAIRE DE COMMANDE, TEL QUE DÉFINI CI-DESSOUS) DÉLIVRÉE PAR LES ÉTATS-UNIS (OU LEUR ÉTAT), LE CANADA, LA RÉPUBLIQUE DE L'INDE, LES PAYS-BAS, L'ESPAGNE, L'AUTRICHE, LA SUISSE, LA FRANCE OU LE ROYAUME-UNI POUR BÉNÉFICIER DE L'ACCÈS AU , PALMARÈSOU LE ROYAUME-UNI POUR RECEVOIR L'ACCÈS À PALANTIR AIP NOW, ET VOUS NE POUVEZ PAS ACCÉDER À PALANTIR AIP NOW NI L'UTILISER SI VOUS ÊTES SITUÉ EN DEHORS DES ÉTATS-UNIS, DU CANADA, DE LA RÉPUBLIQUE D'INDE, DE LA RÉPUBLIQUE FÉDÉRALE D'ALLEMAGNE, DES PAYS-BAS, DE L'ESPAGNE, DE L'AUTRICHE, DE LA SUISSE, DE LA FRANCE OU DU ROYAUME-UNI.
Le présent Contrat est conclu entre le Client (tel que défini ci-dessous) et Palantir (chacun étant une "Partie" et collectivement les "Parties") et prend effet à la date à laquelle Vous sélectionnez "J'ACCEPTE" (ou équivalent) sur le Formulaire de Soumission de Commande lorsque cette option est mise à disposition par Palantir (la "Date d'Entrée en Vigueur") .
1.1 On entend par "société affiliée" une entité qui, directement ou indirectement, possède ou contrôle une partie à la date d'entrée en vigueur et tant que cette entité reste directement ou indirectement détenue ou contrôlée par la partie, ou est détenue ou contrôlée par elle. Au sens des présentes, on entend par "contrôle" le pouvoir de diriger, directement ou indirectement, la gestion ou les affaires d'une entité et par "propriété" la propriété effective de plus de cinquante pour cent des titres de participation avec droit de vote ou d'autres intérêts avec droit de vote équivalents d'une entité.
1.2 Le terme "Contrat" désigne, collectivement, les présentes Conditions de service de Palantir AIP Now et toutes les pièces jointes, addenda, conditions, avis, règles de fonctionnement, politiques (y compris la Politique de confidentialité de Palantir), pièces, annexes ou documents incorporés par référence ou hyperliens dans les présentes (tels qu'ils peuvent être mis à jour de temps à autre conformément à l'article 13 des présentes) ou que nous pouvons publier de temps à autre sur le site Web ou les comptes du client et tous les documents de commande conclus entre Palantir et le client qui font référence au présent contrat, y compris le formulaire de soumission de commande.
1.3 "Client" : le client identifié sur le formulaire de soumission de commande qui est partie au présent contrat et au nom duquel vous acceptez les conditions du présent contrat en tant que représentant légal.
1.4 On entend par "Données Client" toutes les données (y compris les versions agrégées ou transformées de celles-ci et les résultats analytiques), les modèles, les algorithmes, les analyses, le code de transformation ou tout autre contenu fourni par, directement ou indirectement par un tiers, ou créé par le Client ou les Utilisateurs utilisant le Service ou le Site web, pour intégration, utilisation ou autre traitement dans ou par le biais du Service. Les données du client excluent les données d'utilisation.
1.5 "Logiciel de connexion des données" désigne le logiciel de Palantir fourni pour être installé localement par le client afin de connecter les données du client au service.
1.6 "Documentation" signifie toute documentation technique pour le Service mise à disposition en relation avec le Service, y compris la documentation technique relative au Service disponible sur https://www.palantir.com/docs/, mise à jour de temps en temps à la seule discrétion de Palantir.
1.7 "Droits de propriété intellectuelle" : tous les droits, titres et intérêts relatifs aux secrets commerciaux, brevets, droits d'auteur, marques de service, marques déposées, savoir-faire, noms commerciaux, droits sur l'habillage commercial et l'emballage, droits moraux, droits à la vie privée, droits de publicité et tout autre droit similaire, y compris les demandes, continuations ou enregistrements relatifs à ce qui précède, en vertu des lois ou des règlements de toute autorité gouvernementale, réglementaire ou judiciaire.
1.8 "Formulaire de soumission de commande" désigne le formulaire en ligne (ou le document incorporant expressément le présent contrat par référence) rempli et/ou signé par vous pour inclure les informations du client et spécifier le service et/ou les services professionnels (le cas échéant) à fournir en vertu des présentes et qui est soumis par vous à Palantir pour le compte du client.
1.9 "Palantir", sauf indication contraire expresse dans un formulaire de soumission de commande, signifie (a) Palantir Technologies Inc. si le lieu d'utilisation principal du client est les Etats-Unis, le Canada, la République fédérale d'Allemagne, les Pays-Bas, l'Espagne, l'Autriche, la Suisse, la France ou la République de l'Inde ; ou (b) Palantir Technologies UK, Ltd. si le lieu d'utilisation principal du client est le Royaume-Uni. Nonobstant ce qui précède, (x) si le siège social (c'est-à-dire l'établissement principal) de l'entité mère ultime du client est situé en République de Corée, "Palantir" désigne Palantir Korea LLC. Si ni (a), ni (b), ni (x) ne s'applique, alors "Palantir" signifie Palantir Technologies Inc.
1.10 "Plate-forme Palantir" désigne le service, la documentation, le logiciel de connexion des données, les échantillons, le site Web, les modèles et les interfaces de programmation d'application (API), fournis ou mis à la disposition du client en tant que service dans le cadre du présent accord, ainsi que toutes les améliorations, modifications, travaux dérivés, correctifs, mises à niveau et mises à jour qui s'y rapportent.
1.11 "Politique de confidentialité de Palantir" : toute politique spécifique à la confidentialité disponible sur le site web et/ou accessible par le biais du formulaire de soumission de commande.
1.12 Le "matériel d'échantillonnage" désigne toute technologie et tout matériel fourni ou mis à disposition par Palantir au client pour être utilisé avec le service, y compris le code d'échantillonnage, les bibliothèques logicielles, les outils de ligne de commande, le code d'intégration des données, les modèles et les fichiers de configuration.
1.13 "Service" désigne l'accès au logiciel en tant que service à Palantir AIP Now (ou à la (aux) plateforme(s) spécifiée(s) dans un formulaire de soumission de commande).
1.14 On entend par "taxes" toute taxe applicable sur les ventes, l'utilisation, les transactions, la valeur ajoutée, les biens et services, la taxe de vente harmonisée, les retenues à la source, les droits d'accise ou autres taxes similaires, ainsi que tous les frais ou charges étrangers, provinciaux, fédéraux, étatiques ou locaux (y compris, mais sans s'y limiter, les frais environnementaux ou autres frais similaires), les droits, les coûts de conformité aux contrôles et réglementations en matière d'exportation et d'importation, et autres évaluations gouvernementales, y compris les pénalités et les intérêts y afférents, imposés sur, concernant ou associés de toute autre manière à toute transaction dans le cadre des présentes.
1.15 "Contenu Tiers" désigne toutes les données, services ou applications tiers qui interagissent avec le Service et dont Palantir peut, à la seule discrétion du Client, faciliter l'utilisation en relation avec le Service et sous réserve d'un accord indépendant entre le Client et ce tiers.
1.16 "Services Tiers" désigne les services tiers que Palantir peut utiliser dans le cadre de la fourniture du Service, comme indiqué dans la Documentation (ou comme convenu par ailleurs par les Parties).
1.17 "Site web" signifie WWW.PALANTIR.COM ou tout autre domaine appartenant à Palantir, y compris tout sous-domaine de ce qui précède, et tous les logiciels, applications, produits, contenus et services fournis par Palantir sur ou par l'intermédiaire du site web.
2.1 Accès au Service. Palantir mettra le Service à la disposition du Client, sous réserve des conditions ultérieures énoncées à la Section 2.8, pendant la Durée applicable, uniquement pour une utilisation par le Client et ses Utilisateurs conformément aux termes et conditions du présent Contrat et de la Documentation, à des fins professionnelles internes (et/ou, le cas échéant, personnelles) du Client, ou (le cas échéant) comme prévu explicitement par ailleurs dans un Formulaire de Soumission de Commande
2.2 Licence de logiciel de connexion de données. Si cela s'applique à l'utilisation du Service, et sous réserve des conditions ultérieures énoncées dans la Section 2.8, Palantir accorde au Client pendant la Durée une licence limitée non exclusive, non transférable, non sous-licenciable, pour utiliser le Logiciel de Connexion des Données dans le seul but d'utiliser et de se connecter au Service. Le Client autorisera Palantir à accéder à distance au Logiciel de Connexion des Données si nécessaire pour fournir le Service.
2.3 Licence sur les échantillons de matériel. Palantir peut mettre à disposition des échantillons de matériel à utiliser par le Client pendant la Durée. Le cas échéant, et sous réserve des conditions ultérieures énoncées dans la Section 2.8, Palantir accorde au Client pendant la Durée une licence non exclusive, non transférable, non sous-licenciable, limitée, pour copier, modifier et utiliser les Échantillons uniquement dans la mesure nécessaire à l'utilisation du Service par le Client.
2.4 Données d'utilisation. Palantir peut collecter et utiliser des mesures, des analyses, des statistiques ou d'autres données liées à l'utilisation du Service par le Client (a) pour sécuriser le Service au profit du Client ; (b) pour fournir, analyser, maintenir, soutenir et améliorer le Service ; et (c) pour tout autre objectif pour lequel le Client fournit une autorisation via le Service, lorsque cette option est disponible (collectivement "Données d'Utilisation").
2.5 Sécurité. Palantir a mis en place un programme de sécurité de l'information ("ISP") conçu pour garantir des contrôles de sécurité pratiques et solides, ainsi que la conformité avec les normes et les cadres des meilleures pratiques de l'industrie. Une liste complète des certifications de Palantir peut être consultée sur le site https://www.palantir.com/information-security/ sous "Compliance and Accreditation". L'ISP de Palantir est en outre aligné sur les cadres et systèmes de gestion NIST 800-53, TSC (Trust Service Criteria) et CIS (Center for Internet Security). Le client reconnaît que la documentation de Palantir mentionnée dans cette section et d'autres informations connexes sont des informations confidentielles de Palantir en vertu des présentes.
2.6 Niveaux de service et assistance. Pendant la Durée, Palantir n'a aucune obligation de fournir des services de support dans le cadre de ce Contrat. Ce Contrat ne vous donne pas, à Vous ou au Client, de droits sur les mises à jour ou les mises à niveau de la Plateforme Palantir ou sur les extensions ou les améliorations de la Plateforme Palantir développées par Palantir à tout moment dans le futur. Palantir peut offrir des services d'assistance séparément. Tout code logiciel supplémentaire ou matériel connexe que Palantir vous fournit ou fournit au client dans le cadre des services d'assistance doit être considéré comme faisant partie de la Plateforme Palantir et est soumis aux termes et conditions du présent Accord.
2.7 Services Professionnels. Palantir fournira au Client des services de mise en œuvre, d'habilitation, de formation ou d'autres services professionnels tels que spécifiés dans le Formulaire de Soumission de Commande, et soumis à tous les frais qui en découlent ("Services Professionnels"). Si le formulaire de soumission de commande ne spécifie aucun service professionnel, Palantir peut à sa discrétion (sans obligation de le faire en l'absence d'un accord séparé stipulant le contraire) fournir au Client des services professionnels. L'exécution de tout Service Professionnel n'affectera pas la propriété de la Plateforme Palantir et des autres matériels fournis par Palantir dans le cadre de ce Contrat.
2.8 Exigences de conformité de Palantir. Si Palantir détermine, à sa seule discrétion, que le client n'a pas satisfait aux exigences de conformité de Palantir, les obligations de Palantir en vertu des sections 2.1, 2.2 et 2.3 (y compris l'octroi des droits d'accès et des licences qui y sont prévues) prendront immédiatement fin dès que Palantir déterminera que le client n'a pas satisfait aux exigences de conformité de Palantir. Palantir peut évaluer (et réévaluer) le respect par le Client des exigences de conformité de Palantir à tout moment, y compris après que le Client ait accédé au Service. En outre, l'accès continu du Client au Service et/ou à toute Plateforme Palantir est conditionné à la détermination par Palantir, à sa seule discrétion, que le Client satisfait aux Exigences de Conformité de Palantir. Les "Exigences de Conformité de Palantir" comprennent (mais ne sont pas limitées à) la détermination par Palantir (à sa seule discrétion) que l'exécution de cet Accord avec le Client ne risque pas (i) de violer les obligations de Palantir en vertu des réglementations de contrôle commercial des Etats-Unis, y compris les réglementations d'administration des exportations des Etats-Unis, ou d'autres réglementations d'exportation applicables. Export Administration regulations, ou d'autres lois de contrôle des exportations applicables dans d'autres juridictions, (ii) violer ou autrement enfreindre les obligations contractuelles de Palantir avec des tiers, (iii) rendre Palantir en violation des lois interdisant de fournir des biens, du soutien ou des services à des Specially Designated Nationals tels que définis par le Département du Trésor des États-Unis, ou à des personnes soumises à des interdictions de blocage ou de refus similaires administrées par une agence du gouvernement des États-Unis, (iv) rendre Palantir en violation des lois interdisant de fournir des biens, du soutien ou des services à des Specially Designated Nationals tels que définis par le Département du Trésor des États-Unis, ou à des personnes soumises à des interdictions de blocage ou de refus similaires administrées par une agence du gouvernement des États-Unis.(iv) violer les obligations de Palantir en vertu des lois et réglementations sur les exportations et les sanctions des Etats-Unis et d'autres juridictions applicables, y compris, sans limitation, celles du Bureau américain de l'industrie et de la sécurité et de l'Office of Foreign Assets Control, ou (v) violer de toute autre manière les politiques ou valeurs de Palantir. Palantir se réserve le droit de modifier la définition des exigences de conformité de Palantir à tout moment, selon les besoins et à sa seule discrétion.
3. Utilisation du service par le client.
3.1 Comptes.
(a) Si le Client est une entité autre qu'une personne physique, telle qu'une entreprise, une organisation ou un établissement d'enseignement, le Client peut fournir un maximum de cinq (5) comptes pour accéder au Service ("Comptes") pour ses (1) employés, (2) contractants, (3) autres utilisateurs (y compris les employés ou contractants de ses Affiliés) spécifiés dans le Formulaire de Soumission de Commande aux fins autorisées par les présentes, et/ou (4) les clients du Client (les "Tiers Autorisés") sous réserve des conditions supplémentaires énoncées à la Section 3.1(a)(i)-(vi) des présentes (collectivement, les "Utilisateurs") :
(i) Le client peut accorder l'accès au service à un tiers autorisé uniquement dans le but d'utiliser les services fournis par le client au tiers autorisé dans le cadre des activités commerciales du client ; pour éviter toute ambiguïté, un tiers autorisé ne peut pas accéder au service pour ses propres activités commerciales indépendantes des services fournis par le client.
(ii) L'accès des Tiers Autorisés au Service sera strictement limité aux applications frontales construites par le Client en utilisant la Plateforme Palantir et il est interdit aux Tiers Autorisés d'ingérer directement des données dans la Plateforme Palantir, à condition que le Client puisse ingérer les données du Tiers Autorisé dans la Plateforme Palantir sous réserve du point (i) ci-dessus.
(iii) L'accès du Tiers Autorisé sera régi par et soumis à toutes les restrictions et obligations de l'Accord, et le Client sera responsable de tout manquement ou violation de celui-ci par un Tiers Autorisé. Le Client peut fournir à un Tiers Autorisé un accès soumis aux conditions d'accès non modifiées fournies séparément au Client par Palantir.
(iv) L'utilisation par un tiers autorisé est soumise aux redevances prévues dans le présent document.
(v) Le Client est responsable de la fourniture d'une assistance aux Tiers Autorisés concernant les applications frontales construites par le Client, et le Client doit maintenir une politique d'assistance stipulant que les Tiers Autorisés doivent soumettre toute demande d'assistance au Client, à condition que le Client puisse escalader à Palantir les problèmes de la Plateforme Palantir identifiés par un Tiers Autorisé qui ne peuvent être résolus par le Client et Palantir fournira une assistance raisonnable au Client pour de telles escalades pendant les heures normales d'ouverture de Palantir dans la (les) région(s) désignée(s) par Palantir.
(vi) Le Client ne doit pas, et ne doit pas permettre à un Tiers Autorisé d'accéder à la Plateforme Palantir à partir de tout pays figurant sur la liste des pays interdits de Palantir, telle que mise à disposition par Palantir au Client (chacun étant un "Pays Interdit").
(b) Si le Client est une personne physique, le Client ne peut fournir plus de cinq (5) Comptes, chacun uniquement à d'autres personnes physiques (chacune de ces personnes physiques étant considérée comme un Utilisateur) qui ont fourni au Client tous les consentements, autorisations, approbations, et/ou accords nécessaires pour permettre au Client d'utiliser et/ou de traiter les données de ces Utilisateurs en vertu de la loi applicable, de la réglementation, ou des accords avec ces Utilisateurs, et qui ont signé des Conditions de Service avec Palantir substantiellement similaires aux termes du présent Accord ; à condition que, si le Client est une personne physique accédant à l'instance du Service d'un autre client de Palantir en tant qu'Utilisateur autorisé (ou équivalent, tel qu'identifié sur le Formulaire de Soumission de Commande) (cet autre client de Palantir, un "Utilisateur Principal"), ce Client n'est pas autorisé à fournir des Comptes. Le Client sera responsable (i) de l'administration des Comptes ; (ii) de l'utilisation des mesures de sécurité standard de l'industrie pour protéger les Comptes (y compris, sans limitation, l'utilisation de l'authentification multi-facteurs) ; (iii) de toute activité sur les Comptes et de la surveillance de cette activité sur les Comptes (uniquement dans la mesure où cette surveillance ne viole aucune autre condition du présent Accord ou de la loi applicable) ; et (iv) des actions et omissions de ses Utilisateurs en relation avec la Plateforme Palantir et/ou les Comptes. Le Client désactivera immédiatement tout Compte dès qu'il aura connaissance de la compromission ou de l'utilisation non autorisée de celui-ci (et dans ce cas, notifiera rapidement Palantir de cette compromission ou utilisation non autorisée), ou sur demande raisonnable de Palantir.
3.2 Protection des données. Les Parties se conformeront à l'Addendum de Protection des Données de Palantir ("DPA") disponible sur https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795 . Le Client sera seul responsable de l'exactitude, du contenu et de la légalité des Données Client et s'assurera que toute intégration des Données Client dans le Service est conforme aux lois et réglementations applicables, y compris, mais sans s'y limiter, aux exigences de localisation des données. Dans le rôle de Palantir en tant que contrôleur (tel que défini dans le DPA) en ce qui concerne le Client, la politique de confidentialité de l'AIP Now disponible sur http://www.palantir.com/aip-now-statement s'appliquera et sera incorporée ici par référence.
4. Utilisation acceptable.
4.1 Lois applicables. Votre accès et votre utilisation du Service et du Site Web, ainsi que ceux du Client, ne violeront pas les lois applicables des Etats-Unis ou d'autres lois applicables dans la juridiction dans laquelle Vous ou le Client êtes situé, dans laquelle toute personne physique qui peut être identifiée (directement ou indirectement) par référence aux Données Client (chacune, une "Personne concernée") est située, ou dans laquelle les Données Client sont stockées et il est de votre seule responsabilité et de celle du Client d'assurer une telle conformité. Palantir peut de temps à autre mettre à disposition des politiques d'utilisation acceptables, des directives communautaires ou des politiques similaires, qui feront partie de cet Accord conformément à la politique de mise à jour énoncée à la Section 14.
4.2 Utilisation concurrentielle. Le client n'utilisera pas, n'accédera pas, n'évaluera pas ou ne verra pas la Plateforme Palantir dans le but de construire ou d'offrir un produit ou un service similaire ou compétitif à la Plateforme Palantir.
4.3 Contrôle des exportations. La Plateforme Palantir peut être soumise aux réglementations de contrôle commercial des Etats-Unis, telles que les Réglementations d'Administration d'Exportation des Etats-Unis, ou d'autres lois de contrôle d'exportation applicables dans d'autres juridictions, y compris les lois et réglementations d'exportation et de sanctions référencées dans la Section 15 de cet Accord. Le Client ne peut pas utiliser la Plateforme Palantir en violation du contrôle des exportations ou d'autres contrôles commerciaux des Etats-Unis ou de toute autre juridiction applicable. Ceci inclut, sans limitation, les interdictions suivantes :
(a) Le client ne peut pas utiliser ou accéder au service s'il est ou travaille pour le compte d'un ressortissant spécialement désigné, tel que défini par le département du Trésor des États-Unis, ou d'une personne soumise à des interdictions similaires de blocage ou de refus d'accès administrées par une agence gouvernementale américaine ; et
(b) Le client ne peut pas utiliser le service ou y accéder pour effectuer des activités soumises à la réglementation ITAR (International Traffic in Arms Regulations) du Département d'État des États-Unis, y compris, mais sans s'y limiter, l'ingestion de données contrôlées par ITAR.
4.4 Utilisation d'IIP et/ou d'ISP. Si le client utilise ou prévoit d'utiliser des informations d'identification personnelle ("PII"), des données personnelles, des informations personnelles ou des informations de santé protégées ("PHI"), telles que définies par la loi applicable, en relation avec le service, le client (a) doit indiquer cette utilisation (prévue) lorsque cette option est disponible dans le formulaire de soumission de commande, et signer un accord d'association commerciale avant d'accéder au service ou de l'utiliser ; et (b) suivra les conseils pertinents et les meilleures pratiques pour protéger les données sensibles définies dans la documentation disponible à l'adresse https://www.palantir.com/docs/foundry/security/overview/. Pour éviter toute ambiguïté, le présent article n'autorise pas le client à utiliser les informations susmentionnées dans le cadre du service si un formulaire de commande n'autorise pas expressément une telle utilisation.
4.5 Limitations des cas d'utilisation. Le Client doit se conformer aux Restrictions de Cas d'Utilisation de Palantir disponibles sur https://palantir.pactsafe.io/#ucr-985315, qui sont par la présente incorporées par référence dans l'Accord, y compris en relation avec toute utilisation de la Plateforme Palantir
4.6 Droits d'audit. Le Client accepte que Palantir puisse auditer l'utilisation du Service par le Client afin de vérifier le respect par le Client du présent Accord, y compris, mais sans s'y limiter, le respect de la Section 3.2 (Protection des données), de la Section 4 (Utilisation acceptable), de la Section 5.3 (Restrictions), de la Section 6 (Confidentialité), et de la Section 7 (Frais et paiement). Si Palantir prend connaissance ou soupçonne raisonnablement une violation du présent Accord par le Client, sur préavis raisonnable, Palantir peut vérifier la conformité du Client avec le présent Accord, l'utilisation par le Client de la Plateforme Palantir, et le(s) système(s) de surveillance du logiciel du Client et les enregistrements, à condition que cet audit soit effectué pendant les heures de travail normales du Client. Si Palantir croit raisonnablement que cet audit révèle que le Client a violé le présent Contrat, Palantir peut exercer ses droits de résiliation conformément à la Section 8.2, et/ou ses droits de suspension des services conformément à la Section 8.4, selon le cas, et le Client sera responsable des coûts raisonnables de l'audit en plus de tous les autres frais, dommages, pénalités ou recours auxquels Palantir peut avoir droit en vertu du présent Contrat et/ou de la loi applicable. Pour éviter toute ambiguïté, le lancement d'un audit par Palantir n'est pas nécessairement une condition préalable à l'exercice de ses droits de résiliation conformément à la section 8.2 ou à l'exercice de ses droits de suspension des services conformément à la section 8.4, si les conditions permettant l'exercice des droits précédents sont remplies ; la décision de Palantir de lancer un audit n'exclut pas sa capacité à exercer ses droits conformément à la section 8.2 ou à la section 8.4, si les conditions permettant l'exercice des droits précédents sont remplies.
5. Droits de propriété.
5.1 Propriété du client. Entre les Parties, le Client détient tous les droits, titres et intérêts, y compris tous les Droits de Propriété Intellectuelle, dans et sur les Données Client et toutes les modifications qui y sont apportées. Sous réserve de l'Accord, le Client accorde à Palantir un droit et une licence non exclusifs, mondiaux et libres de redevances pendant la Durée pour utiliser et traiter les Données Client uniquement pour fournir le Service et/ou les Services Professionnels, et comme peut l'exiger la loi applicable. Le Client accorde en outre à Palantir un droit et une licence mondiaux, perpétuels, irrévocables et libres de redevances pour utiliser, distribuer, divulguer, faire et incorporer dans la Plateforme Palantir toute suggestion, demande d'amélioration, recommandation ou autre retour d'information fourni par le Client ou les Utilisateurs en rapport avec la Plateforme Palantir
5.2 Propriété de Palantir. Entre les parties, Palantir détient tous les droits, titres et intérêts, y compris tous les droits de propriété intellectuelle, dans et sur la plate-forme Palantir, et toute autre documentation ou matériel connexe fourni par Palantir et tous les travaux dérivés, modifications ou améliorations de ce qui précède (y compris, sans limitation, tous les droits de propriété intellectuelle incorporés dans ce qui précède). A l'exception des droits exprès accordés ici, Palantir n'accorde aucune autre licence ou accès, qu'ils soient exprès ou implicites, ni aucun droit de propriété sur la Plateforme Palantir, les logiciels, les services ou les Droits de Propriété Intellectuelle.
5.3 Restrictions. Le client s'engage à ne pas (et à ne pas permettre à un tiers de) : (a) obtenir ou tenter d'obtenir un accès non autorisé au service ou au site web ou à l'infrastructure, ou à tout élément de ceux-ci, ou contourner ou interférer avec toute mesure d'authentification ou de sécurité du service ou du site web ; (b) interférer avec ou perturber l'intégrité ou la performance du service ou du site web ; (c) accéder ou tenter d'accéder aux données d'un autre client ; (d) avoir un impact négatif sur la capacité d'autres clients à utiliser le service ; (e) transmettre du matériel contenant des virus logiciels ou d'autres codes informatiques, fichiers, scripts, agents ou programmes nuisibles ou délétères par le biais du Service ou du Site Internet ; (f) décompiler, désassembler, scanner, faire de l'ingénierie inverse, ou tenter de découvrir tout code source ou idées ou algorithmes sous-jacents de toute Plateforme Palantir (sauf dans la mesure où la loi applicable interdit expressément une telle restriction d'ingénierie inverse, et dans ce cas, uniquement sur notification écrite préalable à Palantir) ; (g) fournir, louer, prêter, utiliser à des fins de partage de temps ou de bureau de service, ou autrement utiliser ou permettre à d'autres d'utiliser le Service au profit d'un tiers ; (h) utiliser le Service ou le Site Internet à toute fin qui n'est pas expressément autorisée par le présent Accord ; (i) lister ou autrement afficher ou copier tout code de toute Plateforme Palantir, à l'exception des échantillons dans la mesure nécessaire à l'utilisation du Service par le Client ; (j) copier toute Plateforme Palantir (ou composant de celle-ci) ou développer toute amélioration, modification ou travail dérivé de celle-ci, à l'exception des échantillons dans la mesure nécessaire à l'utilisation du Service par le Client ; (l) permettre le transfert, la transmission (y compris, sans limitation, la mise à disposition en ligne, la transmission électronique ou toute autre communication au public), l'exportation ou la réexportation de toute Plateforme Palantir (ou de toute partie de celle-ci) ou de toute donnée technique de Palantir ; (m) effectuer des tests de pénétration sur le Service, sauf autorisation de Palantir ; (n) utiliser, accéder, évaluer ou visualiser la Plate-forme Palantir dans le but de construire ou d'offrir un produit ou un service similaire ou concurrentiel à la Plate-forme Palantir ; (o) supprimer, masquer ou modifier, ou autrement violer les conditions de tout avis de droit d'auteur, marques, logos et noms commerciaux et tout autre avis (y compris les licences open source de tiers ou similaires) ou identifications qui apparaissent sur ou dans toute Plateforme Palantir et tout média associé ; (p) utiliser le site Web ou la plate-forme Palantir pour s'engager dans une fraude ou une fausse déclaration, ou la promouvoir (y compris, mais sans s'y limiter, fournir des informations frauduleuses ou trompeuses en réponse au formulaire de soumission de commande) ; ou (q) utiliser ou accéder au service dans le but de s'engager dans des activités ou des communications de spamming ou de les soutenir, ou dans des activités ou des communications de marketing en violation de la loi sur le contrôle de l'assaut de la pornographie et du marketing non sollicités (15 U.S.C. § 7701 et seq.), le Telephone Consumer Protection Act (47 U.S.C. § 227) et toutes les autres lois applicables interdisant le spam ou régissant d'une autre manière la transmission de matériel et/ou de communications de marketing. Nonobstant ce qui précède, ou toute déclaration contraire dans les présentes, le contenu de tiers peut être mis à disposition avec des avis et des licences open source ou similaires de ces communautés et tiers qui régissent l'utilisation de ces parties, et le client accepte par les présentes d'être lié par toutes ces licences et de s'y conformer pleinement ; toutefois, les dispositions d'exonération de garantie et de limitation de responsabilité du présent accord s'appliqueront à l'ensemble de ce contenu de tiers.
6. Confidentialité. Chaque partie (la "partie destinataire") garde strictement confidentielles toutes les informations confidentielles de l'autre partie (la "partie divulgatrice"), n'utilise ces informations confidentielles qu'aux fins du présent accord et ne les divulgue à aucun tiers, à l'exception des administrateurs, employés, agents, avocats, comptables, sous-traitants ou autres représentants de la partie destinataire qui sont soumis à des obligations de confidentialité au moins aussi restrictives que celles prévues dans le présent accord ("représentants autorisés"), selon le principe du "besoin de savoir". La partie destinataire doit faire preuve d'au moins le même degré de diligence que celui qu'elle utilise pour empêcher la divulgation de ses propres informations confidentielles, mais en aucun cas d'un degré de diligence inférieur à ce qui est raisonnable. La partie destinataire peut, sans violer les obligations de l'accord, divulguer des informations confidentielles dans la mesure requise par un tribunal valide ou une ordonnance gouvernementale, ou comme l'exige la loi applicable, à condition que la partie destinataire : (a) fournisse à la partie divulgatrice un préavis écrit raisonnable de cette divulgation et (b) fasse des efforts raisonnables pour limiter la divulgation et pour obtenir, ou aider la partie divulgatrice à obtenir, un traitement confidentiel ou une ordonnance de protection empêchant ou limitant la divulgation, tout en permettant à la partie divulgatrice de participer à la procédure. "Informations confidentielles" signifie (i) dans le cas de Palantir, la plate-forme Palantir (y compris toute information s'y rapportant) ; (ii) dans le cas du client, les données du client ; et (iii) toute autre information qui, par la nature de l'information divulguée ou la manière dont elle a été divulguée, serait considérée par une personne raisonnable comme étant confidentielle, dans chaque cas, sous quelque forme que ce soit (y compris, mais sans s'y limiter, électronique ou orale) et qu'elle ait été fournie avant, pendant ou après la date d'entrée en vigueur ; à condition, toutefois, que les informations confidentielles ne comprennent pas les informations qui (1) sont ou deviennent du domaine public sans que la partie destinataire ou ses représentants autorisés ne l'aient fait ou ne l'aient omis ; (2) sont connues de la partie destinataire à la date d'entrée en vigueur ou au moment de leur divulgation par la partie divulgatrice (comme le prouvent les documents écrits) sans obligation de les garder confidentielles ; (3) ont été légitimement divulguées à la partie destinataire avant la date d'entrée en vigueur par une autre source sans violation de la confidentialité par le tiers divulgateur et sans restriction de divulgation ou d'utilisation ; ou (4) la partie destinataire peut prouver par écrit que ces informations ont été développées de manière indépendante sans utilisation ou référence aux informations confidentielles. La partie destinataire est responsable de toute violation de la présente section par toute personne ou entité à laquelle la partie destinataire est autorisée à divulguer des informations confidentielles en vertu de la présente section. Les obligations de la partie destinataire en matière d'informations confidentielles survivent à la résiliation du présent accord pendant cinq (5) ans ; toutefois, les obligations de la partie destinataire en vertu des présentes survivent à la résiliation et se poursuivent à perpétuité, ou aussi longtemps que le permet la législation applicable, en ce qui concerne les informations confidentielles qui constituent un secret commercial en vertu de la législation applicable.
7. Frais et paiement ; taxes. Le service est réputé fourni dès lors que l'accès est accordé au client ou à son profit. Si des frais fixes sont indiqués dans le formulaire de commande, ces frais seront facturés et payables à l'avance, ou comme indiqué dans le formulaire de commande. Toute redevance basée sur l'utilisation prévue dans le formulaire de commande, y compris si elle est payable au-delà de l'utilisation incluse spécifiée dans le formulaire de commande, sera calculée conformément aux taux d'utilisation prévus dans le formulaire de commande (le cas échéant) et facturée et payable trimestriellement à terme échu, ou selon toute autre modalité prévue dans le formulaire de commande. Tous les paiements seront effectués par virement bancaire sur un compte désigné par Palantir dans la devise indiquée sur la facture correspondante, ou par toute autre méthode de paiement convenue par les Parties (y compris comme spécifié dans le Formulaire de Soumission de Commande) et comme indiqué sur la facture correspondante, dans les trente (30) jours suivant la date d'émission de la facture de Palantir . Tout paiement tardif sera soumis à des frais de service égaux à 1,5 % par mois du montant dû ou au montant maximum d'intérêts autorisé par la loi applicable, selon le montant le moins élevé. Sauf indication contraire dans le formulaire de soumission de commande, les honoraires s'entendent hors taxes applicables (à l'exception des taxes sur ou mesurées par le revenu net de Palantir). Le Client sera responsable de tous les impôts découlant du présent Contrat, de sorte qu'après paiement de ces impôts, le montant reçu par Palantir ne soit pas inférieur aux honoraires indiqués dans le Formulaire de Soumission de Commande. Dans le cas où un traité de double imposition s'applique, qui prévoit un taux de retenue à la source nul ou réduit, le Client accepte (a) de ne pas retenir les impôts dans le cas d'un taux de retenue à la source nul ou (b) de retenir au taux d'imposition réduit conformément au traité de double imposition.
8. Durée et résiliation ; suspension.
8.1 Durée ; résiliation pour des raisons de commodité. Sauf indication contraire dans le Formulaire de commande, le présent Accord prend effet à la Date d'entrée en vigueur et reste en vigueur à l'adresse jusqu'à ce qu'il soit résilié conformément aux dispositions des présentes (la "Durée") ; toutefois, si le Client est une personne physique accédant à l'instance du Service d'un Utilisateur principal en tant qu'Utilisateur autorisé (ou équivalent, tel qu'identifié dans le Formulaire de commande), la Durée reste en vigueur jusqu'à ce que l'accès de l'Utilisateur principal au Service arrive à expiration ou soit résilié. Nonobstant ce qui précède, si cela est spécifié autrement dans le Formulaire de Commande, "Durée" signifie la période allant de la Date d'Entrée en Vigueur jusqu'à l'expiration de la durée spécifiée dans le Formulaire de Commande. Palantir peut résilier le présent contrat pour des raisons de commodité, pour n'importe quelle raison ou sans raison, à tout moment, en fournissant au client un préavis de soixante (60) jours pour cette résiliation.
8.2 Résiliation pour motif grave. Sans limiter les autres droits de l'une ou l'autre des parties, l'une ou l'autre des parties peut résilier le présent accord pour un motif valable (a) en cas de violation substantielle par l'autre partie de l'une des dispositions du présent accord et en cas de défaut de remédier à la violation (et de fournir un avis écrit raisonnable de ce remède à la partie non violente) dans les trente (30) jours suivant la notification écrite de cette violation par la partie non violente ou (b) si l'autre partie se place sous la protection d'une procédure de faillite, de mise sous séquestre ou d'une procédure similaire ou si une telle procédure est engagée contre cette partie et n'est pas rejetée dans les quatre-vingt-dix (90) jours. Sauf lorsqu'un recours exclusif est spécifié dans le présent accord, l'exercice par l'une ou l'autre partie du droit de résiliation en vertu de la présente disposition est sans préjudice de tout autre recours dont elle peut disposer en vertu du présent accord ou de la loi. En cas de résiliation du présent accord par le client pour un motif valable conformément à la section 8.2(a) ou par Palantir en cas de non-respect par le client des exigences de conformité de Palantir, comme indiqué à la section 8.4(c) (suspension des services), Palantir fournira un remboursement au prorata de tous les frais prépayés pour les services non utilisés à la date effective de la résiliation
8.3 Effet de la résiliation. En cas de résiliation ou d'expiration du présent Accord, sauf dans les cas spécifiquement indiqués ci-dessous, tous les droits, accès et licences du Client accordés à la Plateforme Palantir cesseront immédiatement et le Client retournera ou détruira rapidement tous les Logiciels de Connexion de Données, les Matériels d'Echantillon et la Documentation, et toutes les autres Informations Confidentielles de Palantir, et, sur demande écrite, certifiera sa conformité avec ce qui précède à Palantir par écrit dans les dix (10) jours de cette demande. A la résiliation ou à l'expiration du présent Accord, si le Client en fait la demande, le Client aura, sous réserve des conditions du présent Accord, accès au Service pendant trente (30) jours dans le seul but de récupérer les Données du Client. Palantir supprimera ensuite toutes les données du client. Nonobstant ce qui précède, Palantir conservera, sous réserve des autres conditions du présent Accord, et uniquement à des fins de sécurité, les informations d'utilisation et les métadonnées liées à la sécurité du Service, à l'exclusion des Données Client (à l'exception des informations liées à la sécurité telles que les adresses IP, les noms d'utilisateur, les tentatives de connexion et les requêtes de recherche), pendant une période de deux (2) ans à compter du dernier événement enregistré. La résiliation ou l'expiration du présent accord ne limite ni n'affecte les droits ou obligations acquis avant la date effective de résiliation ou d'expiration (y compris, mais sans s'y limiter, les obligations de paiement). Les articles 1, 4 (à l'exclusion de l'article 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14 et 15 survivront à toute résiliation ou expiration du présent accord.
8.4 Suspension des services. Si Palantir détermine raisonnablement que : (a) Vous n'avez pas l'autorisation de lier le Client à cet Accord au nom du Client (en violation de la déclaration et de la garantie expresses dans le préambule de cet Accord) ; (b) L'utilisation par le Client du Service, de la Plateforme Palantir, ou du Site Web viole la loi applicable ou viole autrement une condition matérielle de cet Accord (y compris la Section 3.2 (Protection des données), la Section 4 (Utilisation acceptable), la Section 5.3 (Restrictions), Section 6 (Confidentialité), et Section 7 (Frais et Paiement)) ; (c) le Client ne satisfait pas aux Exigences de Conformité de Palantir ; ou (d) le Client a violé l'une des garanties énoncées dans la Section 11, Palantir se réserve le droit de désactiver, suspendre, ou résilier l'accès du Client à tout ou partie du Site Web et/ou de la Plateforme Palantir
9. Indemnisation.
9.1 Indemnisation de Palantir. Palantir défendra le client contre toute réclamation de contrefaçon ou de violation de tout droit de propriété intellectuelle déposée contre le client par un tiers sur la base de l'utilisation par le client de la plate-forme Palantir conformément aux conditions du présent accord et indemnisera et dégagera le client des coûts raisonnables, des honoraires d'avocat et des dommages, le cas échéant, finalement accordés contre le client conformément à une ordonnance non susceptible d'appel rendue par un tribunal de la juridiction compétente dans le cadre d'une telle réclamation ou d'un accord de règlement conclu par Palantir. Si l'utilisation par le Client de l'une quelconque des Plateformes Palantir est, ou de l'avis de Palantir est susceptible d'être, interdite par un tribunal compétent en raison du type de contrefaçon spécifié ci-dessus, ou si cela est requis par un règlement approuvé par Palantir par écrit, Palantir peut, à sa seule discrétion : (a) substituer des produits ou services substantiellement similaires sur le plan fonctionnel ; (b) procurer au Client le droit de continuer à utiliser la Plateforme Palantir ; ou (c) si Palantir détermine raisonnablement que les options (a) et (b) sont commercialement irréalisables, résilier le présent Contrat et rembourser au Client une partie proportionnelle des frais payés en vertu des présentes pour la Plateforme Palantir résiliée, qui reflète la partie restante de la Durée en cours au moment de la résiliation. Les obligations d'indemnisation précédentes de Palantir ne s'appliquent pas : (i) si la Plateforme Palantir est modifiée par ou à la demande du Client ou des Utilisateurs, mais seulement dans la mesure où la violation alléguée n'aurait pas eu lieu sans cette modification ; (ii) si la Plateforme Palantir est combinée avec des produits non Palantir non autorisés par Palantir, mais seulement dans la mesure où la violation alléguée n'aurait pas eu lieu sans cette combinaison ; (iii) à toute utilisation non autorisée de la Plateforme Palantir, toute utilisation qui n'est pas conforme à la Documentation, toute utilisation qui viole la Section 4 (Utilisation acceptable), ou l'utilisation pendant toute période de suspension (comme indiqué dans la Section 8.4) ; (iv) à toute donnée client ; ou (v) à tout produit ou service non Palantir
9.2 Indemnisation du Client. Le client défendra Palantir contre toute réclamation d'un tiers contre Palantir découlant de ou liée à (a) la violation par le client de la loi applicable, (b) les données du client, (c) la violation par le client du DPA, (d) la violation par le client de la section 4 (utilisation acceptable), (e) la violation par le client de la section 5.3 (Restrictions), ou (f) tout produit ou service offert par le Client (sauf si cette réclamation est attribuable au Service tel qu'il est offert par Palantir) et indemniser et dégager Palantir de toute responsabilité concernant les coûts, frais d'avocats et dommages, le cas échéant, émis par une autorité compétente ou définitivement accordés en vertu d'une ordonnance non susceptible d'appel.
9.3 Procédure d'indemnisation. Les obligations de la partie indemnisante sont conditionnées par le fait que la partie indemnisée fournisse à la partie indemnisante : (a) une notification écrite rapide (ne dépassant en aucun cas vingt (20) jours) de toute réclamation, poursuite ou demande dont elle a connaissance ; (b) le droit d'assumer la défense et le contrôle exclusifs de toute question faisant l'objet d'une indemnisation (à condition que la partie indemnisante ne règle aucune réclamation à moins qu'elle ne libère inconditionnellement la partie indemnisée de toute responsabilité et qu'elle ne reconnaisse pas de faute ou d'acte répréhensible de la part de la partie indemnisée) ; et (c) la coopération avec toute demande raisonnable d'aide à la défense et au règlement de la partie indemnisante (aux frais de la partie indemnisante). La présente section énonce la seule responsabilité et obligation de chaque partie et le seul et unique recours en ce qui concerne toute réclamation pour violation des droits de propriété intellectuelle.
10.1 Garantie de Palantir. Palantir garantit que pendant la Durée (a) le Service sera fourni substantiellement en conformité avec la Documentation applicable et (b) les Services Professionnels seront fournis de manière professionnelle et selon les règles de l'art. En cas de violation d'une des garanties ci-dessus, le client peut notifier par écrit à Palantir la résiliation du présent contrat, qui prendra effet trente (30) jours après réception de la notification par Palantir, à moins que Palantir ne soit en mesure de remédier à la violation avant la date effective de la résiliation. Cette garantie ne s'appliquera pas dans la mesure où cette violation est causée par les Données du Client ou par une mauvaise utilisation ou une modification non autorisée du Service (y compris, mais sans s'y limiter, la violation par le Client de la Section 4 (Utilisation acceptable de )) ou de tout matériel sélectionné par le Client et utilisé en relation avec le Service. En cas de résiliation du présent Accord suite à l'exercice par le Client de son droit en vertu de la présente Section, le Client aura le droit de recevoir de Palantir, comme seul et unique recours, un remboursement d'une partie proportionnelle des frais payés en vertu du présent Accord qui reflète la partie restante de la Durée active au moment de la résiliation.
10.2 Clause de non-responsabilité. AUCUN MONTANT PAYÉ AU TITRE DES PRÉSENTES N'EST REMBOURSABLE OU COMPENSABLE, SAUF INDICATION CONTRAIRE EXPLICITE DANS LES PRÉSENTES. SAUF INDICATION EXPRESSE DANS LES PRESENTES, ET UNIQUEMENT DANS LA MESURE MAXIMALE AUTORISEE PAR LA LOI APPLICABLE, LA PLATEFORME PALANTIR ET LES SERVICES PROFESSIONNELS SONT FOURNIS EN L'ETAT, SANS AUTRE GARANTIE, ET PALANTIR ET SES FOURNISSEURS ET PRESTATAIRES DE SERVICES EXCLUENT PAR LES PRESENTES TOUTE GARANTIE. SANS AUCUNE AUTRE GARANTIE D'AUCUNE SORTE ET PALANTIR ET SES FOURNISSEURS ET PRESTATAIRES DE SERVICES REJETTENT PAR LA PRÉSENTE TOUTE GARANTIE DE QUELQUE NATURE QUE CE SOIT, EXPRESSE OU IMPLICITE, ORALE OU ÉCRITE, RELATIVE À LA PLATEFORME PALANTIR ET AUX SERVICES PROFESSIONNELS FOURNIS DANS LE CADRE DES PRÉSENTES OU AUTREMENT, Y COMPRIS, MAIS SANS S'Y LIMITER, TOUTE GARANTIE DE NON-CONTREFAÇON, DE QUALITÉ MARCHANDE, DE TITRE OU D'ADÉQUATION À UN USAGE PARTICULIER. SANS LIMITER LA LIMITATION PRÉCÉDENTE, PALANTIR NE GARANTIT PAS QUE LA PLATEFORME PALANTIR ET LES SERVICES PROFESSIONNELS RÉPONDRONT AUX EXIGENCES DU CLIENT OU GARANTISSENT DES RÉSULTATS, DES ISSUES OU DES CONCLUSIONS OU QUE LE FONCTIONNEMENT DU SERVICE SERA ININTERROMPU OU EXEMPT D'ERREURS. PALANTIR N'EST PAS RESPONSABLE DES SERVICES DE TIERS (Y COMPRIS, MAIS SANS S'Y LIMITER, LES GARANTIES DE TEMPS DE FONCTIONNEMENT, LES PANNES OU LES DÉFAILLANCES), DES DONNÉES DES CLIENTS OU DU CONTENU DE TIERS. PALANTIR NE CONTRÔLE PAS LE TRANSFERT D'INFORMATIONS OU DE DONNÉES DU CLIENT SUR LES MOYENS DE COMMUNICATION, L'INTERNET OU LES SERVICES DE TIERS, ET LE SERVICE PEUT ÊTRE SUJET À DES RETARDS ET AUTRES PROBLÈMES INHÉRENTS À L'UTILISATION DE CES MOYENS DE COMMUNICATION. PALANTIR N'EST PAS RESPONSABLE DES RETARDS, DÉFAILLANCES OU AUTRES DOMMAGES RÉSULTANT DE CES PROBLÈMES.
11. Garantie du Client. Le Client garantit que (a) le Client a fourni toutes les notifications nécessaires et obtenu tous les consentements, autorisations, approbations, et/ou accords requis par les lois ou politiques applicables, et a informé Palantir de toutes les obligations applicables au traitement des Données Client par Palantir, afin de permettre à Palantir de traiter les Données Client, y compris les données personnelles, selon la portée, l'objectif et les instructions spécifiées par le Client et que le Client ne dirigera pas le traitement des Données Client par Palantir en violation de toute loi ou réglementation (y compris les exigences de localisation) ou les droits des tiers ; (b) il n'utilisera pas le Service à des fins non autorisées ou illégales ; et (c) il ne téléchargera pas ou n'importera pas de Données Client vers le Service nécessitant une documentation supplémentaire sans avoir au préalable exécuté cette documentation. Toutes les données du client qu'il intègre, utilise ou met à disposition dans le cadre de l'utilisation du service, ainsi que les conclusions qui en sont tirées, le sont à ses propres risques et il est seul responsable des dommages ou des pertes qui en résultent pour toute partie.
12. Limitations de responsabilité. DANS TOUTE LA MESURE PERMISE PAR LA LOI APPLICABLE, ET NONOBSTANT TOUTE AUTRE DISPOSITION DU PRÉSENT ACCORD, AUCUNE DES PARTIES NE SERA RESPONSABLE ENVERS L'AUTRE PARTIE OU SES AFFILIÉS (A) DU COÛT DE L'APPROVISIONNEMENT EN PRODUITS OU SERVICES DE SUBSTITUTION, OU DU COÛT DU REMPLACEMENT OU DE LA RESTAURATION DES DONNÉES DES CLIENTS, (B) DES PERTES ÉCONOMIQUES, DES PROFITS ATTENDUS OU PERDUS, DES REVENUS OU DES ÉCONOMIES ANTICIPÉES, LA PERTE D'ACTIVITÉ, LA PERTE DE CONTRATS, LA PERTE OU L'ATTEINTE AU FONDS DE COMMERCE OU À LA RÉPUTATION, ET/OU (C) LES PERTES OU DOMMAGES INDIRECTS, SPÉCIAUX, ACCESSOIRES, PUNITIFS OU CONSÉCUTIFS, QU'ILS RÉSULTENT DE L'EXÉCUTION OU DE LA VIOLATION DU PRÉSENT ACCORD OU DE L'UTILISATION OU DE L'INCAPACITÉ À UTILISER LA PLATE-FORME PALANTIR, MÊME SI LA PARTIE A ÉTÉ INFORMÉE DE LA POSSIBILITÉ DE CES PERTES OU DOMMAGES. A L'EXCEPTION DES OBLIGATIONS DES PARTIES EXPOSEES DANS LES SECTIONS 5 ET 9.2 DU PRÉSENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRÉSENTES, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIÉTÉS AFFILIÉES ENVERS L'AUTRE PARTIE ET SES SOCIÉTÉS AFFILIÉES POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DOIT PAS DÉPASSER LE PLUS ÉLEVÉ DES MONTANTS SUIVANTS : A) LES FRAIS PAYÉS OU PAYABLES À PALANTIR PAR LE CLIENT EN VERTU DE L'ACCORD DANS LES DOUZE (12) MOIS PRÉCÉDANT LA RÉCLAMATION POUR LE SERVICE OU LES SERVICES PROFESSIONNELS QUI ONT DONNÉ LIEU À CETTE RÉCLAMATION OU B) CENT MILLE DOLLARS (100 000 USD), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT . NONOBSTANT LA PHRASE PRÉCÉDENTE, SI AUCUNE REDEVANCE N'EST DUE PAR LE CLIENT PENDANT LA DURÉE DU CONTRAT, À L'EXCEPTION DES OBLIGATIONS DES PARTIES ÉNONCÉES AUX ARTICLES 5 ET 9.2 DU PRÉSENT CONTRAT ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DU PRÉSENT CONTRAT, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIÉTÉS AFFILIÉES ENVERS L'AUTRE PARTIE ET SES SOCIÉTÉS AFFILIÉES POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DÉPASSERA PAS CINQUANTE MILLE DOLLARS (50 000 DOLLARS AMÉRICAINS), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT. LES LIMITATIONS ÉNONCÉES DANS LA PRÉSENTE SECTION 12 S'APPLIQUENT INDÉPENDAMMENT DU FAIT QU'UNE ACTION SOIT FONDÉE SUR UN CONTRAT, UN DÉLIT CIVIL (Y COMPRIS LA NÉGLIGENCE), UNE RESPONSABILITÉ STRICTE OU TOUTE AUTRE THÉORIE JURIDIQUE OU ÉQUITABLE.
13. RÈGLEMENT DES LITIGES. TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DU PRÉSENT ACCORD OU S'Y RAPPORTANT, Y COMPRIS L'ARBITRABILITÉ, QUI NE PEUT ÊTRE RÉSOLU À LA SUITE DE DISCUSSIONS DE BONNE FOI DANS LES SOIXANTE (60) JOURS SUIVANT LA NOTIFICATION D'UN LITIGE, EST DÉFINITIVEMENT RÉGLÉ PAR VOIE D'ARBITRAGE. LE DROIT APPLICABLE EST LE DROIT MATÉRIEL DE L'ÉTAT DE NEW YORK, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET L'ARBITRAGE EST ADMINISTRÉ À NEW YORK, NEW YORK, ÉTATS-UNIS, CONFORMÉMENT AUX RÈGLES ET PROCÉDURES D'ARBITRAGE GLOBALES DE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. ("JAMS") ET AUX RÈGLES FÉDÉRALES DE PREUVE (NONOBSTANT LA RÈGLE 22(D) DE JAMS OU TOUTE AUTRE RÈGLE DE JAMS CONTRAIRE). LES PARTIES CONVIENNENT DE SE METTRE EN ARBITRAGE UNIQUEMENT SUR UNE BASE INDIVIDUELLE, ET LE PRÉSENT ACCORD N'AUTORISE PAS L'ARBITRAGE COLLECTIF NI AUCUNE RÉCLAMATION PRÉSENTÉE EN TANT QUE DEMANDEUR OU MEMBRE D'UN GROUPE DANS LE CADRE D'UNE PROCÉDURE D'ARBITRAGE COLLECTIVE, REPRÉSENTATIVE, PAGA, CONJOINTE OU REPRÉSENTATIVE. LE TRIBUNAL ARBITRAL NE PEUT CONSOLIDER LES DEMANDES DE PLUS D'UNE PERSONNE ET NE PEUT PRÉSIDER AUCUNE FORME DE PROCÉDURE REPRÉSENTATIVE OU COLLECTIVE. NONOBSTANT CE QUI PRÉCÈDE, CHAQUE PARTIE A LE DROIT D'INTENTER UNE ACTION À TOUT MOMENT DEVANT UN TRIBUNAL COMPÉTENT EN VUE D'OBTENIR UNE INJONCTION PRÉLIMINAIRE DANS L'ATTENTE D'UNE DÉCISION FINALE DE L'ARBITRE OU DES ARBITRES, À CONDITION QUE (A) LA PARTIE QUI INTENTE L'ACTION DEMANDE UNE ORDONNANCE POUR DÉPOSER L'ACTION SOUS SCELLÉS (OU AU MOINS LE FAIRE POUR TOUT DÉPÔT CONTENANT DES INFORMATIONS CONFIDENTIELLES OU DES SECRETS COMMERCIAUX) AFIN DE LIMITER LA DIVULGATION CONFORMÉMENT À LA SECTION 6 DU PRÉSENT ACCORD ; ET (B) UNE INJONCTION PERMANENTE ET DES DOMMAGES-INTÉRÊTS NE PEUVENT ÊTRE ACCORDÉS QUE PAR L'ARBITRE OU LES ARBITRES.
14.1 Mises à jour de cet accord. Palantir se réserve le droit de modifier le présent Accord à tout moment et mettra à jour le présent Accord en cas de modification. Palantir notifiera au Client les modifications a posteriori du présent Contrat en publiant un avis sur le Site Internet et/ou en envoyant un courrier électronique à l'adresse électronique principale spécifiée dans un Formulaire de Soumission de Commande applicable ou sur le Compte du Client. Tout amendement au présent Accord prendra effet trente (30) jours après que Palantir ait fourni cet avis. L'utilisation continue par le Client de la Plateforme Palantir dans les trente (30) jours après que Palantir ait fourni l'avis susmentionné constitue l'acceptation de ces révisions du présent Accord. Pour toute autre modification, la poursuite de l'utilisation de la Plateforme Palantir par le Client constitue un accord avec nos révisions du présent Accord. Palantir se réserve le droit à tout moment et de temps en temps de modifier (y compris la dépréciation de la fonctionnalité ou des outils), temporairement ou définitivement, la Plateforme Palantir (ou toute partie de celle-ci)
15. Divers. Palantir fournira le Service et les Services Professionnels conformément aux lois et réglementations applicables à la fourniture par Palantir de ce Service et des Services Professionnels en général, y compris, mais sans s'y limiter, en ce qui concerne la protection des données et les transferts internationaux de données personnelles , sans tenir compte de l'utilisation spécifique du Service par le Client, sauf dans la mesure indiquée dans le Formulaire de Soumission de Commande, et sous réserve du respect par le Client du présent Accord. Les parties doivent se conformer à l'addendum AIP de Palantir disponible à l'adresse https://palantir.pactsafe.io/aip-legal-3791.html, qui est incorporé par référence dans les présentes. Sauf accord écrit préalable de Palantir, ni le présent Accord ni l'accès ou les licences accordés en vertu des présentes ne peuvent être cédés, transférés ou concédés en sous-licence par le Client, y compris, sans limitation, dans le cadre d'un changement de contrôle du Client ou de la vente de la totalité ou de la quasi-totalité des actifs du Client ; toute tentative en ce sens sera nulle et non avenue. Palantir peut céder ou déléguer le présent accord, en totalité ou en partie, à toute personne ou entité à tout moment, avec ou sans le consentement du Client. Palantir peut résilier le présent contrat en cas de changement de contrôle du client ou de vente de la totalité ou de la quasi-totalité des actifs du client. Palantir peut sous-traiter le présent contrat ou des parties de celui-ci. Toute notification requise ou autorisée en vertu des présentes doit être adressée par écrit au Client à l'adresse (aux adresses) indiquée(s) dans le Formulaire de soumission de commande et, si elles sont envoyées par courrier électronique, les notifications à Palantir doivent être envoyées àlegalnotices@palantir.com ou 1200 17th Street Floor 15 Denver, CO 80202 (ATTN : Legal). Si une disposition du présent accord est jugée inapplicable ou invalide par une cour ou un tribunal de la juridiction compétente, cette disposition sera limitée ou éliminée dans la mesure minimale nécessaire pour que le présent accord reste pleinement en vigueur et soit applicable. Aucune renonciation à une violation ne sera considérée comme une renonciation à une violation ultérieure. Le service et les services professionnels sont soumis au contrôle des lois et réglementations américaines en matière d'exportation et de sanctions, y compris les réglementations américaines en matière d'administration des exportations ("EAR") administrées par le Bureau de l'industrie et de la sécurité ("BIS") du ministère du commerce et les réglementations en matière d'embargos et de sanctions administrées par l'Office of Foreign Assets Control ("OFAC") du ministère des finances des États-Unis. Le service est contrôlé en vertu de l'article 5D002.c.1, ENC. Le client doit s'assurer que toutes les exportations, réexportations, transferts, utilisations finales et utilisateurs du service sont conformes aux lois et réglementations en matière d'exportation et de sanctions des États-Unis et d'autres juridictions applicables, y compris, mais sans s'y limiter, celles du Bureau américain de l'industrie et de la sécurité et de l'Office of Foreign Assets Control (OFAC). Le Client déclare qu'il n'est pas soumis à des restrictions en vertu de listes d'utilisateurs finaux restreints du gouvernement américain, et qu'il n'est pas détenu ou contrôlé à 50% ou plus, directement ou indirectement, par des individus ou des entités identifiés sur de telles listes. Le Client notifiera immédiatement Palantir si le Client devient sujet à de telles restrictions. Le Client s'abstiendra de prendre des mesures qui amèneraient Palantir à violer les lois et réglementations applicables en matière d'exportation et de sanctions. A l'exception de l'obligation de payer de l'argent, aucune des parties ne sera responsable d'une défaillance ou d'un retard dans le cadre du présent accord en raison d'une cause échappant à son contrôle raisonnable, y compris, sans limitation, les actes de guerre, les catastrophes naturelles, les tremblements de terre, les inondations, les embargos, les émeutes, les sabotages, les pénuries ou les conflits de travail, les actes gouvernementaux ou les défaillances d'Internet, des télécommunications ou du fournisseur de services d'hébergement, les attaques informatiques ou les actes malveillants ; à condition que la partie retardée : (a) donne à l'autre partie une notification rapide de cette cause ; et (b) fasse des efforts commercialement raisonnables pour corriger rapidement cette défaillance ou ce retard d'exécution. Palantir a le droit de suspendre immédiatement l'accès au Service : (a) si le Client est en violation matérielle du présent Accord ; (b) pour prévenir un incident de sécurité ayant un impact sur le Client, le Contenu du Client, ou le Service ; ou (c) si la poursuite de l'accès violait les lois applicables ou si cela était requis en vertu de la loi ou de la réglementation applicable ou de demandes ou d'ordonnances d'autorités gouvernementales, réglementaires ou judiciaires. Il n'y a pas de tiers bénéficiaires dans le cadre du présent accord, que ce soit de manière expresse ou implicite. Pour éviter toute ambiguïté, aucune disposition du présent accord ne doit être interprétée comme créant une relation de coentreprise, d'emploi, de partenariat, d'alliance stratégique, d'alliance formelle ou de partenariat stratégique entre les parties. Le présent accord constitue la déclaration complète et exclusive de l'accord mutuel des parties et remplace et annule tous les accords et communications écrits et oraux antérieurs relatifs à l'objet du présent accord. En cas de conflit entre les présentes conditions de service et tout formulaire de soumission de commande ou toute annexe, les conditions de ce formulaire de soumission de commande ou de cette annexe prévaudront. Palantir n'est en aucun cas affilié à, ou approuvé ou sponsorisé par, The Saul Zaentz Company d.b.a. Tolkien Enterprises ou la succession de J.R.R. Tolkien.
ADDENDUM SPÉCIFIQUE AU PAYS
Pour les clients situés dans l'un des pays identifiés dans le présent addendum spécifique au pays (l'"addendum") et pour lesquels les conditions de service de Palantir ("conditions de service") ne seront pas régies par la loi de New York (par exemple, parce que la disposition relative au choix de la loi dans la section 13 des conditions de service sera inefficace en vertu de la loi applicable), les dispositions spécifiques au pays ci-dessous remplaceront ou compléteront les dispositions équivalentes dans les conditions de service, comme indiqué. Les termes en majuscules utilisés dans le présent addendum et qui n'y sont pas définis ont la même signification que celle qui leur est donnée dans les conditions de service.
FRANCE
1. Conditions en langue locale. Une copie des présentes conditions de service traduites en français est disponible à l'adresse suivante: https://palantir.pactsafe.io/aip-now-6493.html#fra-aip-now-tos-052325 (les "conditions françaises"). Pour éviter toute ambiguïté, en cas de conflit ou d'incohérence entre les conditions françaises susmentionnées et la version anglaise des conditions de service (disponible à https://palantir.pactsafe.io/aip-now-6493.html#aip-now-tos-899513, c'est la version française qui prévaut. Une copie de la DPA traduite en français est disponible à l'adresse suivante : https://palantir.pactsafe.io/aip-now-6493.html#fra-aip-now-dpa-252305 (la "DPA française"). Pour éviter toute ambiguïté, en cas de conflit ou d'incohérence entre le DPA français susmentionné et la version anglaise du DPA, c'est la version anglaise du DPA qui prévaut.
2. Résiliation pour des raisons de commodité. La dernière phrase de la section 8.1 est supprimée dans son intégralité et remplacée par ce qui suit :
"L'une ou l'autre des parties peut résilier le présent accord pour des raisons de commodité, pour n'importe quelle raison ou sans raison, à tout moment, en fournissant à l'autre partie un préavis écrit de cette résiliation ; pour que le droit de résiliation susmentionné soit effectif, si la partie qui résilie est le client, le client doit fournir un préavis écrit de quatorze (14) jours, et si la partie qui résilie est Palantir, Palantir doit fournir un préavis écrit de soixante (60) jours".
3. Limitations de responsabilité. L'article 12 des conditions de service est supprimé dans son intégralité et remplacé par le texte suivant :
"12.Limitations de responsabilité. DANS TOUTE LA MESURE PERMISE PAR LA LOI APPLICABLE, A L'EXCEPTION DES GARANTIES LEGALES ACCORDEES AUX CONSOMMATEURS EN VERTU DE LA APPLICABLELOI FRANCAISE , ET NONOBSTANT TOUTE AUTRE DISPOSITION DU PRESENT ACCORD, AUCUNE PARTIE NE SERA RESPONSABLE ENVERS L'AUTRE PARTIE OU SES SOCIETES AFFILIEES POUR (A) LE COUT D'ACQUISITION DE PRODUITS OU SERVICES DE SUBSTITUTION, OU LE COUT DE REMPLACEMENT OU DE RESTAURATION DES DONNEES DU CLIENT, (B) LES PERTES ECONOMIQUES, PERTES DE PROFITS, DE REVENUS OU D'ÉCONOMIES ANTICIPÉES, PERTES D'AFFAIRES, PERTES DE CONTRATS, PERTES OU DOMMAGES À LA CLIENTÈLE OU À LA RÉPUTATION, ET/OU (C) PERTES OU DOMMAGES INDIRECTS, SPÉCIAUX, ACCESSOIRES, PUNITIFS OU CONSÉCUTIFS, QU'ILS RÉSULTENT DE L'EXÉCUTION OU DE LA VIOLATION DU PRÉSENT ACCORD OU DE L'UTILISATION OU DE L'INCAPACITÉ À UTILISER LA PLATE-FORME PALANTIR, MÊME SI LA PARTIE A ÉTÉ INFORMÉE DE LA POSSIBILITÉ DE CES PERTES OU DOMMAGES. A L'EXCEPTION DES DROITS DE GARANTIE STATUTAIRE ACCORDES AUX CONSOMMATEURS EN VERTU DE LA LOI FRANCAISE APPLICABLE, ET A L'EXCEPTION DES OBLIGATIONS DES PARTIES STIPULEES DANS LES SECTIONS 5 ET 9.2 DU PRÉSENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRÉSENTES, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES AFFILIÉS ENVERS L'AUTRE PARTIE ET SES AFFILIÉS POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DÉPASSERA PAS LE PLUS ÉLEVÉ DES MONTANTS SUIVANTS : A) LES FRAIS PAYÉS OU PAYABLES À PALANTIR PAR LE CLIENT EN VERTU DE L'ACCORD DANS LES DOUZE (12) MOIS PRÉCÉDANT LA RÉCLAMATION POUR LE SERVICE OU LES SERVICES PROFESSIONNELS QUI ONT DONNÉ LIEU À CETTE RÉCLAMATION OU B) CENT MILLE DOLLARS (USD 100 000), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT. NONOBSTANT LA PHRASE PRÉCÉDENTE, SI AUCUNE REDEVANCE N'EST DUE PAR LE CLIENT PENDANT LA DURÉE DU CONTRAT, À L'EXCEPTION DE TOUT DROIT DE GARANTIE LÉGALE ACCORDÉ AUX CONSOMMATEURS EN VERTU DE LA LOI FRANÇAISE APPLICABLE, À ETL'EXCEPTION DES OBLIGATIONS DES PARTIES ÉNONCÉES AUX ARTICLES 5 ET 9.2 DU PRESENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRESENTES, LA MESURE MAXIMALE AUTORISEE PAR LA LOI APPLICABLE , CHAQUE PARTIE ACCEPTE QUE LA RESPONSABILITE GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIETES AFFILIEES ENVERS L'AUTRE PARTIE ET SES SOCIETES AFFILIEES POUR TOUTE RECLAMATION DE QUELQUE NATURE QUE CE SOIT N'EXCEDE PAS CINQUANTE MILLE DOLLARS (USD 50 000), ET QUE CE RECOURS EST JUSTE ET ADEQUAT. LES LIMITATIONS ÉNONCÉES DANS LA PRÉSENTE SECTION 12 S'APPLIQUENT INDÉPENDAMMENT DU FAIT QU'UNE ACTION SOIT FONDÉE SUR UN CONTRAT, UN DÉLIT CIVIL (Y COMPRIS LA NÉGLIGENCE), UNE RESPONSABILITÉ STRICTE OU TOUTE AUTRE THÉORIE JURIDIQUE OU ÉQUITABLE".
4. Règlement des litiges. L'article 13 des conditions de service est supprimé dans son intégralité et remplacé par le texte suivant :
"13.RÈGLEMENT DES LITIGES. TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DU PRÉSENT ACCORD OU S'Y RAPPORTANT, Y COMPRIS L'ARBITRABILITÉ, QUI NE PEUT ÊTRE RÉSOLU À LA SUITE DE DISCUSSIONS DE BONNE FOI DANS LES SOIXANTE (60) JOURS SUIVANT LA NOTIFICATION D'UN LITIGE, SERA DÉFINITIVEMENT RÉGLÉ PAR VOIE D'ARBITRAGE. LE DROIT APPLICABLE EST LE DROIT MATÉRIEL DE L'ÉTAT DE NEW YORK, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET L'ARBITRAGE EST ADMINISTRÉ À NEW YORK, NEW YORK, ÉTATS-UNIS, CONFORMÉMENT AUX RÈGLES ET PROCÉDURES D'ARBITRAGE GLOBALES DU JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. ("JAMS") ET AUX RÈGLES FÉDÉRALES DE LA PREUVE (NONOBSTANT LA RÈGLE 22(D) DE JAMS OU TOUTE AUTRE RÈGLE DE JAMS CONTRAIRE). LES PARTIES CONVIENNENT DE RECOURIR À L'ARBITRAGE UNIQUEMENT SUR UNE BASE INDIVIDUELLE, ET LE PRÉSENT ACCORD N'AUTORISE PAS L'ARBITRAGE COLLECTIF NI AUCUNE RÉCLAMATION PRÉSENTÉE EN TANT QUE DEMANDEUR OU MEMBRE D'UN GROUPE DANS LE CADRE D'UNE PROCÉDURE D'ARBITRAGE COLLECTIVE, REPRÉSENTATIVE, PAGA, CONJOINTE OU REPRÉSENTATIVE. LE TRIBUNAL ARBITRAL NE PEUT PAS CONSOLIDER LES DEMANDES DE PLUS D'UNE PERSONNE ET NE PEUT PRÉSIDER AUCUNE FORME DE PROCÉDURE REPRÉSENTATIVE OU COLLECTIVE. NONOBSTANT CE QUI PRÉCÈDE, CHAQUE PARTIE A LE DROIT D'INTENTER UNE ACTION À TOUT MOMENT DEVANT UN TRIBUNAL COMPÉTENT POUR OBTENIR UNE INJONCTION PRÉLIMINAIRE DANS L'ATTENTE D'UNE DÉCISION FINALE DE L'ARBITRE OU DES ARBITRES, À CONDITION QUE (A) LA PARTIE QUI INTENTE L'ACTION DEMANDE UNE ORDONNANCE POUR DÉPOSER L'ACTION SOUS SCELLÉS (OU AU MOINS LE FAIRE POUR TOUT DÉPÔT CONTENANT DES INFORMATIONS CONFIDENTIELLES OU DES SECRETS COMMERCIAUX) AFIN DE LIMITER LA DIVULGATION COMME PRÉVU À LA SECTION 6 DU PRÉSENT ACCORD ; ET (B) UNE INJONCTION PERMANENTE ET DES DOMMAGES-INTÉRÊTS NE SERONT ACCORDÉS QUE PAR L'ARBITRE OU LES ARBITRES. SI LE CLIENT EST SITUÉ EN FRANCE, LE DROIT APPLICABLE SERA LE DROIT MATÉRIEL DE LA FRANCE, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET SANS TENIR COMPTE DE LA CONVENTION DES NATIONS UNIES SUR LES CONTRATS DE VENTE INTERNATIONALE DE MARCHANDISES, ET TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DE OU EN RAPPORT AVEC LE PRÉSENT ACCORD, Y COMPRIS LA VALIDITÉ, L'INVALIDITÉ, LA VIOLATION OU LA RÉSILIATION DE CELUI-CI, SERA, À LA DISCRÉTION DU CLIENT, RÉGLÉ PAR DES PROCÉDURES JUDICIAIRES AU DOMICILE DU CLIENT OU À SON LIEU DE RÉSIDENCE HABITUEL, AVEC DES PROCÉDURES MENÉES EN ANGLAIS."
5. Mises à jour de l'accord. La section 14.1 des conditions de service est supprimée dans son intégralité et remplacée par ce qui suit :
"14.1. Mises à jour de cet Accord. Palantir se réserve le droit de modifier le présent Accord à tout moment et mettra à jour le présent Accord en cas de modification. Palantir notifiera au Client les modifications apportées au présent Accord en envoyant un e-mail à l'adresse e-mail principale spécifiée dans un Formulaire de Soumission de Commande applicable ou sur le Compte du Client. Toute modification du présent Contrat entrera en vigueur soixante (60) jours après que Palantir ait fourni cette notification, à moins que le Client ne notifie à Palantir la résiliation du Contrat. Dans ce cas, la résiliation prendra effet soixante (60) jours après la notification de Palantir au Client. L'utilisation continue par le Client de la Plateforme Palantir dans les soixante (60) jours après que Palantir ait fourni l'avis susmentionné constitue un accord sur ces révisions du présent Accord. Pour toute autre modification, l'utilisation continue par le Client de la Plateforme Palantir constitue un accord avec nos révisions du présent Accord. Palantir se réserve le droit à tout moment et de temps en temps de modifier (y compris la dépréciation des fonctionnalités ou des outils), temporairement ou définitivement, la Palantir Plateforme (ou toute partie de celle-ci)".
Effective May 23rd 2025 to May 23rd 2025
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
EN SÉLECTIONNANT "I ACCEPT" (OU L'ÉQUIVALENT) LORSQU'UNE TELLE OPTION EST DISPONIBLE, OU EN INSTALLANT, EXÉCUTANT, TÉLÉCHARGEANT, ACCÉDANT OU UTILISANT DE TOUTE AUTRE MANIÈRE TOUTE PARTIE DE LA PLATEFORME PALANTIR (TELLE QUE DÉFINIE CI-DESSOUS), VOUS CONFIRMEZ QUE VOUS ("VOUS" OU "VOTRE" OU "UTILISATEUR AUTORISÉ") AVEZ LU LE PRÉSENT ACCORD (TEL QUE DÉFINI CI-DESSOUS), QUE VOUS COMPRENEZ LES TERMES DE L'ACCORD, ET QUE VOUS ET (LE CAS ÉCHÉANT) L'ENTITÉ QUE VOUS REPRÉSENTEZ CONSENTEZ INCONDITIONNELLEMENT À ÊTRE LIÉS PAR ET DEVENEZ PARTIE À CET ACCORD, QUI, POUR ÉVITER TOUT DOUTE, CONTIENT LA SECTION 13 CONCERNANT L'ARBITRAGE OBLIGATOIRE ET CONTRAIGNANT DES LITIGES, LA SECTION 4 CONCERNANT L'UTILISATION ACCEPTABLE, ET LA SECTION 9.2 CONCERNANT LES INDEMNITÉS DU CLIENT. SI VOUS CONCLUEZ LE PRÉSENT ACCORD AU NOM D'UNE ENTITÉ, TELLE QUE LA SOCIÉTÉ, L'ORGANISATION OU L'ÉTABLISSEMENT D'ENSEIGNEMENT POUR LEQUEL VOUS TRAVAILLEZ, VOUS DÉCLAREZ ET GARANTISSEZ QUE VOUS ÊTES AUTORISÉ À ACCEPTER LES CONDITIONS DU PRÉSENT ACCORD AU NOM DE L'ENTITÉ EN TANT QUE REPRÉSENTANT LÉGAL AUTORISÉ. SI VOUS N'ACCEPTEZ PAS INCONDITIONNELLEMENT TOUS LES TERMES DE CET ACCORD, NE SÉLECTIONNEZ PAS "J'ACCEPTE" LORSQUE CETTE OPTION EST DISPONIBLE ET N'INSTALLEZ PAS, N'EXÉCUTEZ PAS, NE TÉLÉCHARGEZ PAS, N'ACCÉDEZ PAS OU N'UTILISEZ PAS DE QUELQUE MANIÈRE QUE CE SOIT TOUTE PARTIE DE LA PLATEFORME PALANTIR.
L'ACCEPTATION DE PALANTIR EST EXPRESSÉMENT CONDITIONNÉE PAR VOTRE CONSENTEMENT À TOUS LES TERMES ET CONDITIONS DE CET ACCORD, À L'EXCLUSION DE TOUS LES AUTRES TERMES ; SI CES TERMES SONT CONSIDÉRÉS COMME UNE OFFRE, L'ACCEPTATION EST EXPRESSÉMENT LIMITÉE À CES TERMES.
PALANTIR AIP NOW N'EST ACTUELLEMENT DISPONIBLE QUE POUR LES CLIENTS ET LES UTILISATEURS SITUÉS AUX ÉTATS-UNIS, AU CANADA, EN RÉPUBLIQUE D'INDE, EN RÉPUBLIQUE FÉDÉRALE D'ALLEMAGNE, PAYS-BAS, EN ESPAGNE, EN AUTRICHE, EN SUISSE, EN FRANCE OU AU ROYAUME-UNI. EN CONSÉQUENCE, VOUS DEVEZ PRÉSENTER UNE PIÈCE D'IDENTITÉ (SUR LE FORMULAIRE DE COMMANDE, TEL QUE DÉFINI CI-DESSOUS) DÉLIVRÉE PAR LES ÉTATS-UNIS (OU LEUR ÉTAT), LE CANADA, LA RÉPUBLIQUE DE L'INDE, LES PAYS-BAS, L'ESPAGNE, L'AUTRICHE, LA SUISSE, LA FRANCE OU LE ROYAUME-UNI POUR BÉNÉFICIER DE L'ACCÈS AU , PALMARÈSOU LE ROYAUME-UNI POUR RECEVOIR L'ACCÈS À PALANTIR AIP NOW, ET VOUS NE POUVEZ PAS ACCÉDER À PALANTIR AIP NOW NI L'UTILISER SI VOUS ÊTES SITUÉ EN DEHORS DES ÉTATS-UNIS, DU CANADA, DE LA RÉPUBLIQUE D'INDE, DE LA RÉPUBLIQUE FÉDÉRALE D'ALLEMAGNE, DES PAYS-BAS, DE L'ESPAGNE, DE L'AUTRICHE, DE LA SUISSE, DE LA FRANCE OU DU ROYAUME-UNI.
Le présent Contrat est conclu entre le Client (tel que défini ci-dessous) et Palantir (chacun étant une "Partie" et collectivement les "Parties") et prend effet à la date à laquelle Vous sélectionnez "J'ACCEPTE" (ou équivalent) sur le Formulaire de Soumission de Commande lorsque cette option est mise à disposition par Palantir (la "Date d'Entrée en Vigueur") .
1.1 On entend par "société affiliée" une entité qui, directement ou indirectement, possède ou contrôle une partie à la date d'entrée en vigueur et tant que cette entité reste directement ou indirectement détenue ou contrôlée par la partie, ou est détenue ou contrôlée par elle. Au sens des présentes, on entend par "contrôle" le pouvoir de diriger, directement ou indirectement, la gestion ou les affaires d'une entité et par "propriété" la propriété effective de plus de cinquante pour cent des titres de participation avec droit de vote ou d'autres intérêts avec droit de vote équivalents d'une entité.
1.2 Le terme "Contrat" désigne, collectivement, les présentes Conditions de service de Palantir AIP Now et toutes les pièces jointes, addenda, conditions, avis, règles de fonctionnement, politiques (y compris la Politique de confidentialité de Palantir), pièces, annexes ou documents incorporés par référence ou hyperliens dans les présentes (tels qu'ils peuvent être mis à jour de temps à autre conformément à l'article 13 des présentes) ou que nous pouvons publier de temps à autre sur le site Web ou les comptes du client et tous les documents de commande conclus entre Palantir et le client qui font référence au présent contrat, y compris le formulaire de soumission de commande.
1.3 "Client" : le client identifié sur le formulaire de soumission de commande qui est partie au présent contrat et au nom duquel vous acceptez les conditions du présent contrat en tant que représentant légal.
1.4 On entend par "Données Client" toutes les données (y compris les versions agrégées ou transformées de celles-ci et les résultats analytiques), les modèles, les algorithmes, les analyses, le code de transformation ou tout autre contenu fourni par, directement ou indirectement par un tiers, ou créé par le Client ou les Utilisateurs utilisant le Service ou le Site web, pour intégration, utilisation ou autre traitement dans ou par le biais du Service. Les données du client excluent les données d'utilisation.
1.5 "Logiciel de connexion des données" désigne le logiciel de Palantir fourni pour être installé localement par le client afin de connecter les données du client au service.
1.6 "Documentation" signifie toute documentation technique pour le Service mise à disposition en relation avec le Service, y compris la documentation technique relative au Service disponible sur https://www.palantir.com/docs/, mise à jour de temps en temps à la seule discrétion de Palantir.
1.7 "Droits de propriété intellectuelle" : tous les droits, titres et intérêts relatifs aux secrets commerciaux, brevets, droits d'auteur, marques de service, marques déposées, savoir-faire, noms commerciaux, droits sur l'habillage commercial et l'emballage, droits moraux, droits à la vie privée, droits de publicité et tout autre droit similaire, y compris les demandes, continuations ou enregistrements relatifs à ce qui précède, en vertu des lois ou des règlements de toute autorité gouvernementale, réglementaire ou judiciaire.
1.8 "Formulaire de soumission de commande" désigne le formulaire en ligne (ou le document incorporant expressément le présent contrat par référence) rempli et/ou signé par vous pour inclure les informations du client et spécifier le service et/ou les services professionnels (le cas échéant) à fournir en vertu des présentes et qui est soumis par vous à Palantir pour le compte du client.
1.9 "Palantir", sauf indication contraire expresse dans un formulaire de soumission de commande, signifie (a) Palantir Technologies Inc. si le lieu d'utilisation principal du client est les Etats-Unis, le Canada, la République fédérale d'Allemagne, les Pays-Bas, l'Espagne, l'Autriche, la Suisse, la France ou la République de l'Inde ; ou (b) Palantir Technologies UK, Ltd. si le lieu d'utilisation principal du client est le Royaume-Uni. Nonobstant ce qui précède, (x) si le siège social (c'est-à-dire l'établissement principal) de l'entité mère ultime du client est situé en République de Corée, "Palantir" désigne Palantir Korea LLC. Si ni (a), ni (b), ni (x) ne s'applique, alors "Palantir" signifie Palantir Technologies Inc.
1.10 "Plate-forme Palantir" désigne le service, la documentation, le logiciel de connexion des données, les échantillons, le site Web, les modèles et les interfaces de programmation d'application (API), fournis ou mis à la disposition du client en tant que service dans le cadre du présent accord, ainsi que toutes les améliorations, modifications, travaux dérivés, correctifs, mises à niveau et mises à jour qui s'y rapportent.
1.11 "Politique de confidentialité de Palantir" : toute politique spécifique à la confidentialité disponible sur le site web et/ou accessible par le biais du formulaire de soumission de commande.
1.12 Le "matériel d'échantillonnage" désigne toute technologie et tout matériel fourni ou mis à disposition par Palantir au client pour être utilisé avec le service, y compris le code d'échantillonnage, les bibliothèques logicielles, les outils de ligne de commande, le code d'intégration des données, les modèles et les fichiers de configuration.
1.13 "Service" désigne l'accès au logiciel en tant que service à Palantir AIP Now (ou à la (aux) plateforme(s) spécifiée(s) dans un formulaire de soumission de commande).
1.14 On entend par "taxes" toute taxe applicable sur les ventes, l'utilisation, les transactions, la valeur ajoutée, les biens et services, la taxe de vente harmonisée, les retenues à la source, les droits d'accise ou autres taxes similaires, ainsi que tous les frais ou charges étrangers, provinciaux, fédéraux, étatiques ou locaux (y compris, mais sans s'y limiter, les frais environnementaux ou autres frais similaires), les droits, les coûts de conformité aux contrôles et réglementations en matière d'exportation et d'importation, et autres évaluations gouvernementales, y compris les pénalités et les intérêts y afférents, imposés sur, concernant ou associés de toute autre manière à toute transaction dans le cadre des présentes.
1.15 "Contenu Tiers" désigne toutes les données, services ou applications tiers qui interagissent avec le Service et dont Palantir peut, à la seule discrétion du Client, faciliter l'utilisation en relation avec le Service et sous réserve d'un accord indépendant entre le Client et ce tiers.
1.16 "Services Tiers" désigne les services tiers que Palantir peut utiliser dans le cadre de la fourniture du Service, comme indiqué dans la Documentation (ou comme convenu par ailleurs par les Parties).
1.17 "Site web" signifie WWW.PALANTIR.COM ou tout autre domaine appartenant à Palantir, y compris tout sous-domaine de ce qui précède, et tous les logiciels, applications, produits, contenus et services fournis par Palantir sur ou par l'intermédiaire du site web.
2.1 Accès au Service. Palantir mettra le Service à la disposition du Client, sous réserve des conditions ultérieures énoncées à la Section 2.8, pendant la Durée applicable, uniquement pour une utilisation par le Client et ses Utilisateurs conformément aux termes et conditions du présent Contrat et de la Documentation, à des fins professionnelles internes (et/ou, le cas échéant, personnelles) du Client, ou (le cas échéant) comme prévu explicitement par ailleurs dans un Formulaire de Soumission de Commande
2.2 Licence de logiciel de connexion de données. Si cela s'applique à l'utilisation du Service, et sous réserve des conditions ultérieures énoncées dans la Section 2.8, Palantir accorde au Client pendant la Durée une licence limitée non exclusive, non transférable, non sous-licenciable, pour utiliser le Logiciel de Connexion des Données dans le seul but d'utiliser et de se connecter au Service. Le Client autorisera Palantir à accéder à distance au Logiciel de Connexion des Données si nécessaire pour fournir le Service.
2.3 Licence sur les échantillons de matériel. Palantir peut mettre à disposition des échantillons de matériel à utiliser par le Client pendant la Durée. Le cas échéant, et sous réserve des conditions ultérieures énoncées dans la Section 2.8, Palantir accorde au Client pendant la Durée une licence non exclusive, non transférable, non sous-licenciable, limitée, pour copier, modifier et utiliser les Échantillons uniquement dans la mesure nécessaire à l'utilisation du Service par le Client.
2.4 Données d'utilisation. Palantir peut collecter et utiliser des mesures, des analyses, des statistiques ou d'autres données liées à l'utilisation du Service par le Client (a) pour sécuriser le Service au profit du Client ; (b) pour fournir, analyser, maintenir, soutenir et améliorer le Service ; et (c) pour tout autre objectif pour lequel le Client fournit une autorisation via le Service, lorsque cette option est disponible (collectivement "Données d'Utilisation").
2.5 Sécurité. Palantir a mis en place un programme de sécurité de l'information ("ISP") conçu pour garantir des contrôles de sécurité pratiques et solides, ainsi que la conformité avec les normes et les cadres des meilleures pratiques de l'industrie. Une liste complète des certifications de Palantir peut être consultée sur le site https://www.palantir.com/information-security/ sous "Compliance and Accreditation". L'ISP de Palantir est en outre aligné sur les cadres et systèmes de gestion NIST 800-53, TSC (Trust Service Criteria) et CIS (Center for Internet Security). Le client reconnaît que la documentation de Palantir mentionnée dans cette section et d'autres informations connexes sont des informations confidentielles de Palantir en vertu des présentes.
2.6 Niveaux de service et assistance. Pendant la Durée, Palantir n'a aucune obligation de fournir des services de support dans le cadre de ce Contrat. Ce Contrat ne vous donne pas, à Vous ou au Client, de droits sur les mises à jour ou les mises à niveau de la Plateforme Palantir ou sur les extensions ou les améliorations de la Plateforme Palantir développées par Palantir à tout moment dans le futur. Palantir peut offrir des services d'assistance séparément. Tout code logiciel supplémentaire ou matériel connexe que Palantir vous fournit ou fournit au client dans le cadre des services d'assistance doit être considéré comme faisant partie de la Plateforme Palantir et est soumis aux termes et conditions du présent Accord.
2.7 Services Professionnels. Palantir fournira au Client des services de mise en œuvre, d'habilitation, de formation ou d'autres services professionnels tels que spécifiés dans le Formulaire de Soumission de Commande, et soumis à tous les frais qui en découlent ("Services Professionnels"). Si le formulaire de soumission de commande ne spécifie aucun service professionnel, Palantir peut à sa discrétion (sans obligation de le faire en l'absence d'un accord séparé stipulant le contraire) fournir au Client des services professionnels. L'exécution de tout Service Professionnel n'affectera pas la propriété de la Plateforme Palantir et des autres matériels fournis par Palantir dans le cadre de ce Contrat.
2.8 Exigences de conformité de Palantir. Si Palantir détermine, à sa seule discrétion, que le client n'a pas satisfait aux exigences de conformité de Palantir, les obligations de Palantir en vertu des sections 2.1, 2.2 et 2.3 (y compris l'octroi des droits d'accès et des licences qui y sont prévues) prendront immédiatement fin dès que Palantir déterminera que le client n'a pas satisfait aux exigences de conformité de Palantir. Palantir peut évaluer (et réévaluer) le respect par le Client des exigences de conformité de Palantir à tout moment, y compris après que le Client ait accédé au Service. En outre, l'accès continu du Client au Service et/ou à toute Plateforme Palantir est conditionné à la détermination par Palantir, à sa seule discrétion, que le Client satisfait aux Exigences de Conformité de Palantir. Les "Exigences de Conformité de Palantir" comprennent (mais ne sont pas limitées à) la détermination par Palantir (à sa seule discrétion) que l'exécution de cet Accord avec le Client ne risque pas (i) de violer les obligations de Palantir en vertu des réglementations de contrôle commercial des Etats-Unis, y compris les réglementations d'administration des exportations des Etats-Unis, ou d'autres réglementations d'exportation applicables. Export Administration regulations, ou d'autres lois de contrôle des exportations applicables dans d'autres juridictions, (ii) violer ou autrement enfreindre les obligations contractuelles de Palantir avec des tiers, (iii) rendre Palantir en violation des lois interdisant de fournir des biens, du soutien ou des services à des Specially Designated Nationals tels que définis par le Département du Trésor des États-Unis, ou à des personnes soumises à des interdictions de blocage ou de refus similaires administrées par une agence du gouvernement des États-Unis, (iv) rendre Palantir en violation des lois interdisant de fournir des biens, du soutien ou des services à des Specially Designated Nationals tels que définis par le Département du Trésor des États-Unis, ou à des personnes soumises à des interdictions de blocage ou de refus similaires administrées par une agence du gouvernement des États-Unis.(iv) violer les obligations de Palantir en vertu des lois et réglementations sur les exportations et les sanctions des Etats-Unis et d'autres juridictions applicables, y compris, sans limitation, celles du Bureau américain de l'industrie et de la sécurité et de l'Office of Foreign Assets Control, ou (v) violer de toute autre manière les politiques ou valeurs de Palantir. Palantir se réserve le droit de modifier la définition des exigences de conformité de Palantir à tout moment, selon les besoins et à sa seule discrétion.
3. Utilisation du service par le client.
3.1 Comptes.
(a) Si le Client est une entité autre qu'une personne physique, telle qu'une entreprise, une organisation ou un établissement d'enseignement, le Client peut fournir un maximum de cinq (5) comptes pour accéder au Service ("Comptes") pour ses (1) employés, (2) contractants, (3) autres utilisateurs (y compris les employés ou contractants de ses Affiliés) spécifiés dans le Formulaire de Soumission de Commande aux fins autorisées par les présentes, et/ou (4) les clients du Client (les "Tiers Autorisés") sous réserve des conditions supplémentaires énoncées à la Section 3.1(a)(i)-(vi) des présentes (collectivement, les "Utilisateurs") :
(i) Le client peut accorder l'accès au service à un tiers autorisé uniquement dans le but d'utiliser les services fournis par le client au tiers autorisé dans le cadre des activités commerciales du client ; pour éviter toute ambiguïté, un tiers autorisé ne peut pas accéder au service pour ses propres activités commerciales indépendantes des services fournis par le client.
(ii) L'accès des Tiers Autorisés au Service sera strictement limité aux applications frontales construites par le Client en utilisant la Plateforme Palantir et il est interdit aux Tiers Autorisés d'ingérer directement des données dans la Plateforme Palantir, à condition que le Client puisse ingérer les données du Tiers Autorisé dans la Plateforme Palantir sous réserve du point (i) ci-dessus.
(iii) L'accès du Tiers Autorisé sera régi par et soumis à toutes les restrictions et obligations de l'Accord, et le Client sera responsable de tout manquement ou violation de celui-ci par un Tiers Autorisé. Le Client peut fournir à un Tiers Autorisé un accès soumis aux conditions d'accès non modifiées fournies séparément au Client par Palantir.
(iv) L'utilisation par un tiers autorisé est soumise aux redevances prévues dans le présent document.
(v) Le Client est responsable de la fourniture d'une assistance aux Tiers Autorisés concernant les applications frontales construites par le Client, et le Client doit maintenir une politique d'assistance stipulant que les Tiers Autorisés doivent soumettre toute demande d'assistance au Client, à condition que le Client puisse escalader à Palantir les problèmes de la Plateforme Palantir identifiés par un Tiers Autorisé qui ne peuvent être résolus par le Client et Palantir fournira une assistance raisonnable au Client pour de telles escalades pendant les heures normales d'ouverture de Palantir dans la (les) région(s) désignée(s) par Palantir.
(vi) Le Client ne doit pas, et ne doit pas permettre à un Tiers Autorisé d'accéder à la Plateforme Palantir à partir de tout pays figurant sur la liste des pays interdits de Palantir, telle que mise à disposition par Palantir au Client (chacun étant un "Pays Interdit").
(b) Si le Client est une personne physique, le Client ne peut fournir plus de cinq (5) Comptes, chacun uniquement à d'autres personnes physiques (chacune de ces personnes physiques étant considérée comme un Utilisateur) qui ont fourni au Client tous les consentements, autorisations, approbations, et/ou accords nécessaires pour permettre au Client d'utiliser et/ou de traiter les données de ces Utilisateurs en vertu de la loi applicable, de la réglementation, ou des accords avec ces Utilisateurs, et qui ont signé des Conditions de Service avec Palantir substantiellement similaires aux termes du présent Accord ; à condition que, si le Client est une personne physique accédant à l'instance du Service d'un autre client de Palantir en tant qu'Utilisateur autorisé (ou équivalent, tel qu'identifié sur le Formulaire de Soumission de Commande) (cet autre client de Palantir, un "Utilisateur Principal"), ce Client n'est pas autorisé à fournir des Comptes. Le Client sera responsable (i) de l'administration des Comptes ; (ii) de l'utilisation des mesures de sécurité standard de l'industrie pour protéger les Comptes (y compris, sans limitation, l'utilisation de l'authentification multi-facteurs) ; (iii) de toute activité sur les Comptes et de la surveillance de cette activité sur les Comptes (uniquement dans la mesure où cette surveillance ne viole aucune autre condition du présent Accord ou de la loi applicable) ; et (iv) des actions et omissions de ses Utilisateurs en relation avec la Plateforme Palantir et/ou les Comptes. Le Client désactivera immédiatement tout Compte dès qu'il aura connaissance de la compromission ou de l'utilisation non autorisée de celui-ci (et dans ce cas, notifiera rapidement Palantir de cette compromission ou utilisation non autorisée), ou sur demande raisonnable de Palantir.
3.2 Protection des données. Les Parties se conformeront à l'Addendum de Protection des Données de Palantir ("DPA") disponible sur https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795 . Le Client sera seul responsable de l'exactitude, du contenu et de la légalité des Données Client et s'assurera que toute intégration des Données Client dans le Service est conforme aux lois et réglementations applicables, y compris, mais sans s'y limiter, aux exigences de localisation des données. Dans le rôle de Palantir en tant que contrôleur (tel que défini dans le DPA) en ce qui concerne le Client, la politique de confidentialité de l'AIP Now disponible sur http://www.palantir.com/aip-now-statement s'appliquera et sera incorporée ici par référence.
4. Utilisation acceptable.
4.1 Lois applicables. Votre accès et votre utilisation du Service et du Site Web, ainsi que ceux du Client, ne violeront pas les lois applicables des Etats-Unis ou d'autres lois applicables dans la juridiction dans laquelle Vous ou le Client êtes situé, dans laquelle toute personne physique qui peut être identifiée (directement ou indirectement) par référence aux Données Client (chacune, une "Personne concernée") est située, ou dans laquelle les Données Client sont stockées et il est de votre seule responsabilité et de celle du Client d'assurer une telle conformité. Palantir peut de temps à autre mettre à disposition des politiques d'utilisation acceptables, des directives communautaires ou des politiques similaires, qui feront partie de cet Accord conformément à la politique de mise à jour énoncée à la Section 14.
4.2 Utilisation concurrentielle. Le client n'utilisera pas, n'accédera pas, n'évaluera pas ou ne verra pas la Plateforme Palantir dans le but de construire ou d'offrir un produit ou un service similaire ou compétitif à la Plateforme Palantir.
4.3 Contrôle des exportations. La Plateforme Palantir peut être soumise aux réglementations de contrôle commercial des Etats-Unis, telles que les Réglementations d'Administration d'Exportation des Etats-Unis, ou d'autres lois de contrôle d'exportation applicables dans d'autres juridictions, y compris les lois et réglementations d'exportation et de sanctions référencées dans la Section 15 de cet Accord. Le Client ne peut pas utiliser la Plateforme Palantir en violation du contrôle des exportations ou d'autres contrôles commerciaux des Etats-Unis ou de toute autre juridiction applicable. Ceci inclut, sans limitation, les interdictions suivantes :
(a) Le client ne peut pas utiliser ou accéder au service s'il est ou travaille pour le compte d'un ressortissant spécialement désigné, tel que défini par le département du Trésor des États-Unis, ou d'une personne soumise à des interdictions similaires de blocage ou de refus d'accès administrées par une agence gouvernementale américaine ; et
(b) Le client ne peut pas utiliser le service ou y accéder pour effectuer des activités soumises à la réglementation ITAR (International Traffic in Arms Regulations) du Département d'État des États-Unis, y compris, mais sans s'y limiter, l'ingestion de données contrôlées par ITAR.
4.4 Utilisation d'IIP et/ou d'ISP. Si le client utilise ou prévoit d'utiliser des informations d'identification personnelle ("PII"), des données personnelles, des informations personnelles ou des informations de santé protégées ("PHI"), telles que définies par la loi applicable, en relation avec le service, le client (a) doit indiquer cette utilisation (prévue) lorsque cette option est disponible dans le formulaire de soumission de commande, et signer un accord d'association commerciale avant d'accéder au service ou de l'utiliser ; et (b) suivra les conseils pertinents et les meilleures pratiques pour protéger les données sensibles définies dans la documentation disponible à l'adresse https://www.palantir.com/docs/foundry/security/overview/. Pour éviter toute ambiguïté, le présent article n'autorise pas le client à utiliser les informations susmentionnées dans le cadre du service si un formulaire de commande n'autorise pas expressément une telle utilisation.
4.5 Limitations des cas d'utilisation. Le Client doit se conformer aux Restrictions de Cas d'Utilisation de Palantir disponibles sur https://palantir.pactsafe.io/#ucr-985315, qui sont par la présente incorporées par référence dans l'Accord, y compris en relation avec toute utilisation de la Plateforme Palantir
4.6 Droits d'audit. Le Client accepte que Palantir puisse auditer l'utilisation du Service par le Client afin de vérifier le respect par le Client du présent Accord, y compris, mais sans s'y limiter, le respect de la Section 3.2 (Protection des données), de la Section 4 (Utilisation acceptable), de la Section 5.3 (Restrictions), de la Section 6 (Confidentialité), et de la Section 7 (Frais et paiement). Si Palantir prend connaissance ou soupçonne raisonnablement une violation du présent Accord par le Client, sur préavis raisonnable, Palantir peut vérifier la conformité du Client avec le présent Accord, l'utilisation par le Client de la Plateforme Palantir, et le(s) système(s) de surveillance du logiciel du Client et les enregistrements, à condition que cet audit soit effectué pendant les heures de travail normales du Client. Si Palantir croit raisonnablement que cet audit révèle que le Client a violé le présent Contrat, Palantir peut exercer ses droits de résiliation conformément à la Section 8.2, et/ou ses droits de suspension des services conformément à la Section 8.4, selon le cas, et le Client sera responsable des coûts raisonnables de l'audit en plus de tous les autres frais, dommages, pénalités ou recours auxquels Palantir peut avoir droit en vertu du présent Contrat et/ou de la loi applicable. Pour éviter toute ambiguïté, le lancement d'un audit par Palantir n'est pas nécessairement une condition préalable à l'exercice de ses droits de résiliation conformément à la section 8.2 ou à l'exercice de ses droits de suspension des services conformément à la section 8.4, si les conditions permettant l'exercice des droits précédents sont remplies ; la décision de Palantir de lancer un audit n'exclut pas sa capacité à exercer ses droits conformément à la section 8.2 ou à la section 8.4, si les conditions permettant l'exercice des droits précédents sont remplies.
5. Droits de propriété.
5.1 Propriété du client. Entre les Parties, le Client détient tous les droits, titres et intérêts, y compris tous les Droits de Propriété Intellectuelle, dans et sur les Données Client et toutes les modifications qui y sont apportées. Sous réserve de l'Accord, le Client accorde à Palantir un droit et une licence non exclusifs, mondiaux et libres de redevances pendant la Durée pour utiliser et traiter les Données Client uniquement pour fournir le Service et/ou les Services Professionnels, et comme peut l'exiger la loi applicable. Le Client accorde en outre à Palantir un droit et une licence mondiaux, perpétuels, irrévocables et libres de redevances pour utiliser, distribuer, divulguer, faire et incorporer dans la Plateforme Palantir toute suggestion, demande d'amélioration, recommandation ou autre retour d'information fourni par le Client ou les Utilisateurs en rapport avec la Plateforme Palantir
5.2 Propriété de Palantir. Entre les parties, Palantir détient tous les droits, titres et intérêts, y compris tous les droits de propriété intellectuelle, dans et sur la plate-forme Palantir, et toute autre documentation ou matériel connexe fourni par Palantir et tous les travaux dérivés, modifications ou améliorations de ce qui précède (y compris, sans limitation, tous les droits de propriété intellectuelle incorporés dans ce qui précède). A l'exception des droits exprès accordés ici, Palantir n'accorde aucune autre licence ou accès, qu'ils soient exprès ou implicites, ni aucun droit de propriété sur la Plateforme Palantir, les logiciels, les services ou les Droits de Propriété Intellectuelle.
5.3 Restrictions. Le client s'engage à ne pas (et à ne pas permettre à un tiers de) : (a) obtenir ou tenter d'obtenir un accès non autorisé au service ou au site web ou à l'infrastructure, ou à tout élément de ceux-ci, ou contourner ou interférer avec toute mesure d'authentification ou de sécurité du service ou du site web ; (b) interférer avec ou perturber l'intégrité ou la performance du service ou du site web ; (c) accéder ou tenter d'accéder aux données d'un autre client ; (d) avoir un impact négatif sur la capacité d'autres clients à utiliser le service ; (e) transmettre du matériel contenant des virus logiciels ou d'autres codes informatiques, fichiers, scripts, agents ou programmes nuisibles ou délétères par le biais du Service ou du Site Internet ; (f) décompiler, désassembler, scanner, faire de l'ingénierie inverse, ou tenter de découvrir tout code source ou idées ou algorithmes sous-jacents de toute Plateforme Palantir (sauf dans la mesure où la loi applicable interdit expressément une telle restriction d'ingénierie inverse, et dans ce cas, uniquement sur notification écrite préalable à Palantir) ; (g) fournir, louer, prêter, utiliser à des fins de partage de temps ou de bureau de service, ou autrement utiliser ou permettre à d'autres d'utiliser le Service au profit d'un tiers ; (h) utiliser le Service ou le Site Internet à toute fin qui n'est pas expressément autorisée par le présent Accord ; (i) lister ou autrement afficher ou copier tout code de toute Plateforme Palantir, à l'exception des échantillons dans la mesure nécessaire à l'utilisation du Service par le Client ; (j) copier toute Plateforme Palantir (ou composant de celle-ci) ou développer toute amélioration, modification ou travail dérivé de celle-ci, à l'exception des échantillons dans la mesure nécessaire à l'utilisation du Service par le Client ; (l) permettre le transfert, la transmission (y compris, sans limitation, la mise à disposition en ligne, la transmission électronique ou toute autre communication au public), l'exportation ou la réexportation de toute Plateforme Palantir (ou de toute partie de celle-ci) ou de toute donnée technique de Palantir ; (m) effectuer des tests de pénétration sur le Service, sauf autorisation de Palantir ; (n) utiliser, accéder, évaluer ou visualiser la Plate-forme Palantir dans le but de construire ou d'offrir un produit ou un service similaire ou concurrentiel à la Plate-forme Palantir ; (o) supprimer, masquer ou modifier, ou autrement violer les conditions de tout avis de droit d'auteur, marques, logos et noms commerciaux et tout autre avis (y compris les licences open source de tiers ou similaires) ou identifications qui apparaissent sur ou dans toute Plateforme Palantir et tout média associé ; (p) utiliser le site Web ou la plate-forme Palantir pour s'engager dans une fraude ou une fausse déclaration, ou la promouvoir (y compris, mais sans s'y limiter, fournir des informations frauduleuses ou trompeuses en réponse au formulaire de soumission de commande) ; ou (q) utiliser ou accéder au service dans le but de s'engager dans des activités ou des communications de spamming ou de les soutenir, ou dans des activités ou des communications de marketing en violation de la loi sur le contrôle de l'assaut de la pornographie et du marketing non sollicités (15 U.S.C. § 7701 et seq.), le Telephone Consumer Protection Act (47 U.S.C. § 227) et toutes les autres lois applicables interdisant le spam ou régissant d'une autre manière la transmission de matériel et/ou de communications de marketing. Nonobstant ce qui précède, ou toute déclaration contraire dans les présentes, le contenu de tiers peut être mis à disposition avec des avis et des licences open source ou similaires de ces communautés et tiers qui régissent l'utilisation de ces parties, et le client accepte par les présentes d'être lié par toutes ces licences et de s'y conformer pleinement ; toutefois, les dispositions d'exonération de garantie et de limitation de responsabilité du présent accord s'appliqueront à l'ensemble de ce contenu de tiers.
6. Confidentialité. Chaque partie (la "partie destinataire") garde strictement confidentielles toutes les informations confidentielles de l'autre partie (la "partie divulgatrice"), n'utilise ces informations confidentielles qu'aux fins du présent accord et ne les divulgue à aucun tiers, à l'exception des administrateurs, employés, agents, avocats, comptables, sous-traitants ou autres représentants de la partie destinataire qui sont soumis à des obligations de confidentialité au moins aussi restrictives que celles prévues dans le présent accord ("représentants autorisés"), selon le principe du "besoin de savoir". La partie destinataire doit faire preuve d'au moins le même degré de diligence que celui qu'elle utilise pour empêcher la divulgation de ses propres informations confidentielles, mais en aucun cas d'un degré de diligence inférieur à ce qui est raisonnable. La partie destinataire peut, sans violer les obligations de l'accord, divulguer des informations confidentielles dans la mesure requise par un tribunal valide ou une ordonnance gouvernementale, ou comme l'exige la loi applicable, à condition que la partie destinataire : (a) fournisse à la partie divulgatrice un préavis écrit raisonnable de cette divulgation et (b) fasse des efforts raisonnables pour limiter la divulgation et pour obtenir, ou aider la partie divulgatrice à obtenir, un traitement confidentiel ou une ordonnance de protection empêchant ou limitant la divulgation, tout en permettant à la partie divulgatrice de participer à la procédure. "Informations confidentielles" signifie (i) dans le cas de Palantir, la plate-forme Palantir (y compris toute information s'y rapportant) ; (ii) dans le cas du client, les données du client ; et (iii) toute autre information qui, par la nature de l'information divulguée ou la manière dont elle a été divulguée, serait considérée par une personne raisonnable comme étant confidentielle, dans chaque cas, sous quelque forme que ce soit (y compris, mais sans s'y limiter, électronique ou orale) et qu'elle ait été fournie avant, pendant ou après la date d'entrée en vigueur ; à condition, toutefois, que les informations confidentielles ne comprennent pas les informations qui (1) sont ou deviennent du domaine public sans que la partie destinataire ou ses représentants autorisés ne l'aient fait ou ne l'aient omis ; (2) sont connues de la partie destinataire à la date d'entrée en vigueur ou au moment de leur divulgation par la partie divulgatrice (comme le prouvent les documents écrits) sans obligation de les garder confidentielles ; (3) ont été légitimement divulguées à la partie destinataire avant la date d'entrée en vigueur par une autre source sans violation de la confidentialité par le tiers divulgateur et sans restriction de divulgation ou d'utilisation ; ou (4) la partie destinataire peut prouver par écrit que ces informations ont été développées de manière indépendante sans utilisation ou référence aux informations confidentielles. La partie destinataire est responsable de toute violation de la présente section par toute personne ou entité à laquelle la partie destinataire est autorisée à divulguer des informations confidentielles en vertu de la présente section. Les obligations de la partie destinataire en matière d'informations confidentielles survivent à la résiliation du présent accord pendant cinq (5) ans ; toutefois, les obligations de la partie destinataire en vertu des présentes survivent à la résiliation et se poursuivent à perpétuité, ou aussi longtemps que le permet la législation applicable, en ce qui concerne les informations confidentielles qui constituent un secret commercial en vertu de la législation applicable.
7. Frais et paiement ; taxes. Le service est réputé fourni dès lors que l'accès est accordé au client ou à son profit. Si des frais fixes sont indiqués dans le formulaire de commande, ces frais seront facturés et payables à l'avance, ou comme indiqué dans le formulaire de commande. Toute redevance basée sur l'utilisation prévue dans le formulaire de commande, y compris si elle est payable au-delà de l'utilisation incluse spécifiée dans le formulaire de commande, sera calculée conformément aux taux d'utilisation prévus dans le formulaire de commande (le cas échéant) et facturée et payable trimestriellement à terme échu, ou selon toute autre modalité prévue dans le formulaire de commande. Tous les paiements seront effectués par virement bancaire sur un compte désigné par Palantir dans la devise indiquée sur la facture correspondante, ou par toute autre méthode de paiement convenue par les Parties (y compris comme spécifié dans le Formulaire de Soumission de Commande) et comme indiqué sur la facture correspondante, dans les trente (30) jours suivant la date d'émission de la facture de Palantir . Tout paiement tardif sera soumis à des frais de service égaux à 1,5 % par mois du montant dû ou au montant maximum d'intérêts autorisé par la loi applicable, selon le montant le moins élevé. Sauf indication contraire dans le formulaire de soumission de commande, les honoraires s'entendent hors taxes applicables (à l'exception des taxes sur ou mesurées par le revenu net de Palantir). Le Client sera responsable de tous les impôts découlant du présent Contrat, de sorte qu'après paiement de ces impôts, le montant reçu par Palantir ne soit pas inférieur aux honoraires indiqués dans le Formulaire de Soumission de Commande. Dans le cas où un traité de double imposition s'applique, qui prévoit un taux de retenue à la source nul ou réduit, le Client accepte (a) de ne pas retenir les impôts dans le cas d'un taux de retenue à la source nul ou (b) de retenir au taux d'imposition réduit conformément au traité de double imposition.
8. Durée et résiliation ; suspension.
8.1 Durée ; résiliation pour des raisons de commodité. Sauf indication contraire dans le Formulaire de commande, le présent Accord prend effet à la Date d'entrée en vigueur et reste en vigueur à l'adresse jusqu'à ce qu'il soit résilié conformément aux dispositions des présentes (la "Durée") ; toutefois, si le Client est une personne physique accédant à l'instance du Service d'un Utilisateur principal en tant qu'Utilisateur autorisé (ou équivalent, tel qu'identifié dans le Formulaire de commande), la Durée reste en vigueur jusqu'à ce que l'accès de l'Utilisateur principal au Service arrive à expiration ou soit résilié. Nonobstant ce qui précède, si cela est spécifié autrement dans le Formulaire de Commande, "Durée" signifie la période allant de la Date d'Entrée en Vigueur jusqu'à l'expiration de la durée spécifiée dans le Formulaire de Commande. Palantir peut résilier le présent contrat pour des raisons de commodité, pour n'importe quelle raison ou sans raison, à tout moment, en fournissant au client un préavis de soixante (60) jours pour cette résiliation.
8.2 Résiliation pour motif grave. Sans limiter les autres droits de l'une ou l'autre des parties, l'une ou l'autre des parties peut résilier le présent accord pour un motif valable (a) en cas de violation substantielle par l'autre partie de l'une des dispositions du présent accord et en cas de défaut de remédier à la violation (et de fournir un avis écrit raisonnable de ce remède à la partie non violente) dans les trente (30) jours suivant la notification écrite de cette violation par la partie non violente ou (b) si l'autre partie se place sous la protection d'une procédure de faillite, de mise sous séquestre ou d'une procédure similaire ou si une telle procédure est engagée contre cette partie et n'est pas rejetée dans les quatre-vingt-dix (90) jours. Sauf lorsqu'un recours exclusif est spécifié dans le présent accord, l'exercice par l'une ou l'autre partie du droit de résiliation en vertu de la présente disposition est sans préjudice de tout autre recours dont elle peut disposer en vertu du présent accord ou de la loi. En cas de résiliation du présent accord par le client pour un motif valable conformément à la section 8.2(a) ou par Palantir en cas de non-respect par le client des exigences de conformité de Palantir, comme indiqué à la section 8.4(c) (suspension des services), Palantir fournira un remboursement au prorata de tous les frais prépayés pour les services non utilisés à la date effective de la résiliation
8.3 Effet de la résiliation. En cas de résiliation ou d'expiration du présent Accord, sauf dans les cas spécifiquement indiqués ci-dessous, tous les droits, accès et licences du Client accordés à la Plateforme Palantir cesseront immédiatement et le Client retournera ou détruira rapidement tous les Logiciels de Connexion de Données, les Matériels d'Echantillon et la Documentation, et toutes les autres Informations Confidentielles de Palantir, et, sur demande écrite, certifiera sa conformité avec ce qui précède à Palantir par écrit dans les dix (10) jours de cette demande. A la résiliation ou à l'expiration du présent Accord, si le Client en fait la demande, le Client aura, sous réserve des conditions du présent Accord, accès au Service pendant trente (30) jours dans le seul but de récupérer les Données du Client. Palantir supprimera ensuite toutes les données du client. Nonobstant ce qui précède, Palantir conservera, sous réserve des autres conditions du présent Accord, et uniquement à des fins de sécurité, les informations d'utilisation et les métadonnées liées à la sécurité du Service, à l'exclusion des Données Client (à l'exception des informations liées à la sécurité telles que les adresses IP, les noms d'utilisateur, les tentatives de connexion et les requêtes de recherche), pendant une période de deux (2) ans à compter du dernier événement enregistré. La résiliation ou l'expiration du présent accord ne limite ni n'affecte les droits ou obligations acquis avant la date effective de résiliation ou d'expiration (y compris, mais sans s'y limiter, les obligations de paiement). Les articles 1, 4 (à l'exclusion de l'article 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14 et 15 survivront à toute résiliation ou expiration du présent accord.
8.4 Suspension des services. Si Palantir détermine raisonnablement que : (a) Vous n'avez pas l'autorisation de lier le Client à cet Accord au nom du Client (en violation de la déclaration et de la garantie expresses dans le préambule de cet Accord) ; (b) L'utilisation par le Client du Service, de la Plateforme Palantir, ou du Site Web viole la loi applicable ou viole autrement une condition matérielle de cet Accord (y compris la Section 3.2 (Protection des données), la Section 4 (Utilisation acceptable), la Section 5.3 (Restrictions), Section 6 (Confidentialité), et Section 7 (Frais et Paiement)) ; (c) le Client ne satisfait pas aux Exigences de Conformité de Palantir ; ou (d) le Client a violé l'une des garanties énoncées dans la Section 11, Palantir se réserve le droit de désactiver, suspendre, ou résilier l'accès du Client à tout ou partie du Site Web et/ou de la Plateforme Palantir
9. Indemnisation.
9.1 Indemnisation de Palantir. Palantir défendra le client contre toute réclamation de contrefaçon ou de violation de tout droit de propriété intellectuelle déposée contre le client par un tiers sur la base de l'utilisation par le client de la plate-forme Palantir conformément aux conditions du présent accord et indemnisera et dégagera le client des coûts raisonnables, des honoraires d'avocat et des dommages, le cas échéant, finalement accordés contre le client conformément à une ordonnance non susceptible d'appel rendue par un tribunal de la juridiction compétente dans le cadre d'une telle réclamation ou d'un accord de règlement conclu par Palantir. Si l'utilisation par le Client de l'une quelconque des Plateformes Palantir est, ou de l'avis de Palantir est susceptible d'être, interdite par un tribunal compétent en raison du type de contrefaçon spécifié ci-dessus, ou si cela est requis par un règlement approuvé par Palantir par écrit, Palantir peut, à sa seule discrétion : (a) substituer des produits ou services substantiellement similaires sur le plan fonctionnel ; (b) procurer au Client le droit de continuer à utiliser la Plateforme Palantir ; ou (c) si Palantir détermine raisonnablement que les options (a) et (b) sont commercialement irréalisables, résilier le présent Contrat et rembourser au Client une partie proportionnelle des frais payés en vertu des présentes pour la Plateforme Palantir résiliée, qui reflète la partie restante de la Durée en cours au moment de la résiliation. Les obligations d'indemnisation précédentes de Palantir ne s'appliquent pas : (i) si la Plateforme Palantir est modifiée par ou à la demande du Client ou des Utilisateurs, mais seulement dans la mesure où la violation alléguée n'aurait pas eu lieu sans cette modification ; (ii) si la Plateforme Palantir est combinée avec des produits non Palantir non autorisés par Palantir, mais seulement dans la mesure où la violation alléguée n'aurait pas eu lieu sans cette combinaison ; (iii) à toute utilisation non autorisée de la Plateforme Palantir, toute utilisation qui n'est pas conforme à la Documentation, toute utilisation qui viole la Section 4 (Utilisation acceptable), ou l'utilisation pendant toute période de suspension (comme indiqué dans la Section 8.4) ; (iv) à toute donnée client ; ou (v) à tout produit ou service non Palantir
9.2 Indemnisation du Client. Le client défendra Palantir contre toute réclamation d'un tiers contre Palantir découlant de ou liée à (a) la violation par le client de la loi applicable, (b) les données du client, (c) la violation par le client du DPA, (d) la violation par le client de la section 4 (utilisation acceptable), (e) la violation par le client de la section 5.3 (Restrictions), ou (f) tout produit ou service offert par le Client (sauf si cette réclamation est attribuable au Service tel qu'il est offert par Palantir) et indemniser et dégager Palantir de toute responsabilité concernant les coûts, frais d'avocats et dommages, le cas échéant, émis par une autorité compétente ou définitivement accordés en vertu d'une ordonnance non susceptible d'appel.
9.3 Procédure d'indemnisation. Les obligations de la partie indemnisante sont conditionnées par le fait que la partie indemnisée fournisse à la partie indemnisante : (a) une notification écrite rapide (ne dépassant en aucun cas vingt (20) jours) de toute réclamation, poursuite ou demande dont elle a connaissance ; (b) le droit d'assumer la défense et le contrôle exclusifs de toute question faisant l'objet d'une indemnisation (à condition que la partie indemnisante ne règle aucune réclamation à moins qu'elle ne libère inconditionnellement la partie indemnisée de toute responsabilité et qu'elle ne reconnaisse pas de faute ou d'acte répréhensible de la part de la partie indemnisée) ; et (c) la coopération avec toute demande raisonnable d'aide à la défense et au règlement de la partie indemnisante (aux frais de la partie indemnisante). La présente section énonce la seule responsabilité et obligation de chaque partie et le seul et unique recours en ce qui concerne toute réclamation pour violation des droits de propriété intellectuelle.
10.1 Garantie de Palantir. Palantir garantit que pendant la Durée (a) le Service sera fourni substantiellement en conformité avec la Documentation applicable et (b) les Services Professionnels seront fournis de manière professionnelle et selon les règles de l'art. En cas de violation d'une des garanties ci-dessus, le client peut notifier par écrit à Palantir la résiliation du présent contrat, qui prendra effet trente (30) jours après réception de la notification par Palantir, à moins que Palantir ne soit en mesure de remédier à la violation avant la date effective de la résiliation. Cette garantie ne s'appliquera pas dans la mesure où cette violation est causée par les Données du Client ou par une mauvaise utilisation ou une modification non autorisée du Service (y compris, mais sans s'y limiter, la violation par le Client de la Section 4 (Utilisation acceptable de )) ou de tout matériel sélectionné par le Client et utilisé en relation avec le Service. En cas de résiliation du présent Accord suite à l'exercice par le Client de son droit en vertu de la présente Section, le Client aura le droit de recevoir de Palantir, comme seul et unique recours, un remboursement d'une partie proportionnelle des frais payés en vertu du présent Accord qui reflète la partie restante de la Durée active au moment de la résiliation.
10.2 Clause de non-responsabilité. AUCUN MONTANT PAYÉ AU TITRE DES PRÉSENTES N'EST REMBOURSABLE OU COMPENSABLE, SAUF INDICATION CONTRAIRE EXPLICITE DANS LES PRÉSENTES. SAUF INDICATION EXPRESSE DANS LES PRESENTES, ET UNIQUEMENT DANS LA MESURE MAXIMALE AUTORISEE PAR LA LOI APPLICABLE, LA PLATEFORME PALANTIR ET LES SERVICES PROFESSIONNELS SONT FOURNIS EN L'ETAT, SANS AUTRE GARANTIE, ET PALANTIR ET SES FOURNISSEURS ET PRESTATAIRES DE SERVICES EXCLUENT PAR LES PRESENTES TOUTE GARANTIE. SANS AUCUNE AUTRE GARANTIE D'AUCUNE SORTE ET PALANTIR ET SES FOURNISSEURS ET PRESTATAIRES DE SERVICES REJETTENT PAR LA PRÉSENTE TOUTE GARANTIE DE QUELQUE NATURE QUE CE SOIT, EXPRESSE OU IMPLICITE, ORALE OU ÉCRITE, RELATIVE À LA PLATEFORME PALANTIR ET AUX SERVICES PROFESSIONNELS FOURNIS DANS LE CADRE DES PRÉSENTES OU AUTREMENT, Y COMPRIS, MAIS SANS S'Y LIMITER, TOUTE GARANTIE DE NON-CONTREFAÇON, DE QUALITÉ MARCHANDE, DE TITRE OU D'ADÉQUATION À UN USAGE PARTICULIER. SANS LIMITER LA LIMITATION PRÉCÉDENTE, PALANTIR NE GARANTIT PAS QUE LA PLATEFORME PALANTIR ET LES SERVICES PROFESSIONNELS RÉPONDRONT AUX EXIGENCES DU CLIENT OU GARANTISSENT DES RÉSULTATS, DES ISSUES OU DES CONCLUSIONS OU QUE LE FONCTIONNEMENT DU SERVICE SERA ININTERROMPU OU EXEMPT D'ERREURS. PALANTIR N'EST PAS RESPONSABLE DES SERVICES DE TIERS (Y COMPRIS, MAIS SANS S'Y LIMITER, LES GARANTIES DE TEMPS DE FONCTIONNEMENT, LES PANNES OU LES DÉFAILLANCES), DES DONNÉES DES CLIENTS OU DU CONTENU DE TIERS. PALANTIR NE CONTRÔLE PAS LE TRANSFERT D'INFORMATIONS OU DE DONNÉES DU CLIENT SUR LES MOYENS DE COMMUNICATION, L'INTERNET OU LES SERVICES DE TIERS, ET LE SERVICE PEUT ÊTRE SUJET À DES RETARDS ET AUTRES PROBLÈMES INHÉRENTS À L'UTILISATION DE CES MOYENS DE COMMUNICATION. PALANTIR N'EST PAS RESPONSABLE DES RETARDS, DÉFAILLANCES OU AUTRES DOMMAGES RÉSULTANT DE CES PROBLÈMES.
11. Garantie du Client. Le Client garantit que (a) le Client a fourni toutes les notifications nécessaires et obtenu tous les consentements, autorisations, approbations, et/ou accords requis par les lois ou politiques applicables, et a informé Palantir de toutes les obligations applicables au traitement des Données Client par Palantir, afin de permettre à Palantir de traiter les Données Client, y compris les données personnelles, selon la portée, l'objectif et les instructions spécifiées par le Client et que le Client ne dirigera pas le traitement des Données Client par Palantir en violation de toute loi ou réglementation (y compris les exigences de localisation) ou les droits des tiers ; (b) il n'utilisera pas le Service à des fins non autorisées ou illégales ; et (c) il ne téléchargera pas ou n'importera pas de Données Client vers le Service nécessitant une documentation supplémentaire sans avoir au préalable exécuté cette documentation. Toutes les données du client qu'il intègre, utilise ou met à disposition dans le cadre de l'utilisation du service, ainsi que les conclusions qui en sont tirées, le sont à ses propres risques et il est seul responsable des dommages ou des pertes qui en résultent pour toute partie.
12. Limitations de responsabilité. DANS TOUTE LA MESURE PERMISE PAR LA LOI APPLICABLE, ET NONOBSTANT TOUTE AUTRE DISPOSITION DU PRÉSENT ACCORD, AUCUNE DES PARTIES NE SERA RESPONSABLE ENVERS L'AUTRE PARTIE OU SES AFFILIÉS (A) DU COÛT DE L'APPROVISIONNEMENT EN PRODUITS OU SERVICES DE SUBSTITUTION, OU DU COÛT DU REMPLACEMENT OU DE LA RESTAURATION DES DONNÉES DES CLIENTS, (B) DES PERTES ÉCONOMIQUES, DES PROFITS ATTENDUS OU PERDUS, DES REVENUS OU DES ÉCONOMIES ANTICIPÉES, LA PERTE D'ACTIVITÉ, LA PERTE DE CONTRATS, LA PERTE OU L'ATTEINTE AU FONDS DE COMMERCE OU À LA RÉPUTATION, ET/OU (C) LES PERTES OU DOMMAGES INDIRECTS, SPÉCIAUX, ACCESSOIRES, PUNITIFS OU CONSÉCUTIFS, QU'ILS RÉSULTENT DE L'EXÉCUTION OU DE LA VIOLATION DU PRÉSENT ACCORD OU DE L'UTILISATION OU DE L'INCAPACITÉ À UTILISER LA PLATE-FORME PALANTIR, MÊME SI LA PARTIE A ÉTÉ INFORMÉE DE LA POSSIBILITÉ DE CES PERTES OU DOMMAGES. A L'EXCEPTION DES OBLIGATIONS DES PARTIES EXPOSEES DANS LES SECTIONS 5 ET 9.2 DU PRÉSENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRÉSENTES, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIÉTÉS AFFILIÉES ENVERS L'AUTRE PARTIE ET SES SOCIÉTÉS AFFILIÉES POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DOIT PAS DÉPASSER LE PLUS ÉLEVÉ DES MONTANTS SUIVANTS : A) LES FRAIS PAYÉS OU PAYABLES À PALANTIR PAR LE CLIENT EN VERTU DE L'ACCORD DANS LES DOUZE (12) MOIS PRÉCÉDANT LA RÉCLAMATION POUR LE SERVICE OU LES SERVICES PROFESSIONNELS QUI ONT DONNÉ LIEU À CETTE RÉCLAMATION OU B) CENT MILLE DOLLARS (100 000 USD), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT . NONOBSTANT LA PHRASE PRÉCÉDENTE, SI AUCUNE REDEVANCE N'EST DUE PAR LE CLIENT PENDANT LA DURÉE DU CONTRAT, À L'EXCEPTION DES OBLIGATIONS DES PARTIES ÉNONCÉES AUX ARTICLES 5 ET 9.2 DU PRÉSENT CONTRAT ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DU PRÉSENT CONTRAT, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIÉTÉS AFFILIÉES ENVERS L'AUTRE PARTIE ET SES SOCIÉTÉS AFFILIÉES POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DÉPASSERA PAS CINQUANTE MILLE DOLLARS (50 000 DOLLARS AMÉRICAINS), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT. LES LIMITATIONS ÉNONCÉES DANS LA PRÉSENTE SECTION 12 S'APPLIQUENT INDÉPENDAMMENT DU FAIT QU'UNE ACTION SOIT FONDÉE SUR UN CONTRAT, UN DÉLIT CIVIL (Y COMPRIS LA NÉGLIGENCE), UNE RESPONSABILITÉ STRICTE OU TOUTE AUTRE THÉORIE JURIDIQUE OU ÉQUITABLE.
13. RÈGLEMENT DES LITIGES. TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DU PRÉSENT ACCORD OU S'Y RAPPORTANT, Y COMPRIS L'ARBITRABILITÉ, QUI NE PEUT ÊTRE RÉSOLU À LA SUITE DE DISCUSSIONS DE BONNE FOI DANS LES SOIXANTE (60) JOURS SUIVANT LA NOTIFICATION D'UN LITIGE, EST DÉFINITIVEMENT RÉGLÉ PAR VOIE D'ARBITRAGE. LE DROIT APPLICABLE EST LE DROIT MATÉRIEL DE L'ÉTAT DE NEW YORK, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET L'ARBITRAGE EST ADMINISTRÉ À NEW YORK, NEW YORK, ÉTATS-UNIS, CONFORMÉMENT AUX RÈGLES ET PROCÉDURES D'ARBITRAGE GLOBALES DE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. ("JAMS") ET AUX RÈGLES FÉDÉRALES DE PREUVE (NONOBSTANT LA RÈGLE 22(D) DE JAMS OU TOUTE AUTRE RÈGLE DE JAMS CONTRAIRE). LES PARTIES CONVIENNENT DE SE METTRE EN ARBITRAGE UNIQUEMENT SUR UNE BASE INDIVIDUELLE, ET LE PRÉSENT ACCORD N'AUTORISE PAS L'ARBITRAGE COLLECTIF NI AUCUNE RÉCLAMATION PRÉSENTÉE EN TANT QUE DEMANDEUR OU MEMBRE D'UN GROUPE DANS LE CADRE D'UNE PROCÉDURE D'ARBITRAGE COLLECTIVE, REPRÉSENTATIVE, PAGA, CONJOINTE OU REPRÉSENTATIVE. LE TRIBUNAL ARBITRAL NE PEUT CONSOLIDER LES DEMANDES DE PLUS D'UNE PERSONNE ET NE PEUT PRÉSIDER AUCUNE FORME DE PROCÉDURE REPRÉSENTATIVE OU COLLECTIVE. NONOBSTANT CE QUI PRÉCÈDE, CHAQUE PARTIE A LE DROIT D'INTENTER UNE ACTION À TOUT MOMENT DEVANT UN TRIBUNAL COMPÉTENT EN VUE D'OBTENIR UNE INJONCTION PRÉLIMINAIRE DANS L'ATTENTE D'UNE DÉCISION FINALE DE L'ARBITRE OU DES ARBITRES, À CONDITION QUE (A) LA PARTIE QUI INTENTE L'ACTION DEMANDE UNE ORDONNANCE POUR DÉPOSER L'ACTION SOUS SCELLÉS (OU AU MOINS LE FAIRE POUR TOUT DÉPÔT CONTENANT DES INFORMATIONS CONFIDENTIELLES OU DES SECRETS COMMERCIAUX) AFIN DE LIMITER LA DIVULGATION CONFORMÉMENT À LA SECTION 6 DU PRÉSENT ACCORD ; ET (B) UNE INJONCTION PERMANENTE ET DES DOMMAGES-INTÉRÊTS NE PEUVENT ÊTRE ACCORDÉS QUE PAR L'ARBITRE OU LES ARBITRES.
14.1 Mises à jour de cet accord. Palantir se réserve le droit de modifier le présent Accord à tout moment et mettra à jour le présent Accord en cas de modification. Palantir notifiera au Client les modifications a posteriori du présent Contrat en publiant un avis sur le Site Internet et/ou en envoyant un courrier électronique à l'adresse électronique principale spécifiée dans un Formulaire de Soumission de Commande applicable ou sur le Compte du Client. Tout amendement au présent Accord prendra effet trente (30) jours après que Palantir ait fourni cet avis. L'utilisation continue par le Client de la Plateforme Palantir dans les trente (30) jours après que Palantir ait fourni l'avis susmentionné constitue l'acceptation de ces révisions du présent Accord. Pour toute autre modification, la poursuite de l'utilisation de la Plateforme Palantir par le Client constitue un accord avec nos révisions du présent Accord. Palantir se réserve le droit à tout moment et de temps en temps de modifier (y compris la dépréciation de la fonctionnalité ou des outils), temporairement ou définitivement, la Plateforme Palantir (ou toute partie de celle-ci)
15. Divers. Palantir fournira le Service et les Services Professionnels conformément aux lois et réglementations applicables à la fourniture par Palantir de ce Service et des Services Professionnels en général, y compris, mais sans s'y limiter, en ce qui concerne la protection des données et les transferts internationaux de données personnelles , sans tenir compte de l'utilisation spécifique du Service par le Client, sauf dans la mesure indiquée dans le Formulaire de Soumission de Commande, et sous réserve du respect par le Client du présent Accord. Les parties doivent se conformer à l'addendum AIP de Palantir disponible à l'adresse https://palantir.pactsafe.io/aip-legal-3791.html, qui est incorporé par référence dans les présentes. Sauf accord écrit préalable de Palantir, ni le présent Accord ni l'accès ou les licences accordés en vertu des présentes ne peuvent être cédés, transférés ou concédés en sous-licence par le Client, y compris, sans limitation, dans le cadre d'un changement de contrôle du Client ou de la vente de la totalité ou de la quasi-totalité des actifs du Client ; toute tentative en ce sens sera nulle et non avenue. Palantir peut céder ou déléguer le présent accord, en totalité ou en partie, à toute personne ou entité à tout moment, avec ou sans le consentement du Client. Palantir peut résilier le présent contrat en cas de changement de contrôle du client ou de vente de la totalité ou de la quasi-totalité des actifs du client. Palantir peut sous-traiter le présent contrat ou des parties de celui-ci. Toute notification requise ou autorisée en vertu des présentes doit être adressée par écrit au Client à l'adresse (aux adresses) indiquée(s) dans le Formulaire de soumission de commande et, si elles sont envoyées par courrier électronique, les notifications à Palantir doivent être envoyées àlegalnotices@palantir.com ou 1200 17th Street Floor 15 Denver, CO 80202 (ATTN : Legal). Si une disposition du présent accord est jugée inapplicable ou invalide par une cour ou un tribunal de la juridiction compétente, cette disposition sera limitée ou éliminée dans la mesure minimale nécessaire pour que le présent accord reste pleinement en vigueur et soit applicable. Aucune renonciation à une violation ne sera considérée comme une renonciation à une violation ultérieure. Le service et les services professionnels sont soumis au contrôle des lois et réglementations américaines en matière d'exportation et de sanctions, y compris les réglementations américaines en matière d'administration des exportations ("EAR") administrées par le Bureau de l'industrie et de la sécurité ("BIS") du ministère du commerce et les réglementations en matière d'embargos et de sanctions administrées par l'Office of Foreign Assets Control ("OFAC") du ministère des finances des États-Unis. Le service est contrôlé en vertu de l'article 5D002.c.1, ENC. Le client doit s'assurer que toutes les exportations, réexportations, transferts, utilisations finales et utilisateurs du service sont conformes aux lois et réglementations en matière d'exportation et de sanctions des États-Unis et d'autres juridictions applicables, y compris, mais sans s'y limiter, celles du Bureau américain de l'industrie et de la sécurité et de l'Office of Foreign Assets Control (OFAC). Le Client déclare qu'il n'est pas soumis à des restrictions en vertu de listes d'utilisateurs finaux restreints du gouvernement américain, et qu'il n'est pas détenu ou contrôlé à 50% ou plus, directement ou indirectement, par des individus ou des entités identifiés sur de telles listes. Le Client notifiera immédiatement Palantir si le Client devient sujet à de telles restrictions. Le Client s'abstiendra de prendre des mesures qui amèneraient Palantir à violer les lois et réglementations applicables en matière d'exportation et de sanctions. A l'exception de l'obligation de payer de l'argent, aucune des parties ne sera responsable d'une défaillance ou d'un retard dans le cadre du présent accord en raison d'une cause échappant à son contrôle raisonnable, y compris, sans limitation, les actes de guerre, les catastrophes naturelles, les tremblements de terre, les inondations, les embargos, les émeutes, les sabotages, les pénuries ou les conflits de travail, les actes gouvernementaux ou les défaillances d'Internet, des télécommunications ou du fournisseur de services d'hébergement, les attaques informatiques ou les actes malveillants ; à condition que la partie retardée : (a) donne à l'autre partie une notification rapide de cette cause ; et (b) fasse des efforts commercialement raisonnables pour corriger rapidement cette défaillance ou ce retard d'exécution. Palantir a le droit de suspendre immédiatement l'accès au Service : (a) si le Client est en violation matérielle du présent Accord ; (b) pour prévenir un incident de sécurité ayant un impact sur le Client, le Contenu du Client, ou le Service ; ou (c) si la poursuite de l'accès violait les lois applicables ou si cela était requis en vertu de la loi ou de la réglementation applicable ou de demandes ou d'ordonnances d'autorités gouvernementales, réglementaires ou judiciaires. Il n'y a pas de tiers bénéficiaires dans le cadre du présent accord, que ce soit de manière expresse ou implicite. Pour éviter toute ambiguïté, aucune disposition du présent accord ne doit être interprétée comme créant une relation de coentreprise, d'emploi, de partenariat, d'alliance stratégique, d'alliance formelle ou de partenariat stratégique entre les parties. Le présent accord constitue la déclaration complète et exclusive de l'accord mutuel des parties et remplace et annule tous les accords et communications écrits et oraux antérieurs relatifs à l'objet du présent accord. En cas de conflit entre les présentes conditions de service et tout formulaire de soumission de commande ou toute annexe, les conditions de ce formulaire de soumission de commande ou de cette annexe prévaudront. Palantir n'est en aucun cas affilié à, ou approuvé ou sponsorisé par, The Saul Zaentz Company d.b.a. Tolkien Enterprises ou la succession de J.R.R. Tolkien.
ADDENDUM SPÉCIFIQUE AU PAYS
Pour les clients situés dans l'un des pays identifiés dans le présent addendum spécifique au pays (l'"addendum") et pour lesquels les conditions de service de Palantir ("conditions de service") ne seront pas régies par la loi de New York (par exemple, parce que la disposition relative au choix de la loi dans la section 13 des conditions de service sera inefficace en vertu de la loi applicable), les dispositions spécifiques au pays ci-dessous remplaceront ou compléteront les dispositions équivalentes dans les conditions de service, comme indiqué. Les termes en majuscules utilisés dans le présent addendum et qui n'y sont pas définis ont la même signification que celle qui leur est donnée dans les conditions de service.
FRANCE
1. Conditions en langue locale. Une copie des présentes conditions de service traduites en français est disponible à l'adresse suivante: https://palantir.pactsafe.io/aip-now-6493.html#fra-aip-now-tos-052325 (les "conditions françaises"). Pour éviter toute ambiguïté, en cas de conflit ou d'incohérence entre les conditions françaises susmentionnées et la version anglaise des conditions de service (disponible à https://palantir.pactsafe.io/aip-now-6493.html#aip-now-tos-899513, c'est la version française qui prévaut. Une copie de la DPA traduite en français est disponible à l'adresse suivante : https://palantir.pactsafe.io/aip-now-6493.html#fra-aip-now-dpa-252305 (la "DPA française"). Pour éviter toute ambiguïté, en cas de conflit ou d'incohérence entre le DPA français susmentionné et la version anglaise du DPA, c'est la version anglaise du DPA qui prévaut.
2. Résiliation pour des raisons de commodité. La dernière phrase de la section 8.1 est supprimée dans son intégralité et remplacée par ce qui suit :
"L'une ou l'autre des parties peut résilier le présent accord pour des raisons de commodité, pour n'importe quelle raison ou sans raison, à tout moment, en fournissant à l'autre partie un préavis écrit de cette résiliation ; pour que le droit de résiliation susmentionné soit effectif, si la partie qui résilie est le client, le client doit fournir un préavis écrit de quatorze (14) jours, et si la partie qui résilie est Palantir, Palantir doit fournir un préavis écrit de soixante (60) jours".
3. Limitations de responsabilité. L'article 12 des conditions de service est supprimé dans son intégralité et remplacé par le texte suivant :
"12.Limitations de responsabilité. DANS TOUTE LA MESURE PERMISE PAR LA LOI APPLICABLE, A L'EXCEPTION DES GARANTIES LEGALES ACCORDEES AUX CONSOMMATEURS EN VERTU DE LA APPLICABLELOI FRANCAISE , ET NONOBSTANT TOUTE AUTRE DISPOSITION DU PRESENT ACCORD, AUCUNE PARTIE NE SERA RESPONSABLE ENVERS L'AUTRE PARTIE OU SES SOCIETES AFFILIEES POUR (A) LE COUT D'ACQUISITION DE PRODUITS OU SERVICES DE SUBSTITUTION, OU LE COUT DE REMPLACEMENT OU DE RESTAURATION DES DONNEES DU CLIENT, (B) LES PERTES ECONOMIQUES, PERTES DE PROFITS, DE REVENUS OU D'ÉCONOMIES ANTICIPÉES, PERTES D'AFFAIRES, PERTES DE CONTRATS, PERTES OU DOMMAGES À LA CLIENTÈLE OU À LA RÉPUTATION, ET/OU (C) PERTES OU DOMMAGES INDIRECTS, SPÉCIAUX, ACCESSOIRES, PUNITIFS OU CONSÉCUTIFS, QU'ILS RÉSULTENT DE L'EXÉCUTION OU DE LA VIOLATION DU PRÉSENT ACCORD OU DE L'UTILISATION OU DE L'INCAPACITÉ À UTILISER LA PLATE-FORME PALANTIR, MÊME SI LA PARTIE A ÉTÉ INFORMÉE DE LA POSSIBILITÉ DE CES PERTES OU DOMMAGES. A L'EXCEPTION DES DROITS DE GARANTIE STATUTAIRE ACCORDES AUX CONSOMMATEURS EN VERTU DE LA LOI FRANCAISE APPLICABLE, ET A L'EXCEPTION DES OBLIGATIONS DES PARTIES STIPULEES DANS LES SECTIONS 5 ET 9.2 DU PRÉSENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRÉSENTES, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES AFFILIÉS ENVERS L'AUTRE PARTIE ET SES AFFILIÉS POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DÉPASSERA PAS LE PLUS ÉLEVÉ DES MONTANTS SUIVANTS : A) LES FRAIS PAYÉS OU PAYABLES À PALANTIR PAR LE CLIENT EN VERTU DE L'ACCORD DANS LES DOUZE (12) MOIS PRÉCÉDANT LA RÉCLAMATION POUR LE SERVICE OU LES SERVICES PROFESSIONNELS QUI ONT DONNÉ LIEU À CETTE RÉCLAMATION OU B) CENT MILLE DOLLARS (USD 100 000), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT. NONOBSTANT LA PHRASE PRÉCÉDENTE, SI AUCUNE REDEVANCE N'EST DUE PAR LE CLIENT PENDANT LA DURÉE DU CONTRAT, À L'EXCEPTION DE TOUT DROIT DE GARANTIE LÉGALE ACCORDÉ AUX CONSOMMATEURS EN VERTU DE LA LOI FRANÇAISE APPLICABLE, À ETL'EXCEPTION DES OBLIGATIONS DES PARTIES ÉNONCÉES AUX ARTICLES 5 ET 9.2 DU PRESENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRESENTES, LA MESURE MAXIMALE AUTORISEE PAR LA LOI APPLICABLE , CHAQUE PARTIE ACCEPTE QUE LA RESPONSABILITE GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIETES AFFILIEES ENVERS L'AUTRE PARTIE ET SES SOCIETES AFFILIEES POUR TOUTE RECLAMATION DE QUELQUE NATURE QUE CE SOIT N'EXCEDE PAS CINQUANTE MILLE DOLLARS (USD 50 000), ET QUE CE RECOURS EST JUSTE ET ADEQUAT. LES LIMITATIONS ÉNONCÉES DANS LA PRÉSENTE SECTION 12 S'APPLIQUENT INDÉPENDAMMENT DU FAIT QU'UNE ACTION SOIT FONDÉE SUR UN CONTRAT, UN DÉLIT CIVIL (Y COMPRIS LA NÉGLIGENCE), UNE RESPONSABILITÉ STRICTE OU TOUTE AUTRE THÉORIE JURIDIQUE OU ÉQUITABLE".
4. Règlement des litiges. L'article 13 des conditions de service est supprimé dans son intégralité et remplacé par le texte suivant :
"13.RÈGLEMENT DES LITIGES. TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DU PRÉSENT ACCORD OU S'Y RAPPORTANT, Y COMPRIS L'ARBITRABILITÉ, QUI NE PEUT ÊTRE RÉSOLU À LA SUITE DE DISCUSSIONS DE BONNE FOI DANS LES SOIXANTE (60) JOURS SUIVANT LA NOTIFICATION D'UN LITIGE, SERA DÉFINITIVEMENT RÉGLÉ PAR VOIE D'ARBITRAGE. LE DROIT APPLICABLE EST LE DROIT MATÉRIEL DE L'ÉTAT DE NEW YORK, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET L'ARBITRAGE EST ADMINISTRÉ À NEW YORK, NEW YORK, ÉTATS-UNIS, CONFORMÉMENT AUX RÈGLES ET PROCÉDURES D'ARBITRAGE GLOBALES DU JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. ("JAMS") ET AUX RÈGLES FÉDÉRALES DE LA PREUVE (NONOBSTANT LA RÈGLE 22(D) DE JAMS OU TOUTE AUTRE RÈGLE DE JAMS CONTRAIRE). LES PARTIES CONVIENNENT DE RECOURIR À L'ARBITRAGE UNIQUEMENT SUR UNE BASE INDIVIDUELLE, ET LE PRÉSENT ACCORD N'AUTORISE PAS L'ARBITRAGE COLLECTIF NI AUCUNE RÉCLAMATION PRÉSENTÉE EN TANT QUE DEMANDEUR OU MEMBRE D'UN GROUPE DANS LE CADRE D'UNE PROCÉDURE D'ARBITRAGE COLLECTIVE, REPRÉSENTATIVE, PAGA, CONJOINTE OU REPRÉSENTATIVE. LE TRIBUNAL ARBITRAL NE PEUT PAS CONSOLIDER LES DEMANDES DE PLUS D'UNE PERSONNE ET NE PEUT PRÉSIDER AUCUNE FORME DE PROCÉDURE REPRÉSENTATIVE OU COLLECTIVE. NONOBSTANT CE QUI PRÉCÈDE, CHAQUE PARTIE A LE DROIT D'INTENTER UNE ACTION À TOUT MOMENT DEVANT UN TRIBUNAL COMPÉTENT POUR OBTENIR UNE INJONCTION PRÉLIMINAIRE DANS L'ATTENTE D'UNE DÉCISION FINALE DE L'ARBITRE OU DES ARBITRES, À CONDITION QUE (A) LA PARTIE QUI INTENTE L'ACTION DEMANDE UNE ORDONNANCE POUR DÉPOSER L'ACTION SOUS SCELLÉS (OU AU MOINS LE FAIRE POUR TOUT DÉPÔT CONTENANT DES INFORMATIONS CONFIDENTIELLES OU DES SECRETS COMMERCIAUX) AFIN DE LIMITER LA DIVULGATION COMME PRÉVU À LA SECTION 6 DU PRÉSENT ACCORD ; ET (B) UNE INJONCTION PERMANENTE ET DES DOMMAGES-INTÉRÊTS NE SERONT ACCORDÉS QUE PAR L'ARBITRE OU LES ARBITRES. SI LE CLIENT EST SITUÉ EN FRANCE, LE DROIT APPLICABLE SERA LE DROIT MATÉRIEL DE LA FRANCE, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET SANS TENIR COMPTE DE LA CONVENTION DES NATIONS UNIES SUR LES CONTRATS DE VENTE INTERNATIONALE DE MARCHANDISES, ET TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DE OU EN RAPPORT AVEC LE PRÉSENT ACCORD, Y COMPRIS LA VALIDITÉ, L'INVALIDITÉ, LA VIOLATION OU LA RÉSILIATION DE CELUI-CI, SERA, À LA DISCRÉTION DU CLIENT, RÉGLÉ PAR DES PROCÉDURES JUDICIAIRES AU DOMICILE DU CLIENT OU À SON LIEU DE RÉSIDENCE HABITUEL, AVEC DES PROCÉDURES MENÉES EN ANGLAIS."
5. Mises à jour de l'accord. La section 14.1 des conditions de service est supprimée dans son intégralité et remplacée par ce qui suit :
"14.1. Mises à jour de cet Accord. Palantir se réserve le droit de modifier le présent Accord à tout moment et mettra à jour le présent Accord en cas de modification. Palantir notifiera au Client les modifications apportées au présent Accord en envoyant un e-mail à l'adresse e-mail principale spécifiée dans un Formulaire de Soumission de Commande applicable ou sur le Compte du Client. Toute modification du présent Contrat entrera en vigueur soixante (60) jours après que Palantir ait fourni cette notification, à moins que le Client ne notifie à Palantir la résiliation du Contrat. Dans ce cas, la résiliation prendra effet soixante (60) jours après la notification de Palantir au Client. L'utilisation continue par le Client de la Plateforme Palantir dans les soixante (60) jours après que Palantir ait fourni l'avis susmentionné constitue un accord sur ces révisions du présent Accord. Pour toute autre modification, l'utilisation continue par le Client de la Plateforme Palantir constitue un accord avec nos révisions du présent Accord. Palantir se réserve le droit à tout moment et de temps en temps de modifier (y compris la dépréciation des fonctionnalités ou des outils), temporairement ou définitivement, la Palantir Plateforme (ou toute partie de celle-ci)".
Effective May 23rd 2025 to May 23rd 2025
DownloadTable of Contents
PALANTIR AIP NOW TERMS OF SERVICE
EN SÉLECTIONNANT "I ACCEPT" (OU L'ÉQUIVALENT) LORSQU'UNE TELLE OPTION EST DISPONIBLE, OU EN INSTALLANT, EXÉCUTANT, TÉLÉCHARGEANT, ACCÉDANT OU UTILISANT DE TOUTE AUTRE MANIÈRE TOUTE PARTIE DE LA PLATEFORME PALANTIR (TELLE QUE DÉFINIE CI-DESSOUS), VOUS CONFIRMEZ QUE VOUS ("VOUS" OU "VOTRE" OU "UTILISATEUR AUTORISÉ") AVEZ LU LE PRÉSENT ACCORD (TEL QUE DÉFINI CI-DESSOUS), QUE VOUS COMPRENEZ LES TERMES DE L'ACCORD, ET QUE VOUS ET (LE CAS ÉCHÉANT) L'ENTITÉ QUE VOUS REPRÉSENTEZ CONSENTEZ INCONDITIONNELLEMENT À ÊTRE LIÉS PAR ET DEVENEZ PARTIE À CET ACCORD, QUI, POUR ÉVITER TOUT DOUTE, CONTIENT LA SECTION 13 CONCERNANT L'ARBITRAGE OBLIGATOIRE ET CONTRAIGNANT DES LITIGES, LA SECTION 4 CONCERNANT L'UTILISATION ACCEPTABLE, ET LA SECTION 9.2 CONCERNANT LES INDEMNITÉS DU CLIENT. SI VOUS CONCLUEZ LE PRÉSENT ACCORD AU NOM D'UNE ENTITÉ, TELLE QUE LA SOCIÉTÉ, L'ORGANISATION OU L'ÉTABLISSEMENT D'ENSEIGNEMENT POUR LEQUEL VOUS TRAVAILLEZ, VOUS DÉCLAREZ ET GARANTISSEZ QUE VOUS ÊTES AUTORISÉ À ACCEPTER LES CONDITIONS DU PRÉSENT ACCORD AU NOM DE L'ENTITÉ EN TANT QUE REPRÉSENTANT LÉGAL AUTORISÉ. SI VOUS N'ACCEPTEZ PAS INCONDITIONNELLEMENT TOUS LES TERMES DE CET ACCORD, NE SÉLECTIONNEZ PAS "J'ACCEPTE" LORSQUE CETTE OPTION EST DISPONIBLE ET N'INSTALLEZ PAS, N'EXÉCUTEZ PAS, NE TÉLÉCHARGEZ PAS, N'ACCÉDEZ PAS OU N'UTILISEZ PAS DE QUELQUE MANIÈRE QUE CE SOIT TOUTE PARTIE DE LA PLATEFORME PALANTIR.
L'ACCEPTATION DE PALANTIR EST EXPRESSÉMENT CONDITIONNÉE PAR VOTRE CONSENTEMENT À TOUS LES TERMES ET CONDITIONS DE CET ACCORD, À L'EXCLUSION DE TOUS LES AUTRES TERMES ; SI CES TERMES SONT CONSIDÉRÉS COMME UNE OFFRE, L'ACCEPTATION EST EXPRESSÉMENT LIMITÉE À CES TERMES.
PALANTIR AIP NOW N'EST ACTUELLEMENT DISPONIBLE QUE POUR LES CLIENTS ET LES UTILISATEURS SITUÉS AUX ÉTATS-UNIS, AU CANADA, EN RÉPUBLIQUE D'INDE, EN RÉPUBLIQUE FÉDÉRALE D'ALLEMAGNE, PAYS-BAS, EN ESPAGNE, EN AUTRICHE, EN SUISSE, EN FRANCE OU AU ROYAUME-UNI. EN CONSÉQUENCE, VOUS DEVEZ PRÉSENTER UNE PIÈCE D'IDENTITÉ (SUR LE FORMULAIRE DE COMMANDE, TEL QUE DÉFINI CI-DESSOUS) DÉLIVRÉE PAR LES ÉTATS-UNIS (OU LEUR ÉTAT), LE CANADA, LA RÉPUBLIQUE DE L'INDE, LES PAYS-BAS, L'ESPAGNE, L'AUTRICHE, LA SUISSE, LA FRANCE OU LE ROYAUME-UNI POUR BÉNÉFICIER DE L'ACCÈS AU , PALMARÈSOU LE ROYAUME-UNI POUR RECEVOIR L'ACCÈS À PALANTIR AIP NOW, ET VOUS NE POUVEZ PAS ACCÉDER À PALANTIR AIP NOW NI L'UTILISER SI VOUS ÊTES SITUÉ EN DEHORS DES ÉTATS-UNIS, DU CANADA, DE LA RÉPUBLIQUE D'INDE, DE LA RÉPUBLIQUE FÉDÉRALE D'ALLEMAGNE, DES PAYS-BAS, DE L'ESPAGNE, DE L'AUTRICHE, DE LA SUISSE, DE LA FRANCE OU DU ROYAUME-UNI.
Le présent Contrat est conclu entre le Client (tel que défini ci-dessous) et Palantir (chacun étant une "Partie" et collectivement les "Parties") et prend effet à la date à laquelle Vous sélectionnez "J'ACCEPTE" (ou équivalent) sur le Formulaire de Soumission de Commande lorsque cette option est mise à disposition par Palantir (la "Date d'Entrée en Vigueur") .
1.1 On entend par "société affiliée" une entité qui, directement ou indirectement, possède ou contrôle une partie à la date d'entrée en vigueur et tant que cette entité reste directement ou indirectement détenue ou contrôlée par la partie, ou est détenue ou contrôlée par elle. Au sens des présentes, on entend par "contrôle" le pouvoir de diriger, directement ou indirectement, la gestion ou les affaires d'une entité et par "propriété" la propriété effective de plus de cinquante pour cent des titres de participation avec droit de vote ou d'autres intérêts avec droit de vote équivalents d'une entité.
1.2 Le terme "Contrat" désigne, collectivement, les présentes Conditions de service de Palantir AIP Now et toutes les pièces jointes, addenda, conditions, avis, règles de fonctionnement, politiques (y compris la Politique de confidentialité de Palantir), pièces, annexes ou documents incorporés par référence ou hyperliens dans les présentes (tels qu'ils peuvent être mis à jour de temps à autre conformément à l'article 13 des présentes) ou que nous pouvons publier de temps à autre sur le site Web ou les comptes du client et tous les documents de commande conclus entre Palantir et le client qui font référence au présent contrat, y compris le formulaire de soumission de commande.
1.3 "Client" : le client identifié sur le formulaire de soumission de commande qui est partie au présent contrat et au nom duquel vous acceptez les conditions du présent contrat en tant que représentant légal.
1.4 On entend par "Données Client" toutes les données (y compris les versions agrégées ou transformées de celles-ci et les résultats analytiques), les modèles, les algorithmes, les analyses, le code de transformation ou tout autre contenu fourni par, directement ou indirectement par un tiers, ou créé par le Client ou les Utilisateurs utilisant le Service ou le Site web, pour intégration, utilisation ou autre traitement dans ou par le biais du Service. Les données du client excluent les données d'utilisation.
1.5 "Logiciel de connexion des données" désigne le logiciel de Palantir fourni pour être installé localement par le client afin de connecter les données du client au service.
1.6 "Documentation" signifie toute documentation technique pour le Service mise à disposition en relation avec le Service, y compris la documentation technique relative au Service disponible sur https://www.palantir.com/docs/, mise à jour de temps en temps à la seule discrétion de Palantir.
1.7 "Droits de propriété intellectuelle" : tous les droits, titres et intérêts relatifs aux secrets commerciaux, brevets, droits d'auteur, marques de service, marques déposées, savoir-faire, noms commerciaux, droits sur l'habillage commercial et l'emballage, droits moraux, droits à la vie privée, droits de publicité et tout autre droit similaire, y compris les demandes, continuations ou enregistrements relatifs à ce qui précède, en vertu des lois ou des règlements de toute autorité gouvernementale, réglementaire ou judiciaire.
1.8 "Formulaire de soumission de commande" désigne le formulaire en ligne (ou le document incorporant expressément le présent contrat par référence) rempli et/ou signé par vous pour inclure les informations du client et spécifier le service et/ou les services professionnels (le cas échéant) à fournir en vertu des présentes et qui est soumis par vous à Palantir pour le compte du client.
1.9 "Palantir", sauf indication contraire expresse dans un formulaire de soumission de commande, signifie (a) Palantir Technologies Inc. si le lieu d'utilisation principal du client est les Etats-Unis, le Canada, la République fédérale d'Allemagne, les Pays-Bas, l'Espagne, l'Autriche, la Suisse, la France ou la République de l'Inde ; ou (b) Palantir Technologies UK, Ltd. si le lieu d'utilisation principal du client est le Royaume-Uni. Nonobstant ce qui précède, (x) si le siège social (c'est-à-dire l'établissement principal) de l'entité mère ultime du client est situé en République de Corée, "Palantir" désigne Palantir Korea LLC. Si ni (a), ni (b), ni (x) ne s'applique, alors "Palantir" signifie Palantir Technologies Inc.
1.10 "Plate-forme Palantir" désigne le service, la documentation, le logiciel de connexion des données, les échantillons, le site Web, les modèles et les interfaces de programmation d'application (API), fournis ou mis à la disposition du client en tant que service dans le cadre du présent accord, ainsi que toutes les améliorations, modifications, travaux dérivés, correctifs, mises à niveau et mises à jour qui s'y rapportent.
1.11 "Politique de confidentialité de Palantir" : toute politique spécifique à la confidentialité disponible sur le site web et/ou accessible par le biais du formulaire de soumission de commande.
1.12 Le "matériel d'échantillonnage" désigne toute technologie et tout matériel fourni ou mis à disposition par Palantir au client pour être utilisé avec le service, y compris le code d'échantillonnage, les bibliothèques logicielles, les outils de ligne de commande, le code d'intégration des données, les modèles et les fichiers de configuration.
1.13 "Service" désigne l'accès au logiciel en tant que service à Palantir AIP Now (ou à la (aux) plateforme(s) spécifiée(s) dans un formulaire de soumission de commande).
1.14 On entend par "taxes" toute taxe applicable sur les ventes, l'utilisation, les transactions, la valeur ajoutée, les biens et services, la taxe de vente harmonisée, les retenues à la source, les droits d'accise ou autres taxes similaires, ainsi que tous les frais ou charges étrangers, provinciaux, fédéraux, étatiques ou locaux (y compris, mais sans s'y limiter, les frais environnementaux ou autres frais similaires), les droits, les coûts de conformité aux contrôles et réglementations en matière d'exportation et d'importation, et autres évaluations gouvernementales, y compris les pénalités et les intérêts y afférents, imposés sur, concernant ou associés de toute autre manière à toute transaction dans le cadre des présentes.
1.15 "Contenu Tiers" désigne toutes les données, services ou applications tiers qui interagissent avec le Service et dont Palantir peut, à la seule discrétion du Client, faciliter l'utilisation en relation avec le Service et sous réserve d'un accord indépendant entre le Client et ce tiers.
1.16 "Services Tiers" désigne les services tiers que Palantir peut utiliser dans le cadre de la fourniture du Service, comme indiqué dans la Documentation (ou comme convenu par ailleurs par les Parties).
1.17 "Site web" signifie WWW.PALANTIR.COM ou tout autre domaine appartenant à Palantir, y compris tout sous-domaine de ce qui précède, et tous les logiciels, applications, produits, contenus et services fournis par Palantir sur ou par l'intermédiaire du site web.
2.1 Accès au Service. Palantir mettra le Service à la disposition du Client, sous réserve des conditions ultérieures énoncées à la Section 2.8, pendant la Durée applicable, uniquement pour une utilisation par le Client et ses Utilisateurs conformément aux termes et conditions du présent Contrat et de la Documentation, à des fins professionnelles internes (et/ou, le cas échéant, personnelles) du Client, ou (le cas échéant) comme prévu explicitement par ailleurs dans un Formulaire de Soumission de Commande
2.2 Licence de logiciel de connexion de données. Si cela s'applique à l'utilisation du Service, et sous réserve des conditions ultérieures énoncées dans la Section 2.8, Palantir accorde au Client pendant la Durée une licence limitée non exclusive, non transférable, non sous-licenciable, pour utiliser le Logiciel de Connexion des Données dans le seul but d'utiliser et de se connecter au Service. Le Client autorisera Palantir à accéder à distance au Logiciel de Connexion des Données si nécessaire pour fournir le Service.
2.3 Licence sur les échantillons de matériel. Palantir peut mettre à disposition des échantillons de matériel à utiliser par le Client pendant la Durée. Le cas échéant, et sous réserve des conditions ultérieures énoncées dans la Section 2.8, Palantir accorde au Client pendant la Durée une licence non exclusive, non transférable, non sous-licenciable, limitée, pour copier, modifier et utiliser les Échantillons uniquement dans la mesure nécessaire à l'utilisation du Service par le Client.
2.4 Données d'utilisation. Palantir peut collecter et utiliser des mesures, des analyses, des statistiques ou d'autres données liées à l'utilisation du Service par le Client (a) pour sécuriser le Service au profit du Client ; (b) pour fournir, analyser, maintenir, soutenir et améliorer le Service ; et (c) pour tout autre objectif pour lequel le Client fournit une autorisation via le Service, lorsque cette option est disponible (collectivement "Données d'Utilisation").
2.5 Sécurité. Palantir a mis en place un programme de sécurité de l'information ("ISP") conçu pour garantir des contrôles de sécurité pratiques et solides, ainsi que la conformité avec les normes et les cadres des meilleures pratiques de l'industrie. Une liste complète des certifications de Palantir peut être consultée sur le site https://www.palantir.com/information-security/ sous "Compliance and Accreditation". L'ISP de Palantir est en outre aligné sur les cadres et systèmes de gestion NIST 800-53, TSC (Trust Service Criteria) et CIS (Center for Internet Security). Le client reconnaît que la documentation de Palantir mentionnée dans cette section et d'autres informations connexes sont des informations confidentielles de Palantir en vertu des présentes.
2.6 Niveaux de service et assistance. Pendant la Durée, Palantir n'a aucune obligation de fournir des services de support dans le cadre de ce Contrat. Ce Contrat ne vous donne pas, à Vous ou au Client, de droits sur les mises à jour ou les mises à niveau de la Plateforme Palantir ou sur les extensions ou les améliorations de la Plateforme Palantir développées par Palantir à tout moment dans le futur. Palantir peut offrir des services d'assistance séparément. Tout code logiciel supplémentaire ou matériel connexe que Palantir vous fournit ou fournit au client dans le cadre des services d'assistance doit être considéré comme faisant partie de la Plateforme Palantir et est soumis aux termes et conditions du présent Accord.
2.7 Services Professionnels. Palantir fournira au Client des services de mise en œuvre, d'habilitation, de formation ou d'autres services professionnels tels que spécifiés dans le Formulaire de Soumission de Commande, et soumis à tous les frais qui en découlent ("Services Professionnels"). Si le formulaire de soumission de commande ne spécifie aucun service professionnel, Palantir peut à sa discrétion (sans obligation de le faire en l'absence d'un accord séparé stipulant le contraire) fournir au Client des services professionnels. L'exécution de tout Service Professionnel n'affectera pas la propriété de la Plateforme Palantir et des autres matériels fournis par Palantir dans le cadre de ce Contrat.
2.8 Exigences de conformité de Palantir. Si Palantir détermine, à sa seule discrétion, que le client n'a pas satisfait aux exigences de conformité de Palantir, les obligations de Palantir en vertu des sections 2.1, 2.2 et 2.3 (y compris l'octroi des droits d'accès et des licences qui y sont prévues) prendront immédiatement fin dès que Palantir déterminera que le client n'a pas satisfait aux exigences de conformité de Palantir. Palantir peut évaluer (et réévaluer) le respect par le Client des exigences de conformité de Palantir à tout moment, y compris après que le Client ait accédé au Service. En outre, l'accès continu du Client au Service et/ou à toute Plateforme Palantir est conditionné à la détermination par Palantir, à sa seule discrétion, que le Client satisfait aux Exigences de Conformité de Palantir. Les "Exigences de Conformité de Palantir" comprennent (mais ne sont pas limitées à) la détermination par Palantir (à sa seule discrétion) que l'exécution de cet Accord avec le Client ne risque pas (i) de violer les obligations de Palantir en vertu des réglementations de contrôle commercial des Etats-Unis, y compris les réglementations d'administration des exportations des Etats-Unis, ou d'autres réglementations d'exportation applicables. Export Administration regulations, ou d'autres lois de contrôle des exportations applicables dans d'autres juridictions, (ii) violer ou autrement enfreindre les obligations contractuelles de Palantir avec des tiers, (iii) rendre Palantir en violation des lois interdisant de fournir des biens, du soutien ou des services à des Specially Designated Nationals tels que définis par le Département du Trésor des États-Unis, ou à des personnes soumises à des interdictions de blocage ou de refus similaires administrées par une agence du gouvernement des États-Unis, (iv) rendre Palantir en violation des lois interdisant de fournir des biens, du soutien ou des services à des Specially Designated Nationals tels que définis par le Département du Trésor des États-Unis, ou à des personnes soumises à des interdictions de blocage ou de refus similaires administrées par une agence du gouvernement des États-Unis.(iv) violer les obligations de Palantir en vertu des lois et réglementations sur les exportations et les sanctions des Etats-Unis et d'autres juridictions applicables, y compris, sans limitation, celles du Bureau américain de l'industrie et de la sécurité et de l'Office of Foreign Assets Control, ou (v) violer de toute autre manière les politiques ou valeurs de Palantir. Palantir se réserve le droit de modifier la définition des exigences de conformité de Palantir à tout moment, selon les besoins et à sa seule discrétion.
3. Utilisation du service par le client.
3.1 Comptes.
(a) Si le Client est une entité autre qu'une personne physique, telle qu'une entreprise, une organisation ou un établissement d'enseignement, le Client peut fournir un maximum de cinq (5) comptes pour accéder au Service ("Comptes") pour ses (1) employés, (2) contractants, (3) autres utilisateurs (y compris les employés ou contractants de ses Affiliés) spécifiés dans le Formulaire de Soumission de Commande aux fins autorisées par les présentes, et/ou (4) les clients du Client (les "Tiers Autorisés") sous réserve des conditions supplémentaires énoncées à la Section 3.1(a)(i)-(vi) des présentes (collectivement, les "Utilisateurs") :
(i) Le client peut accorder l'accès au service à un tiers autorisé uniquement dans le but d'utiliser les services fournis par le client au tiers autorisé dans le cadre des activités commerciales du client ; pour éviter toute ambiguïté, un tiers autorisé ne peut pas accéder au service pour ses propres activités commerciales indépendantes des services fournis par le client.
(ii) L'accès des Tiers Autorisés au Service sera strictement limité aux applications frontales construites par le Client en utilisant la Plateforme Palantir et il est interdit aux Tiers Autorisés d'ingérer directement des données dans la Plateforme Palantir, à condition que le Client puisse ingérer les données du Tiers Autorisé dans la Plateforme Palantir sous réserve du point (i) ci-dessus.
(iii) L'accès du Tiers Autorisé sera régi par et soumis à toutes les restrictions et obligations de l'Accord, et le Client sera responsable de tout manquement ou violation de celui-ci par un Tiers Autorisé. Le Client peut fournir à un Tiers Autorisé un accès soumis aux conditions d'accès non modifiées fournies séparément au Client par Palantir.
(iv) L'utilisation par un tiers autorisé est soumise aux redevances prévues dans le présent document.
(v) Le Client est responsable de la fourniture d'une assistance aux Tiers Autorisés concernant les applications frontales construites par le Client, et le Client doit maintenir une politique d'assistance stipulant que les Tiers Autorisés doivent soumettre toute demande d'assistance au Client, à condition que le Client puisse escalader à Palantir les problèmes de la Plateforme Palantir identifiés par un Tiers Autorisé qui ne peuvent être résolus par le Client et Palantir fournira une assistance raisonnable au Client pour de telles escalades pendant les heures normales d'ouverture de Palantir dans la (les) région(s) désignée(s) par Palantir.
(vi) Le Client ne doit pas, et ne doit pas permettre à un Tiers Autorisé d'accéder à la Plateforme Palantir à partir de tout pays figurant sur la liste des pays interdits de Palantir, telle que mise à disposition par Palantir au Client (chacun étant un "Pays Interdit").
(b) Si le Client est une personne physique, le Client ne peut fournir plus de cinq (5) Comptes, chacun uniquement à d'autres personnes physiques (chacune de ces personnes physiques étant considérée comme un Utilisateur) qui ont fourni au Client tous les consentements, autorisations, approbations, et/ou accords nécessaires pour permettre au Client d'utiliser et/ou de traiter les données de ces Utilisateurs en vertu de la loi applicable, de la réglementation, ou des accords avec ces Utilisateurs, et qui ont signé des Conditions de Service avec Palantir substantiellement similaires aux termes du présent Accord ; à condition que, si le Client est une personne physique accédant à l'instance du Service d'un autre client de Palantir en tant qu'Utilisateur autorisé (ou équivalent, tel qu'identifié sur le Formulaire de Soumission de Commande) (cet autre client de Palantir, un "Utilisateur Principal"), ce Client n'est pas autorisé à fournir des Comptes. Le Client sera responsable (i) de l'administration des Comptes ; (ii) de l'utilisation des mesures de sécurité standard de l'industrie pour protéger les Comptes (y compris, sans limitation, l'utilisation de l'authentification multi-facteurs) ; (iii) de toute activité sur les Comptes et de la surveillance de cette activité sur les Comptes (uniquement dans la mesure où cette surveillance ne viole aucune autre condition du présent Accord ou de la loi applicable) ; et (iv) des actions et omissions de ses Utilisateurs en relation avec la Plateforme Palantir et/ou les Comptes. Le Client désactivera immédiatement tout Compte dès qu'il aura connaissance de la compromission ou de l'utilisation non autorisée de celui-ci (et dans ce cas, notifiera rapidement Palantir de cette compromission ou utilisation non autorisée), ou sur demande raisonnable de Palantir.
3.2 Protection des données. Les Parties se conformeront à l'Addendum de Protection des Données de Palantir ("DPA") disponible sur https://palantir.pactsafe.io/aip-now-6493.html#aip-now-dpa-022795 . Le Client sera seul responsable de l'exactitude, du contenu et de la légalité des Données Client et s'assurera que toute intégration des Données Client dans le Service est conforme aux lois et réglementations applicables, y compris, mais sans s'y limiter, aux exigences de localisation des données. Dans le rôle de Palantir en tant que contrôleur (tel que défini dans le DPA) en ce qui concerne le Client, la politique de confidentialité de l'AIP Now disponible sur http://www.palantir.com/aip-now-statement s'appliquera et sera incorporée ici par référence.
4. Utilisation acceptable.
4.1 Lois applicables. Votre accès et votre utilisation du Service et du Site Web, ainsi que ceux du Client, ne violeront pas les lois applicables des Etats-Unis ou d'autres lois applicables dans la juridiction dans laquelle Vous ou le Client êtes situé, dans laquelle toute personne physique qui peut être identifiée (directement ou indirectement) par référence aux Données Client (chacune, une "Personne concernée") est située, ou dans laquelle les Données Client sont stockées et il est de votre seule responsabilité et de celle du Client d'assurer une telle conformité. Palantir peut de temps à autre mettre à disposition des politiques d'utilisation acceptables, des directives communautaires ou des politiques similaires, qui feront partie de cet Accord conformément à la politique de mise à jour énoncée à la Section 14.
4.2 Utilisation concurrentielle. Le client n'utilisera pas, n'accédera pas, n'évaluera pas ou ne verra pas la Plateforme Palantir dans le but de construire ou d'offrir un produit ou un service similaire ou compétitif à la Plateforme Palantir.
4.3 Contrôle des exportations. La Plateforme Palantir peut être soumise aux réglementations de contrôle commercial des Etats-Unis, telles que les Réglementations d'Administration d'Exportation des Etats-Unis, ou d'autres lois de contrôle d'exportation applicables dans d'autres juridictions, y compris les lois et réglementations d'exportation et de sanctions référencées dans la Section 15 de cet Accord. Le Client ne peut pas utiliser la Plateforme Palantir en violation du contrôle des exportations ou d'autres contrôles commerciaux des Etats-Unis ou de toute autre juridiction applicable. Ceci inclut, sans limitation, les interdictions suivantes :
(a) Le client ne peut pas utiliser ou accéder au service s'il est ou travaille pour le compte d'un ressortissant spécialement désigné, tel que défini par le département du Trésor des États-Unis, ou d'une personne soumise à des interdictions similaires de blocage ou de refus d'accès administrées par une agence gouvernementale américaine ; et
(b) Le client ne peut pas utiliser le service ou y accéder pour effectuer des activités soumises à la réglementation ITAR (International Traffic in Arms Regulations) du Département d'État des États-Unis, y compris, mais sans s'y limiter, l'ingestion de données contrôlées par ITAR.
4.4 Utilisation d'IIP et/ou d'ISP. Si le client utilise ou prévoit d'utiliser des informations d'identification personnelle ("PII"), des données personnelles, des informations personnelles ou des informations de santé protégées ("PHI"), telles que définies par la loi applicable, en relation avec le service, le client (a) doit indiquer cette utilisation (prévue) lorsque cette option est disponible dans le formulaire de soumission de commande, et signer un accord d'association commerciale avant d'accéder au service ou de l'utiliser ; et (b) suivra les conseils pertinents et les meilleures pratiques pour protéger les données sensibles définies dans la documentation disponible à l'adresse https://www.palantir.com/docs/foundry/security/overview/. Pour éviter toute ambiguïté, le présent article n'autorise pas le client à utiliser les informations susmentionnées dans le cadre du service si un formulaire de commande n'autorise pas expressément une telle utilisation.
4.5 Limitations des cas d'utilisation. Le Client doit se conformer aux Restrictions de Cas d'Utilisation de Palantir disponibles sur https://palantir.pactsafe.io/#ucr-985315, qui sont par la présente incorporées par référence dans l'Accord, y compris en relation avec toute utilisation de la Plateforme Palantir
4.6 Droits d'audit. Le Client accepte que Palantir puisse auditer l'utilisation du Service par le Client afin de vérifier le respect par le Client du présent Accord, y compris, mais sans s'y limiter, le respect de la Section 3.2 (Protection des données), de la Section 4 (Utilisation acceptable), de la Section 5.3 (Restrictions), de la Section 6 (Confidentialité), et de la Section 7 (Frais et paiement). Si Palantir prend connaissance ou soupçonne raisonnablement une violation du présent Accord par le Client, sur préavis raisonnable, Palantir peut vérifier la conformité du Client avec le présent Accord, l'utilisation par le Client de la Plateforme Palantir, et le(s) système(s) de surveillance du logiciel du Client et les enregistrements, à condition que cet audit soit effectué pendant les heures de travail normales du Client. Si Palantir croit raisonnablement que cet audit révèle que le Client a violé le présent Contrat, Palantir peut exercer ses droits de résiliation conformément à la Section 8.2, et/ou ses droits de suspension des services conformément à la Section 8.4, selon le cas, et le Client sera responsable des coûts raisonnables de l'audit en plus de tous les autres frais, dommages, pénalités ou recours auxquels Palantir peut avoir droit en vertu du présent Contrat et/ou de la loi applicable. Pour éviter toute ambiguïté, le lancement d'un audit par Palantir n'est pas nécessairement une condition préalable à l'exercice de ses droits de résiliation conformément à la section 8.2 ou à l'exercice de ses droits de suspension des services conformément à la section 8.4, si les conditions permettant l'exercice des droits précédents sont remplies ; la décision de Palantir de lancer un audit n'exclut pas sa capacité à exercer ses droits conformément à la section 8.2 ou à la section 8.4, si les conditions permettant l'exercice des droits précédents sont remplies.
5. Droits de propriété.
5.1 Propriété du client. Entre les Parties, le Client détient tous les droits, titres et intérêts, y compris tous les Droits de Propriété Intellectuelle, dans et sur les Données Client et toutes les modifications qui y sont apportées. Sous réserve de l'Accord, le Client accorde à Palantir un droit et une licence non exclusifs, mondiaux et libres de redevances pendant la Durée pour utiliser et traiter les Données Client uniquement pour fournir le Service et/ou les Services Professionnels, et comme peut l'exiger la loi applicable. Le Client accorde en outre à Palantir un droit et une licence mondiaux, perpétuels, irrévocables et libres de redevances pour utiliser, distribuer, divulguer, faire et incorporer dans la Plateforme Palantir toute suggestion, demande d'amélioration, recommandation ou autre retour d'information fourni par le Client ou les Utilisateurs en rapport avec la Plateforme Palantir
5.2 Propriété de Palantir. Entre les parties, Palantir détient tous les droits, titres et intérêts, y compris tous les droits de propriété intellectuelle, dans et sur la plate-forme Palantir, et toute autre documentation ou matériel connexe fourni par Palantir et tous les travaux dérivés, modifications ou améliorations de ce qui précède (y compris, sans limitation, tous les droits de propriété intellectuelle incorporés dans ce qui précède). A l'exception des droits exprès accordés ici, Palantir n'accorde aucune autre licence ou accès, qu'ils soient exprès ou implicites, ni aucun droit de propriété sur la Plateforme Palantir, les logiciels, les services ou les Droits de Propriété Intellectuelle.
5.3 Restrictions. Le client s'engage à ne pas (et à ne pas permettre à un tiers de) : (a) obtenir ou tenter d'obtenir un accès non autorisé au service ou au site web ou à l'infrastructure, ou à tout élément de ceux-ci, ou contourner ou interférer avec toute mesure d'authentification ou de sécurité du service ou du site web ; (b) interférer avec ou perturber l'intégrité ou la performance du service ou du site web ; (c) accéder ou tenter d'accéder aux données d'un autre client ; (d) avoir un impact négatif sur la capacité d'autres clients à utiliser le service ; (e) transmettre du matériel contenant des virus logiciels ou d'autres codes informatiques, fichiers, scripts, agents ou programmes nuisibles ou délétères par le biais du Service ou du Site Internet ; (f) décompiler, désassembler, scanner, faire de l'ingénierie inverse, ou tenter de découvrir tout code source ou idées ou algorithmes sous-jacents de toute Plateforme Palantir (sauf dans la mesure où la loi applicable interdit expressément une telle restriction d'ingénierie inverse, et dans ce cas, uniquement sur notification écrite préalable à Palantir) ; (g) fournir, louer, prêter, utiliser à des fins de partage de temps ou de bureau de service, ou autrement utiliser ou permettre à d'autres d'utiliser le Service au profit d'un tiers ; (h) utiliser le Service ou le Site Internet à toute fin qui n'est pas expressément autorisée par le présent Accord ; (i) lister ou autrement afficher ou copier tout code de toute Plateforme Palantir, à l'exception des échantillons dans la mesure nécessaire à l'utilisation du Service par le Client ; (j) copier toute Plateforme Palantir (ou composant de celle-ci) ou développer toute amélioration, modification ou travail dérivé de celle-ci, à l'exception des échantillons dans la mesure nécessaire à l'utilisation du Service par le Client ; (l) permettre le transfert, la transmission (y compris, sans limitation, la mise à disposition en ligne, la transmission électronique ou toute autre communication au public), l'exportation ou la réexportation de toute Plateforme Palantir (ou de toute partie de celle-ci) ou de toute donnée technique de Palantir ; (m) effectuer des tests de pénétration sur le Service, sauf autorisation de Palantir ; (n) utiliser, accéder, évaluer ou visualiser la Plate-forme Palantir dans le but de construire ou d'offrir un produit ou un service similaire ou concurrentiel à la Plate-forme Palantir ; (o) supprimer, masquer ou modifier, ou autrement violer les conditions de tout avis de droit d'auteur, marques, logos et noms commerciaux et tout autre avis (y compris les licences open source de tiers ou similaires) ou identifications qui apparaissent sur ou dans toute Plateforme Palantir et tout média associé ; (p) utiliser le site Web ou la plate-forme Palantir pour s'engager dans une fraude ou une fausse déclaration, ou la promouvoir (y compris, mais sans s'y limiter, fournir des informations frauduleuses ou trompeuses en réponse au formulaire de soumission de commande) ; ou (q) utiliser ou accéder au service dans le but de s'engager dans des activités ou des communications de spamming ou de les soutenir, ou dans des activités ou des communications de marketing en violation de la loi sur le contrôle de l'assaut de la pornographie et du marketing non sollicités (15 U.S.C. § 7701 et seq.), le Telephone Consumer Protection Act (47 U.S.C. § 227) et toutes les autres lois applicables interdisant le spam ou régissant d'une autre manière la transmission de matériel et/ou de communications de marketing. Nonobstant ce qui précède, ou toute déclaration contraire dans les présentes, le contenu de tiers peut être mis à disposition avec des avis et des licences open source ou similaires de ces communautés et tiers qui régissent l'utilisation de ces parties, et le client accepte par les présentes d'être lié par toutes ces licences et de s'y conformer pleinement ; toutefois, les dispositions d'exonération de garantie et de limitation de responsabilité du présent accord s'appliqueront à l'ensemble de ce contenu de tiers.
6. Confidentialité. Chaque partie (la "partie destinataire") garde strictement confidentielles toutes les informations confidentielles de l'autre partie (la "partie divulgatrice"), n'utilise ces informations confidentielles qu'aux fins du présent accord et ne les divulgue à aucun tiers, à l'exception des administrateurs, employés, agents, avocats, comptables, sous-traitants ou autres représentants de la partie destinataire qui sont soumis à des obligations de confidentialité au moins aussi restrictives que celles prévues dans le présent accord ("représentants autorisés"), selon le principe du "besoin de savoir". La partie destinataire doit faire preuve d'au moins le même degré de diligence que celui qu'elle utilise pour empêcher la divulgation de ses propres informations confidentielles, mais en aucun cas d'un degré de diligence inférieur à ce qui est raisonnable. La partie destinataire peut, sans violer les obligations de l'accord, divulguer des informations confidentielles dans la mesure requise par un tribunal valide ou une ordonnance gouvernementale, ou comme l'exige la loi applicable, à condition que la partie destinataire : (a) fournisse à la partie divulgatrice un préavis écrit raisonnable de cette divulgation et (b) fasse des efforts raisonnables pour limiter la divulgation et pour obtenir, ou aider la partie divulgatrice à obtenir, un traitement confidentiel ou une ordonnance de protection empêchant ou limitant la divulgation, tout en permettant à la partie divulgatrice de participer à la procédure. "Informations confidentielles" signifie (i) dans le cas de Palantir, la plate-forme Palantir (y compris toute information s'y rapportant) ; (ii) dans le cas du client, les données du client ; et (iii) toute autre information qui, par la nature de l'information divulguée ou la manière dont elle a été divulguée, serait considérée par une personne raisonnable comme étant confidentielle, dans chaque cas, sous quelque forme que ce soit (y compris, mais sans s'y limiter, électronique ou orale) et qu'elle ait été fournie avant, pendant ou après la date d'entrée en vigueur ; à condition, toutefois, que les informations confidentielles ne comprennent pas les informations qui (1) sont ou deviennent du domaine public sans que la partie destinataire ou ses représentants autorisés ne l'aient fait ou ne l'aient omis ; (2) sont connues de la partie destinataire à la date d'entrée en vigueur ou au moment de leur divulgation par la partie divulgatrice (comme le prouvent les documents écrits) sans obligation de les garder confidentielles ; (3) ont été légitimement divulguées à la partie destinataire avant la date d'entrée en vigueur par une autre source sans violation de la confidentialité par le tiers divulgateur et sans restriction de divulgation ou d'utilisation ; ou (4) la partie destinataire peut prouver par écrit que ces informations ont été développées de manière indépendante sans utilisation ou référence aux informations confidentielles. La partie destinataire est responsable de toute violation de la présente section par toute personne ou entité à laquelle la partie destinataire est autorisée à divulguer des informations confidentielles en vertu de la présente section. Les obligations de la partie destinataire en matière d'informations confidentielles survivent à la résiliation du présent accord pendant cinq (5) ans ; toutefois, les obligations de la partie destinataire en vertu des présentes survivent à la résiliation et se poursuivent à perpétuité, ou aussi longtemps que le permet la législation applicable, en ce qui concerne les informations confidentielles qui constituent un secret commercial en vertu de la législation applicable.
7. Frais et paiement ; taxes. Le service est réputé fourni dès lors que l'accès est accordé au client ou à son profit. Si des frais fixes sont indiqués dans le formulaire de commande, ces frais seront facturés et payables à l'avance, ou comme indiqué dans le formulaire de commande. Toute redevance basée sur l'utilisation prévue dans le formulaire de commande, y compris si elle est payable au-delà de l'utilisation incluse spécifiée dans le formulaire de commande, sera calculée conformément aux taux d'utilisation prévus dans le formulaire de commande (le cas échéant) et facturée et payable trimestriellement à terme échu, ou selon toute autre modalité prévue dans le formulaire de commande. Tous les paiements seront effectués par virement bancaire sur un compte désigné par Palantir dans la devise indiquée sur la facture correspondante, ou par toute autre méthode de paiement convenue par les Parties (y compris comme spécifié dans le Formulaire de Soumission de Commande) et comme indiqué sur la facture correspondante, dans les trente (30) jours suivant la date d'émission de la facture de Palantir . Tout paiement tardif sera soumis à des frais de service égaux à 1,5 % par mois du montant dû ou au montant maximum d'intérêts autorisé par la loi applicable, selon le montant le moins élevé. Sauf indication contraire dans le formulaire de soumission de commande, les honoraires s'entendent hors taxes applicables (à l'exception des taxes sur ou mesurées par le revenu net de Palantir). Le Client sera responsable de tous les impôts découlant du présent Contrat, de sorte qu'après paiement de ces impôts, le montant reçu par Palantir ne soit pas inférieur aux honoraires indiqués dans le Formulaire de Soumission de Commande. Dans le cas où un traité de double imposition s'applique, qui prévoit un taux de retenue à la source nul ou réduit, le Client accepte (a) de ne pas retenir les impôts dans le cas d'un taux de retenue à la source nul ou (b) de retenir au taux d'imposition réduit conformément au traité de double imposition.
8. Durée et résiliation ; suspension.
8.1 Durée ; résiliation pour des raisons de commodité. Sauf indication contraire dans le Formulaire de commande, le présent Accord prend effet à la Date d'entrée en vigueur et reste en vigueur à l'adresse jusqu'à ce qu'il soit résilié conformément aux dispositions des présentes (la "Durée") ; toutefois, si le Client est une personne physique accédant à l'instance du Service d'un Utilisateur principal en tant qu'Utilisateur autorisé (ou équivalent, tel qu'identifié dans le Formulaire de commande), la Durée reste en vigueur jusqu'à ce que l'accès de l'Utilisateur principal au Service arrive à expiration ou soit résilié. Nonobstant ce qui précède, si cela est spécifié autrement dans le Formulaire de Commande, "Durée" signifie la période allant de la Date d'Entrée en Vigueur jusqu'à l'expiration de la durée spécifiée dans le Formulaire de Commande. Palantir peut résilier le présent contrat pour des raisons de commodité, pour n'importe quelle raison ou sans raison, à tout moment, en fournissant au client un préavis de soixante (60) jours pour cette résiliation.
8.2 Résiliation pour motif grave. Sans limiter les autres droits de l'une ou l'autre des parties, l'une ou l'autre des parties peut résilier le présent accord pour un motif valable (a) en cas de violation substantielle par l'autre partie de l'une des dispositions du présent accord et en cas de défaut de remédier à la violation (et de fournir un avis écrit raisonnable de ce remède à la partie non violente) dans les trente (30) jours suivant la notification écrite de cette violation par la partie non violente ou (b) si l'autre partie se place sous la protection d'une procédure de faillite, de mise sous séquestre ou d'une procédure similaire ou si une telle procédure est engagée contre cette partie et n'est pas rejetée dans les quatre-vingt-dix (90) jours. Sauf lorsqu'un recours exclusif est spécifié dans le présent accord, l'exercice par l'une ou l'autre partie du droit de résiliation en vertu de la présente disposition est sans préjudice de tout autre recours dont elle peut disposer en vertu du présent accord ou de la loi. En cas de résiliation du présent accord par le client pour un motif valable conformément à la section 8.2(a) ou par Palantir en cas de non-respect par le client des exigences de conformité de Palantir, comme indiqué à la section 8.4(c) (suspension des services), Palantir fournira un remboursement au prorata de tous les frais prépayés pour les services non utilisés à la date effective de la résiliation
8.3 Effet de la résiliation. En cas de résiliation ou d'expiration du présent Accord, sauf dans les cas spécifiquement indiqués ci-dessous, tous les droits, accès et licences du Client accordés à la Plateforme Palantir cesseront immédiatement et le Client retournera ou détruira rapidement tous les Logiciels de Connexion de Données, les Matériels d'Echantillon et la Documentation, et toutes les autres Informations Confidentielles de Palantir, et, sur demande écrite, certifiera sa conformité avec ce qui précède à Palantir par écrit dans les dix (10) jours de cette demande. A la résiliation ou à l'expiration du présent Accord, si le Client en fait la demande, le Client aura, sous réserve des conditions du présent Accord, accès au Service pendant trente (30) jours dans le seul but de récupérer les Données du Client. Palantir supprimera ensuite toutes les données du client. Nonobstant ce qui précède, Palantir conservera, sous réserve des autres conditions du présent Accord, et uniquement à des fins de sécurité, les informations d'utilisation et les métadonnées liées à la sécurité du Service, à l'exclusion des Données Client (à l'exception des informations liées à la sécurité telles que les adresses IP, les noms d'utilisateur, les tentatives de connexion et les requêtes de recherche), pendant une période de deux (2) ans à compter du dernier événement enregistré. La résiliation ou l'expiration du présent accord ne limite ni n'affecte les droits ou obligations acquis avant la date effective de résiliation ou d'expiration (y compris, mais sans s'y limiter, les obligations de paiement). Les articles 1, 4 (à l'exclusion de l'article 4.5), 5, 6, 7, 8, 9, 10, 12, 13, 14 et 15 survivront à toute résiliation ou expiration du présent accord.
8.4 Suspension des services. Si Palantir détermine raisonnablement que : (a) Vous n'avez pas l'autorisation de lier le Client à cet Accord au nom du Client (en violation de la déclaration et de la garantie expresses dans le préambule de cet Accord) ; (b) L'utilisation par le Client du Service, de la Plateforme Palantir, ou du Site Web viole la loi applicable ou viole autrement une condition matérielle de cet Accord (y compris la Section 3.2 (Protection des données), la Section 4 (Utilisation acceptable), la Section 5.3 (Restrictions), Section 6 (Confidentialité), et Section 7 (Frais et Paiement)) ; (c) le Client ne satisfait pas aux Exigences de Conformité de Palantir ; ou (d) le Client a violé l'une des garanties énoncées dans la Section 11, Palantir se réserve le droit de désactiver, suspendre, ou résilier l'accès du Client à tout ou partie du Site Web et/ou de la Plateforme Palantir
9. Indemnisation.
9.1 Indemnisation de Palantir. Palantir défendra le client contre toute réclamation de contrefaçon ou de violation de tout droit de propriété intellectuelle déposée contre le client par un tiers sur la base de l'utilisation par le client de la plate-forme Palantir conformément aux conditions du présent accord et indemnisera et dégagera le client des coûts raisonnables, des honoraires d'avocat et des dommages, le cas échéant, finalement accordés contre le client conformément à une ordonnance non susceptible d'appel rendue par un tribunal de la juridiction compétente dans le cadre d'une telle réclamation ou d'un accord de règlement conclu par Palantir. Si l'utilisation par le Client de l'une quelconque des Plateformes Palantir est, ou de l'avis de Palantir est susceptible d'être, interdite par un tribunal compétent en raison du type de contrefaçon spécifié ci-dessus, ou si cela est requis par un règlement approuvé par Palantir par écrit, Palantir peut, à sa seule discrétion : (a) substituer des produits ou services substantiellement similaires sur le plan fonctionnel ; (b) procurer au Client le droit de continuer à utiliser la Plateforme Palantir ; ou (c) si Palantir détermine raisonnablement que les options (a) et (b) sont commercialement irréalisables, résilier le présent Contrat et rembourser au Client une partie proportionnelle des frais payés en vertu des présentes pour la Plateforme Palantir résiliée, qui reflète la partie restante de la Durée en cours au moment de la résiliation. Les obligations d'indemnisation précédentes de Palantir ne s'appliquent pas : (i) si la Plateforme Palantir est modifiée par ou à la demande du Client ou des Utilisateurs, mais seulement dans la mesure où la violation alléguée n'aurait pas eu lieu sans cette modification ; (ii) si la Plateforme Palantir est combinée avec des produits non Palantir non autorisés par Palantir, mais seulement dans la mesure où la violation alléguée n'aurait pas eu lieu sans cette combinaison ; (iii) à toute utilisation non autorisée de la Plateforme Palantir, toute utilisation qui n'est pas conforme à la Documentation, toute utilisation qui viole la Section 4 (Utilisation acceptable), ou l'utilisation pendant toute période de suspension (comme indiqué dans la Section 8.4) ; (iv) à toute donnée client ; ou (v) à tout produit ou service non Palantir
9.2 Indemnisation du Client. Le client défendra Palantir contre toute réclamation d'un tiers contre Palantir découlant de ou liée à (a) la violation par le client de la loi applicable, (b) les données du client, (c) la violation par le client du DPA, (d) la violation par le client de la section 4 (utilisation acceptable), (e) la violation par le client de la section 5.3 (Restrictions), ou (f) tout produit ou service offert par le Client (sauf si cette réclamation est attribuable au Service tel qu'il est offert par Palantir) et indemniser et dégager Palantir de toute responsabilité concernant les coûts, frais d'avocats et dommages, le cas échéant, émis par une autorité compétente ou définitivement accordés en vertu d'une ordonnance non susceptible d'appel.
9.3 Procédure d'indemnisation. Les obligations de la partie indemnisante sont conditionnées par le fait que la partie indemnisée fournisse à la partie indemnisante : (a) une notification écrite rapide (ne dépassant en aucun cas vingt (20) jours) de toute réclamation, poursuite ou demande dont elle a connaissance ; (b) le droit d'assumer la défense et le contrôle exclusifs de toute question faisant l'objet d'une indemnisation (à condition que la partie indemnisante ne règle aucune réclamation à moins qu'elle ne libère inconditionnellement la partie indemnisée de toute responsabilité et qu'elle ne reconnaisse pas de faute ou d'acte répréhensible de la part de la partie indemnisée) ; et (c) la coopération avec toute demande raisonnable d'aide à la défense et au règlement de la partie indemnisante (aux frais de la partie indemnisante). La présente section énonce la seule responsabilité et obligation de chaque partie et le seul et unique recours en ce qui concerne toute réclamation pour violation des droits de propriété intellectuelle.
10.1 Garantie de Palantir. Palantir garantit que pendant la Durée (a) le Service sera fourni substantiellement en conformité avec la Documentation applicable et (b) les Services Professionnels seront fournis de manière professionnelle et selon les règles de l'art. En cas de violation d'une des garanties ci-dessus, le client peut notifier par écrit à Palantir la résiliation du présent contrat, qui prendra effet trente (30) jours après réception de la notification par Palantir, à moins que Palantir ne soit en mesure de remédier à la violation avant la date effective de la résiliation. Cette garantie ne s'appliquera pas dans la mesure où cette violation est causée par les Données du Client ou par une mauvaise utilisation ou une modification non autorisée du Service (y compris, mais sans s'y limiter, la violation par le Client de la Section 4 (Utilisation acceptable de )) ou de tout matériel sélectionné par le Client et utilisé en relation avec le Service. En cas de résiliation du présent Accord suite à l'exercice par le Client de son droit en vertu de la présente Section, le Client aura le droit de recevoir de Palantir, comme seul et unique recours, un remboursement d'une partie proportionnelle des frais payés en vertu du présent Accord qui reflète la partie restante de la Durée active au moment de la résiliation.
10.2 Clause de non-responsabilité. AUCUN MONTANT PAYÉ AU TITRE DES PRÉSENTES N'EST REMBOURSABLE OU COMPENSABLE, SAUF INDICATION CONTRAIRE EXPLICITE DANS LES PRÉSENTES. SAUF INDICATION EXPRESSE DANS LES PRESENTES, ET UNIQUEMENT DANS LA MESURE MAXIMALE AUTORISEE PAR LA LOI APPLICABLE, LA PLATEFORME PALANTIR ET LES SERVICES PROFESSIONNELS SONT FOURNIS EN L'ETAT, SANS AUTRE GARANTIE, ET PALANTIR ET SES FOURNISSEURS ET PRESTATAIRES DE SERVICES EXCLUENT PAR LES PRESENTES TOUTE GARANTIE. SANS AUCUNE AUTRE GARANTIE D'AUCUNE SORTE ET PALANTIR ET SES FOURNISSEURS ET PRESTATAIRES DE SERVICES REJETTENT PAR LA PRÉSENTE TOUTE GARANTIE DE QUELQUE NATURE QUE CE SOIT, EXPRESSE OU IMPLICITE, ORALE OU ÉCRITE, RELATIVE À LA PLATEFORME PALANTIR ET AUX SERVICES PROFESSIONNELS FOURNIS DANS LE CADRE DES PRÉSENTES OU AUTREMENT, Y COMPRIS, MAIS SANS S'Y LIMITER, TOUTE GARANTIE DE NON-CONTREFAÇON, DE QUALITÉ MARCHANDE, DE TITRE OU D'ADÉQUATION À UN USAGE PARTICULIER. SANS LIMITER LA LIMITATION PRÉCÉDENTE, PALANTIR NE GARANTIT PAS QUE LA PLATEFORME PALANTIR ET LES SERVICES PROFESSIONNELS RÉPONDRONT AUX EXIGENCES DU CLIENT OU GARANTISSENT DES RÉSULTATS, DES ISSUES OU DES CONCLUSIONS OU QUE LE FONCTIONNEMENT DU SERVICE SERA ININTERROMPU OU EXEMPT D'ERREURS. PALANTIR N'EST PAS RESPONSABLE DES SERVICES DE TIERS (Y COMPRIS, MAIS SANS S'Y LIMITER, LES GARANTIES DE TEMPS DE FONCTIONNEMENT, LES PANNES OU LES DÉFAILLANCES), DES DONNÉES DES CLIENTS OU DU CONTENU DE TIERS. PALANTIR NE CONTRÔLE PAS LE TRANSFERT D'INFORMATIONS OU DE DONNÉES DU CLIENT SUR LES MOYENS DE COMMUNICATION, L'INTERNET OU LES SERVICES DE TIERS, ET LE SERVICE PEUT ÊTRE SUJET À DES RETARDS ET AUTRES PROBLÈMES INHÉRENTS À L'UTILISATION DE CES MOYENS DE COMMUNICATION. PALANTIR N'EST PAS RESPONSABLE DES RETARDS, DÉFAILLANCES OU AUTRES DOMMAGES RÉSULTANT DE CES PROBLÈMES.
11. Garantie du Client. Le Client garantit que (a) le Client a fourni toutes les notifications nécessaires et obtenu tous les consentements, autorisations, approbations, et/ou accords requis par les lois ou politiques applicables, et a informé Palantir de toutes les obligations applicables au traitement des Données Client par Palantir, afin de permettre à Palantir de traiter les Données Client, y compris les données personnelles, selon la portée, l'objectif et les instructions spécifiées par le Client et que le Client ne dirigera pas le traitement des Données Client par Palantir en violation de toute loi ou réglementation (y compris les exigences de localisation) ou les droits des tiers ; (b) il n'utilisera pas le Service à des fins non autorisées ou illégales ; et (c) il ne téléchargera pas ou n'importera pas de Données Client vers le Service nécessitant une documentation supplémentaire sans avoir au préalable exécuté cette documentation. Toutes les données du client qu'il intègre, utilise ou met à disposition dans le cadre de l'utilisation du service, ainsi que les conclusions qui en sont tirées, le sont à ses propres risques et il est seul responsable des dommages ou des pertes qui en résultent pour toute partie.
12. Limitations de responsabilité. DANS TOUTE LA MESURE PERMISE PAR LA LOI APPLICABLE, ET NONOBSTANT TOUTE AUTRE DISPOSITION DU PRÉSENT ACCORD, AUCUNE DES PARTIES NE SERA RESPONSABLE ENVERS L'AUTRE PARTIE OU SES AFFILIÉS (A) DU COÛT DE L'APPROVISIONNEMENT EN PRODUITS OU SERVICES DE SUBSTITUTION, OU DU COÛT DU REMPLACEMENT OU DE LA RESTAURATION DES DONNÉES DES CLIENTS, (B) DES PERTES ÉCONOMIQUES, DES PROFITS ATTENDUS OU PERDUS, DES REVENUS OU DES ÉCONOMIES ANTICIPÉES, LA PERTE D'ACTIVITÉ, LA PERTE DE CONTRATS, LA PERTE OU L'ATTEINTE AU FONDS DE COMMERCE OU À LA RÉPUTATION, ET/OU (C) LES PERTES OU DOMMAGES INDIRECTS, SPÉCIAUX, ACCESSOIRES, PUNITIFS OU CONSÉCUTIFS, QU'ILS RÉSULTENT DE L'EXÉCUTION OU DE LA VIOLATION DU PRÉSENT ACCORD OU DE L'UTILISATION OU DE L'INCAPACITÉ À UTILISER LA PLATE-FORME PALANTIR, MÊME SI LA PARTIE A ÉTÉ INFORMÉE DE LA POSSIBILITÉ DE CES PERTES OU DOMMAGES. A L'EXCEPTION DES OBLIGATIONS DES PARTIES EXPOSEES DANS LES SECTIONS 5 ET 9.2 DU PRÉSENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRÉSENTES, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIÉTÉS AFFILIÉES ENVERS L'AUTRE PARTIE ET SES SOCIÉTÉS AFFILIÉES POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DOIT PAS DÉPASSER LE PLUS ÉLEVÉ DES MONTANTS SUIVANTS : A) LES FRAIS PAYÉS OU PAYABLES À PALANTIR PAR LE CLIENT EN VERTU DE L'ACCORD DANS LES DOUZE (12) MOIS PRÉCÉDANT LA RÉCLAMATION POUR LE SERVICE OU LES SERVICES PROFESSIONNELS QUI ONT DONNÉ LIEU À CETTE RÉCLAMATION OU B) CENT MILLE DOLLARS (100 000 USD), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT . NONOBSTANT LA PHRASE PRÉCÉDENTE, SI AUCUNE REDEVANCE N'EST DUE PAR LE CLIENT PENDANT LA DURÉE DU CONTRAT, À L'EXCEPTION DES OBLIGATIONS DES PARTIES ÉNONCÉES AUX ARTICLES 5 ET 9.2 DU PRÉSENT CONTRAT ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DU PRÉSENT CONTRAT, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIÉTÉS AFFILIÉES ENVERS L'AUTRE PARTIE ET SES SOCIÉTÉS AFFILIÉES POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DÉPASSERA PAS CINQUANTE MILLE DOLLARS (50 000 DOLLARS AMÉRICAINS), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT. LES LIMITATIONS ÉNONCÉES DANS LA PRÉSENTE SECTION 12 S'APPLIQUENT INDÉPENDAMMENT DU FAIT QU'UNE ACTION SOIT FONDÉE SUR UN CONTRAT, UN DÉLIT CIVIL (Y COMPRIS LA NÉGLIGENCE), UNE RESPONSABILITÉ STRICTE OU TOUTE AUTRE THÉORIE JURIDIQUE OU ÉQUITABLE.
13. RÈGLEMENT DES LITIGES. TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DU PRÉSENT ACCORD OU S'Y RAPPORTANT, Y COMPRIS L'ARBITRABILITÉ, QUI NE PEUT ÊTRE RÉSOLU À LA SUITE DE DISCUSSIONS DE BONNE FOI DANS LES SOIXANTE (60) JOURS SUIVANT LA NOTIFICATION D'UN LITIGE, EST DÉFINITIVEMENT RÉGLÉ PAR VOIE D'ARBITRAGE. LE DROIT APPLICABLE EST LE DROIT MATÉRIEL DE L'ÉTAT DE NEW YORK, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET L'ARBITRAGE EST ADMINISTRÉ À NEW YORK, NEW YORK, ÉTATS-UNIS, CONFORMÉMENT AUX RÈGLES ET PROCÉDURES D'ARBITRAGE GLOBALES DE JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. ("JAMS") ET AUX RÈGLES FÉDÉRALES DE PREUVE (NONOBSTANT LA RÈGLE 22(D) DE JAMS OU TOUTE AUTRE RÈGLE DE JAMS CONTRAIRE). LES PARTIES CONVIENNENT DE SE METTRE EN ARBITRAGE UNIQUEMENT SUR UNE BASE INDIVIDUELLE, ET LE PRÉSENT ACCORD N'AUTORISE PAS L'ARBITRAGE COLLECTIF NI AUCUNE RÉCLAMATION PRÉSENTÉE EN TANT QUE DEMANDEUR OU MEMBRE D'UN GROUPE DANS LE CADRE D'UNE PROCÉDURE D'ARBITRAGE COLLECTIVE, REPRÉSENTATIVE, PAGA, CONJOINTE OU REPRÉSENTATIVE. LE TRIBUNAL ARBITRAL NE PEUT CONSOLIDER LES DEMANDES DE PLUS D'UNE PERSONNE ET NE PEUT PRÉSIDER AUCUNE FORME DE PROCÉDURE REPRÉSENTATIVE OU COLLECTIVE. NONOBSTANT CE QUI PRÉCÈDE, CHAQUE PARTIE A LE DROIT D'INTENTER UNE ACTION À TOUT MOMENT DEVANT UN TRIBUNAL COMPÉTENT EN VUE D'OBTENIR UNE INJONCTION PRÉLIMINAIRE DANS L'ATTENTE D'UNE DÉCISION FINALE DE L'ARBITRE OU DES ARBITRES, À CONDITION QUE (A) LA PARTIE QUI INTENTE L'ACTION DEMANDE UNE ORDONNANCE POUR DÉPOSER L'ACTION SOUS SCELLÉS (OU AU MOINS LE FAIRE POUR TOUT DÉPÔT CONTENANT DES INFORMATIONS CONFIDENTIELLES OU DES SECRETS COMMERCIAUX) AFIN DE LIMITER LA DIVULGATION CONFORMÉMENT À LA SECTION 6 DU PRÉSENT ACCORD ; ET (B) UNE INJONCTION PERMANENTE ET DES DOMMAGES-INTÉRÊTS NE PEUVENT ÊTRE ACCORDÉS QUE PAR L'ARBITRE OU LES ARBITRES.
14.1 Mises à jour de cet accord. Palantir se réserve le droit de modifier le présent Accord à tout moment et mettra à jour le présent Accord en cas de modification. Palantir notifiera au Client les modifications a posteriori du présent Contrat en publiant un avis sur le Site Internet et/ou en envoyant un courrier électronique à l'adresse électronique principale spécifiée dans un Formulaire de Soumission de Commande applicable ou sur le Compte du Client. Tout amendement au présent Accord prendra effet trente (30) jours après que Palantir ait fourni cet avis. L'utilisation continue par le Client de la Plateforme Palantir dans les trente (30) jours après que Palantir ait fourni l'avis susmentionné constitue l'acceptation de ces révisions du présent Accord. Pour toute autre modification, la poursuite de l'utilisation de la Plateforme Palantir par le Client constitue un accord avec nos révisions du présent Accord. Palantir se réserve le droit à tout moment et de temps en temps de modifier (y compris la dépréciation de la fonctionnalité ou des outils), temporairement ou définitivement, la Plateforme Palantir (ou toute partie de celle-ci)
15. Divers. Palantir fournira le Service et les Services Professionnels conformément aux lois et réglementations applicables à la fourniture par Palantir de ce Service et des Services Professionnels en général, y compris, mais sans s'y limiter, en ce qui concerne la protection des données et les transferts internationaux de données personnelles , sans tenir compte de l'utilisation spécifique du Service par le Client, sauf dans la mesure indiquée dans le Formulaire de Soumission de Commande, et sous réserve du respect par le Client du présent Accord. Les parties doivent se conformer à l'addendum AIP de Palantir disponible à l'adresse https://palantir.pactsafe.io/aip-legal-3791.html, qui est incorporé par référence dans les présentes. Sauf accord écrit préalable de Palantir, ni le présent Accord ni l'accès ou les licences accordés en vertu des présentes ne peuvent être cédés, transférés ou concédés en sous-licence par le Client, y compris, sans limitation, dans le cadre d'un changement de contrôle du Client ou de la vente de la totalité ou de la quasi-totalité des actifs du Client ; toute tentative en ce sens sera nulle et non avenue. Palantir peut céder ou déléguer le présent accord, en totalité ou en partie, à toute personne ou entité à tout moment, avec ou sans le consentement du Client. Palantir peut résilier le présent contrat en cas de changement de contrôle du client ou de vente de la totalité ou de la quasi-totalité des actifs du client. Palantir peut sous-traiter le présent contrat ou des parties de celui-ci. Toute notification requise ou autorisée en vertu des présentes doit être adressée par écrit au Client à l'adresse (aux adresses) indiquée(s) dans le Formulaire de soumission de commande et, si elles sont envoyées par courrier électronique, les notifications à Palantir doivent être envoyées àlegalnotices@palantir.com ou 1200 17th Street Floor 15 Denver, CO 80202 (ATTN : Legal). Si une disposition du présent accord est jugée inapplicable ou invalide par une cour ou un tribunal de la juridiction compétente, cette disposition sera limitée ou éliminée dans la mesure minimale nécessaire pour que le présent accord reste pleinement en vigueur et soit applicable. Aucune renonciation à une violation ne sera considérée comme une renonciation à une violation ultérieure. Le service et les services professionnels sont soumis au contrôle des lois et réglementations américaines en matière d'exportation et de sanctions, y compris les réglementations américaines en matière d'administration des exportations ("EAR") administrées par le Bureau de l'industrie et de la sécurité ("BIS") du ministère du commerce et les réglementations en matière d'embargos et de sanctions administrées par l'Office of Foreign Assets Control ("OFAC") du ministère des finances des États-Unis. Le service est contrôlé en vertu de l'article 5D002.c.1, ENC. Le client doit s'assurer que toutes les exportations, réexportations, transferts, utilisations finales et utilisateurs du service sont conformes aux lois et réglementations en matière d'exportation et de sanctions des États-Unis et d'autres juridictions applicables, y compris, mais sans s'y limiter, celles du Bureau américain de l'industrie et de la sécurité et de l'Office of Foreign Assets Control (OFAC). Le Client déclare qu'il n'est pas soumis à des restrictions en vertu de listes d'utilisateurs finaux restreints du gouvernement américain, et qu'il n'est pas détenu ou contrôlé à 50% ou plus, directement ou indirectement, par des individus ou des entités identifiés sur de telles listes. Le Client notifiera immédiatement Palantir si le Client devient sujet à de telles restrictions. Le Client s'abstiendra de prendre des mesures qui amèneraient Palantir à violer les lois et réglementations applicables en matière d'exportation et de sanctions. A l'exception de l'obligation de payer de l'argent, aucune des parties ne sera responsable d'une défaillance ou d'un retard dans le cadre du présent accord en raison d'une cause échappant à son contrôle raisonnable, y compris, sans limitation, les actes de guerre, les catastrophes naturelles, les tremblements de terre, les inondations, les embargos, les émeutes, les sabotages, les pénuries ou les conflits de travail, les actes gouvernementaux ou les défaillances d'Internet, des télécommunications ou du fournisseur de services d'hébergement, les attaques informatiques ou les actes malveillants ; à condition que la partie retardée : (a) donne à l'autre partie une notification rapide de cette cause ; et (b) fasse des efforts commercialement raisonnables pour corriger rapidement cette défaillance ou ce retard d'exécution. Palantir a le droit de suspendre immédiatement l'accès au Service : (a) si le Client est en violation matérielle du présent Accord ; (b) pour prévenir un incident de sécurité ayant un impact sur le Client, le Contenu du Client, ou le Service ; ou (c) si la poursuite de l'accès violait les lois applicables ou si cela était requis en vertu de la loi ou de la réglementation applicable ou de demandes ou d'ordonnances d'autorités gouvernementales, réglementaires ou judiciaires. Il n'y a pas de tiers bénéficiaires dans le cadre du présent accord, que ce soit de manière expresse ou implicite. Pour éviter toute ambiguïté, aucune disposition du présent accord ne doit être interprétée comme créant une relation de coentreprise, d'emploi, de partenariat, d'alliance stratégique, d'alliance formelle ou de partenariat stratégique entre les parties. Le présent accord constitue la déclaration complète et exclusive de l'accord mutuel des parties et remplace et annule tous les accords et communications écrits et oraux antérieurs relatifs à l'objet du présent accord. En cas de conflit entre les présentes conditions de service et tout formulaire de soumission de commande ou toute annexe, les conditions de ce formulaire de soumission de commande ou de cette annexe prévaudront. Palantir n'est en aucun cas affilié à, ou approuvé ou sponsorisé par, The Saul Zaentz Company d.b.a. Tolkien Enterprises ou la succession de J.R.R. Tolkien.
ADDENDUM SPÉCIFIQUE AU PAYS
Pour les clients situés dans l'un des pays identifiés dans le présent addendum spécifique au pays (l'"addendum") et pour lesquels les conditions de service de Palantir ("conditions de service") ne seront pas régies par la loi de New York (par exemple, parce que la disposition relative au choix de la loi dans la section 13 des conditions de service sera inefficace en vertu de la loi applicable), les dispositions spécifiques au pays ci-dessous remplaceront ou compléteront les dispositions équivalentes dans les conditions de service, comme indiqué. Les termes en majuscules utilisés dans le présent addendum et qui n'y sont pas définis ont la même signification que celle qui leur est donnée dans les conditions de service.
FRANCE
1. Conditions en langue locale. Une copie des présentes conditions de service traduites en français est disponible à l'adresse suivante : [ INSERT LINK ] (les "conditions françaises"). Pour éviter toute ambiguïté, en cas de conflit ou d'incohérence entre les conditions françaises susmentionnées et la version anglaise des conditions de service (disponible à https://palantir.pactsafe.io/aip-now-6493.html#aip-now-tos-899513, c'est la version française qui prévaut. Une copie de la DPA traduite en français est disponible à l'adresse suivante : https://palantir.pactsafe.io/aip-now-6493.html#fra-aip-now-dpa-252305 (la "DPA française"). Pour éviter toute ambiguïté, en cas de conflit ou d'incohérence entre le DPA français susmentionné et la version anglaise du DPA, c'est la version anglaise du DPA qui prévaut.
2. Résiliation pour des raisons de commodité. La dernière phrase de la section 8.1 est supprimée dans son intégralité et remplacée par ce qui suit :
"L'une ou l'autre des parties peut résilier le présent accord pour des raisons de commodité, pour n'importe quelle raison ou sans raison, à tout moment, en fournissant à l'autre partie un préavis écrit de cette résiliation ; pour que le droit de résiliation susmentionné soit effectif, si la partie qui résilie est le client, le client doit fournir un préavis écrit de quatorze (14) jours, et si la partie qui résilie est Palantir, Palantir doit fournir un préavis écrit de soixante (60) jours".
3. Limitations de responsabilité. L'article 12 des conditions de service est supprimé dans son intégralité et remplacé par le texte suivant :
"12.Limitations de responsabilité. DANS TOUTE LA MESURE PERMISE PAR LA LOI APPLICABLE, A L'EXCEPTION DES GARANTIES LEGALES ACCORDEES AUX CONSOMMATEURS EN VERTU DE LA APPLICABLELOI FRANCAISE , ET NONOBSTANT TOUTE AUTRE DISPOSITION DU PRESENT ACCORD, AUCUNE PARTIE NE SERA RESPONSABLE ENVERS L'AUTRE PARTIE OU SES SOCIETES AFFILIEES POUR (A) LE COUT D'ACQUISITION DE PRODUITS OU SERVICES DE SUBSTITUTION, OU LE COUT DE REMPLACEMENT OU DE RESTAURATION DES DONNEES DU CLIENT, (B) LES PERTES ECONOMIQUES, PERTES DE PROFITS, DE REVENUS OU D'ÉCONOMIES ANTICIPÉES, PERTES D'AFFAIRES, PERTES DE CONTRATS, PERTES OU DOMMAGES À LA CLIENTÈLE OU À LA RÉPUTATION, ET/OU (C) PERTES OU DOMMAGES INDIRECTS, SPÉCIAUX, ACCESSOIRES, PUNITIFS OU CONSÉCUTIFS, QU'ILS RÉSULTENT DE L'EXÉCUTION OU DE LA VIOLATION DU PRÉSENT ACCORD OU DE L'UTILISATION OU DE L'INCAPACITÉ À UTILISER LA PLATE-FORME PALANTIR, MÊME SI LA PARTIE A ÉTÉ INFORMÉE DE LA POSSIBILITÉ DE CES PERTES OU DOMMAGES. A L'EXCEPTION DES DROITS DE GARANTIE STATUTAIRE ACCORDES AUX CONSOMMATEURS EN VERTU DE LA LOI FRANCAISE APPLICABLE, ET A L'EXCEPTION DES OBLIGATIONS DES PARTIES STIPULEES DANS LES SECTIONS 5 ET 9.2 DU PRÉSENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRÉSENTES, DANS LA MESURE MAXIMALE AUTORISÉE PAR LA LOI APPLICABLE, CHAQUE PARTIE CONVIENT QUE LA RESPONSABILITÉ GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES AFFILIÉS ENVERS L'AUTRE PARTIE ET SES AFFILIÉS POUR TOUTES LES RÉCLAMATIONS DE QUELQUE NATURE QUE CE SOIT NE DÉPASSERA PAS LE PLUS ÉLEVÉ DES MONTANTS SUIVANTS : A) LES FRAIS PAYÉS OU PAYABLES À PALANTIR PAR LE CLIENT EN VERTU DE L'ACCORD DANS LES DOUZE (12) MOIS PRÉCÉDANT LA RÉCLAMATION POUR LE SERVICE OU LES SERVICES PROFESSIONNELS QUI ONT DONNÉ LIEU À CETTE RÉCLAMATION OU B) CENT MILLE DOLLARS (USD 100 000), ET QUE CE RECOURS EST JUSTE ET ADÉQUAT. NONOBSTANT LA PHRASE PRÉCÉDENTE, SI AUCUNE REDEVANCE N'EST DUE PAR LE CLIENT PENDANT LA DURÉE DU CONTRAT, À L'EXCEPTION DE TOUT DROIT DE GARANTIE LÉGALE ACCORDÉ AUX CONSOMMATEURS EN VERTU DE LA LOI FRANÇAISE APPLICABLE, À ETL'EXCEPTION DES OBLIGATIONS DES PARTIES ÉNONCÉES AUX ARTICLES 5 ET 9.2 DU PRESENT ACCORD ET DES OBLIGATIONS DE PAIEMENT DU CLIENT EN VERTU DES PRESENTES, LA MESURE MAXIMALE AUTORISEE PAR LA LOI APPLICABLE , CHAQUE PARTIE ACCEPTE QUE LA RESPONSABILITE GLOBALE MAXIMALE DE L'UNE DES PARTIES ET DE SES SOCIETES AFFILIEES ENVERS L'AUTRE PARTIE ET SES SOCIETES AFFILIEES POUR TOUTE RECLAMATION DE QUELQUE NATURE QUE CE SOIT N'EXCEDE PAS CINQUANTE MILLE DOLLARS (USD 50 000), ET QUE CE RECOURS EST JUSTE ET ADEQUAT. LES LIMITATIONS ÉNONCÉES DANS LA PRÉSENTE SECTION 12 S'APPLIQUENT INDÉPENDAMMENT DU FAIT QU'UNE ACTION SOIT FONDÉE SUR UN CONTRAT, UN DÉLIT CIVIL (Y COMPRIS LA NÉGLIGENCE), UNE RESPONSABILITÉ STRICTE OU TOUTE AUTRE THÉORIE JURIDIQUE OU ÉQUITABLE".
4. Règlement des litiges. L'article 13 des conditions de service est supprimé dans son intégralité et remplacé par le texte suivant :
"13.RÈGLEMENT DES LITIGES. TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DU PRÉSENT ACCORD OU S'Y RAPPORTANT, Y COMPRIS L'ARBITRABILITÉ, QUI NE PEUT ÊTRE RÉSOLU À LA SUITE DE DISCUSSIONS DE BONNE FOI DANS LES SOIXANTE (60) JOURS SUIVANT LA NOTIFICATION D'UN LITIGE, SERA DÉFINITIVEMENT RÉGLÉ PAR VOIE D'ARBITRAGE. LE DROIT APPLICABLE EST LE DROIT MATÉRIEL DE L'ÉTAT DE NEW YORK, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET L'ARBITRAGE EST ADMINISTRÉ À NEW YORK, NEW YORK, ÉTATS-UNIS, CONFORMÉMENT AUX RÈGLES ET PROCÉDURES D'ARBITRAGE GLOBALES DU JUDICIAL ARBITRATION AND MEDIATION SERVICES, INC. ("JAMS") ET AUX RÈGLES FÉDÉRALES DE LA PREUVE (NONOBSTANT LA RÈGLE 22(D) DE JAMS OU TOUTE AUTRE RÈGLE DE JAMS CONTRAIRE). LES PARTIES CONVIENNENT DE RECOURIR À L'ARBITRAGE UNIQUEMENT SUR UNE BASE INDIVIDUELLE, ET LE PRÉSENT ACCORD N'AUTORISE PAS L'ARBITRAGE COLLECTIF NI AUCUNE RÉCLAMATION PRÉSENTÉE EN TANT QUE DEMANDEUR OU MEMBRE D'UN GROUPE DANS LE CADRE D'UNE PROCÉDURE D'ARBITRAGE COLLECTIVE, REPRÉSENTATIVE, PAGA, CONJOINTE OU REPRÉSENTATIVE. LE TRIBUNAL ARBITRAL NE PEUT PAS CONSOLIDER LES DEMANDES DE PLUS D'UNE PERSONNE ET NE PEUT PRÉSIDER AUCUNE FORME DE PROCÉDURE REPRÉSENTATIVE OU COLLECTIVE. NONOBSTANT CE QUI PRÉCÈDE, CHAQUE PARTIE A LE DROIT D'INTENTER UNE ACTION À TOUT MOMENT DEVANT UN TRIBUNAL COMPÉTENT POUR OBTENIR UNE INJONCTION PRÉLIMINAIRE DANS L'ATTENTE D'UNE DÉCISION FINALE DE L'ARBITRE OU DES ARBITRES, À CONDITION QUE (A) LA PARTIE QUI INTENTE L'ACTION DEMANDE UNE ORDONNANCE POUR DÉPOSER L'ACTION SOUS SCELLÉS (OU AU MOINS LE FAIRE POUR TOUT DÉPÔT CONTENANT DES INFORMATIONS CONFIDENTIELLES OU DES SECRETS COMMERCIAUX) AFIN DE LIMITER LA DIVULGATION COMME PRÉVU À LA SECTION 6 DU PRÉSENT ACCORD ; ET (B) UNE INJONCTION PERMANENTE ET DES DOMMAGES-INTÉRÊTS NE SERONT ACCORDÉS QUE PAR L'ARBITRE OU LES ARBITRES. SI LE CLIENT EST SITUÉ EN FRANCE, LE DROIT APPLICABLE SERA LE DROIT MATÉRIEL DE LA FRANCE, SANS TENIR COMPTE DES CONFLITS DE LOIS, ET SANS TENIR COMPTE DE LA CONVENTION DES NATIONS UNIES SUR LES CONTRATS DE VENTE INTERNATIONALE DE MARCHANDISES, ET TOUT LITIGE, CONTROVERSE OU RÉCLAMATION DÉCOULANT DE OU EN RAPPORT AVEC LE PRÉSENT ACCORD, Y COMPRIS LA VALIDITÉ, L'INVALIDITÉ, LA VIOLATION OU LA RÉSILIATION DE CELUI-CI, SERA, À LA DISCRÉTION DU CLIENT, RÉGLÉ PAR DES PROCÉDURES JUDICIAIRES AU DOMICILE DU CLIENT OU À SON LIEU DE RÉSIDENCE HABITUEL, AVEC DES PROCÉDURES MENÉES EN ANGLAIS."
5. Mises à jour de l'accord. La section 14.1 des conditions de service est supprimée dans son intégralité et remplacée par ce qui suit :
"14.1. Mises à jour de cet Accord. Palantir se réserve le droit de modifier le présent Accord à tout moment et mettra à jour le présent Accord en cas de modification. Palantir notifiera au Client les modifications apportées au présent Accord en envoyant un e-mail à l'adresse e-mail principale spécifiée dans un Formulaire de Soumission de Commande applicable ou sur le Compte du Client. Toute modification du présent Contrat entrera en vigueur soixante (60) jours après que Palantir ait fourni cette notification, à moins que le Client ne notifie à Palantir la résiliation du Contrat. Dans ce cas, la résiliation prendra effet soixante (60) jours après la notification de Palantir au Client. L'utilisation continue par le Client de la Plateforme Palantir dans les soixante (60) jours après que Palantir ait fourni l'avis susmentionné constitue un accord sur ces révisions du présent Accord. Pour toute autre modification, l'utilisation continue par le Client de la Plateforme Palantir constitue un accord avec nos révisions du présent Accord. Palantir se réserve le droit à tout moment et de temps en temps de modifier (y compris la dépréciation des fonctionnalités ou des outils), temporairement ou définitivement, la Palantir Plateforme (ou toute partie de celle-ci)".
[FRENCH] Data Protection Addendum (AIP Now)
Effective May 23rd 2025
DownloadTable of Contents
Dernière modification : mai 2024
EN SÉLECTIONNANT "J'ACCEPTE" (OU UNE OPTION ÉQUIVALENTE) LORSQUE CETTE OPTION EST DISPONIBLE, OU EN INSTALLANT, EXÉCUTANT, TÉLÉCHARGEANT, ACCÉDANT OU UTILISANT DE TOUTE AUTRE MANIÈRE TOUTE PARTIE DE LA TECHNOLOGIE PALANTIR (TELLE QUE DÉFINIE DANS L'ACCORD), VOUS CONFIRMEZ QUE VOUS ("VOUS" OU "VOTRE" OU "UTILISATEUR AUTORISÉ") AVEZ LU CE DPA, QUE VOUS COMPRENEZ LES TERMES DE CE DPA, ET QUE VOUS, EN VOTRE QUALITÉ DE PARTICULIER OU D'ENTREPRENEUR INDIVIDUEL, OU VOUS ET L'ENTITÉ QUE VOUS REPRÉSENTEZ, CONSENTEZ INCONDITIONNELLEMENT À ÊTRE LIÉ PAR CE DPA ET DEVENEZ PARTIE À CE DPA. SI VOUS CONCLUEZ LES PRESENTES CONDITIONS EN VOTRE QUALITE DE PARTICULIER OU D'ENTREPRENEUR INDIVIDUEL, VOUS DECLAREZ ET GARANTISSEZ EGALEMENT QUE VOUS N'UTILISEZ PAS LA TECHNOLOGIE PALANTIR POUR LE COMPTE OU SOUS LES INSTRUCTIONS D'UN AUTRE TIERS OU D'UNE AUTRE ENTITE JURIDIQUE. SI VOUS CONCLUEZ CE DPA AU NOM D'UNE ENTITÉ, TELLE QUE LA SOCIÉTÉ, L'ORGANISATION OU L'ÉTABLISSEMENT D'ENSEIGNEMENT POUR LEQUEL VOUS TRAVAILLEZ, VOUS DÉCLAREZ ET GARANTISSEZ QUE VOUS ÊTES AUTORISÉ À ACCEPTER LES CONDITIONS DE CE DPA AU NOM DE L'ENTITÉ EN TANT QUE REPRÉSENTANT LÉGAL AUTORISÉ. SI VOUS N'ACCEPTEZ PAS INCONDITIONNELLEMENT TOUTES LES CONDITIONS DE CE DPA, NE SÉLECTIONNEZ PAS "J'ACCEPTE" (OU L'ÉQUIVALENT) LORSQUE CETTE OPTION EST DISPONIBLE ET N'INSTALLEZ PAS, N'EXÉCUTEZ PAS, NE TÉLÉCHARGEZ PAS, N'ACCÉDEZ PAS OU N'UTILISEZ PAS DE QUELQUE MANIÈRE QUE CE SOIT TOUTE PARTIE DE LA TECHNOLOGIE PALANTIR.
L'ACCEPTATION DE PALANTIR EST EXPRESSÉMENT CONDITIONNÉE PAR VOTRE ASSENTIMENT À TOUS LES TERMES ET CONDITIONS DE CETTE DPA, À L'EXCLUSION DE TOUS LES AUTRES TERMES ; SI CES TERMES SONT CONSIDÉRÉS COMME UNE OFFRE, L'ACCEPTATION EST EXPRESSÉMENT LIMITÉE À CES TERMES.
Le client qui accepte les termes de ce DPA ("Client") et l'entité Palantir Technologies qui est le signataire de l'accord ("Palantir" ; chacun du Client et de Palantir est une "Partie" et collectivement les "Parties"), ont conclu un accord (tel que les Conditions de Service de Palantir et le Bon de Commande) régissant l'utilisation par le Client de la Technologie Palantir, y compris le Service, et la fourniture de Services Professionnels connexes au Client par Palantir, y compris toutes les pièces jointes, les bons de commande, les pièces et les annexes qui s'y rapportent (collectivement, le "Contrat"). Cette DPA complète, est incorporée et fait partie de l'Accord et établit les droits et obligations de Palantir et du Client en ce qui concerne toutes les Données Personnelles du Client traitées par Palantir au nom du Client dans le cadre de l'Accord. Tous les termes en majuscules utilisés mais non définis dans le présent DPA auront la signification prévue dans l'Accord. En cas de conflit de sens entre les dispositions de l'Accord et le présent DPA, les termes et conditions du présent DPA prévaudront et contrôleront.
1. DÉFINITIONS
1.1 Les termes en majuscules suivants auront la signification indiquée ci-dessous :
- "Pays adéquat" : un pays qui peut importer des données à caractère personnel et qui est considéré par l'autorité dirigeante du pays exportateur comme offrant un niveau adéquat de protection des données en vertu des lois sur la protection des données applicables ;
- On entend par "société affiliée" une entité qui, directement ou indirectement, possède ou contrôle une partie, ou est possédée ou contrôlée par elle, ou est sous propriété ou contrôle commun avec elle. Au sens des présentes, on entend par "contrôle" le pouvoir de diriger, directement ou indirectement, la gestion ou les affaires d'une entité et par "propriété" la propriété effective de plus de cinquante pour cent des titres de participation avec droit de vote ou d'autres intérêts avec droit de vote équivalents d'une entité. En ce qui concerne Palantir, la société affiliée comprend, sans s'y limiter, toutes les entités énumérées dans la pièce A, partie II, et toutes les autres sociétés affiliées de Palantir de temps à autre ;
- Le terme "achèvement" a la signification qui lui est donnée dans l'annexe D du présent DPA ;
- "Contrôleur" : l'entité qui détermine les finalités et les moyens du traitement des données à caractère personnel et comprend, le cas échéant, le terme "contrôleur", "entreprise" et tout autre terme similaire ou équivalent en vertu des lois sur la protection des données applicables ;
- "Données personnelles du client" : toutes les données personnelles contenues dans les données du client qui sont soumises aux lois sur la protection des données ;
- "Incident de données" : toute violation, telle que définie par les lois applicables en matière de protection des données, de la sécurité de Palantir entraînant la destruction, la perte, l'altération, la divulgation non autorisée ou l'accès accidentel ou illégal aux données personnelles du client sur les systèmes gérés ou contrôlés de quelque autre manière par Palantir ;
- "Autorité de protection des données" une autorité compétente chargée de veiller à l'application des lois pertinentes sur la protection des données, y compris, le cas échéant, toute autorité de protection des données, tout régulateur de la vie privée, toute autorité de contrôle, tout procureur général, toute agence nationale de protection de la vie privée ou tout organe ou agence gouvernemental chargé de l'application des lois sur la protection des données ;
- "Lois sur la protection des données" désigne toutes les lois et réglementations applicables, telles que modifiées de temps à autre, concernant la protection des données, la confidentialité des consommateurs, les communications électroniques et les lois sur le marketing, dans la mesure où elles s'appliquent au traitement des données personnelles du client par Palantir dans le cadre de l'accord, comme par exemple :
- Loi californienne sur la protection de la vie privée des consommateurs, Cal. Civ. Code § 1798.100 et seq. ("CCPA") ;
- Loi californienne de 2020 sur les droits à la vie privée ("CPRA") ;
- Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE ("GDPR UE") ;
- Le GDPR de l'UE tel que modifié et incorporé dans le droit britannique en vertu de la loi de 2018 sur l'Union européenne (retrait) du Royaume-Uni ("GDPR du Royaume-Uni") ; et
- La loi fédérale suisse sur la protection des données du 19 juin 1992, telle qu'elle a été remplacée et/ou mise à jour de temps à autre ("PFP").
- "Délégué à la protection des données" : la personne physique ou la société désignée, le cas échéant, en vertu des lois sur la protection des données applicables, pour garantir le respect de ces lois par une organisation et coopérer avec les autorités chargées de la protection des données ;
- La "personne concernée" est la personne identifiée ou identifiable à laquelle se rapportent les données à caractère personnel et comprend, le cas échéant, le terme "consommateur" et tout autre terme similaire ou équivalent en vertu des lois applicables en matière de protection des données
- "Date d'entrée en vigueur du DPA" : la date d'entrée en vigueur de l'accord ;
- "EEE" : Espace économique européen ;
- "Clauses contractuelles types de l'UE" : les clauses contractuelles types à utiliser pour les exportations de données à caractère personnel depuis l'EEE, approuvées par la Commission européenne en vertu de la décision d'exécution 2021/914 de la Commission, ou d'autres clauses qui les remplacent de temps à autre
- On entend par "données à caractère personnel" : (a) toute information concernant (i) une personne physique identifiée ou identifiable et/ou (ii) une entité juridique identifiée ou identifiable (lorsque cette information est protégée de la même manière que les données à caractère personnel ou les informations personnellement identifiables en vertu des lois sur la protection des données applicables), et (b) toute information traitée ou recevant un traitement similaire en tant que "données à caractère personnel", "informations à caractère personnel", "informations personnellement identifiables" ou tout autre terme similaire ou équivalent en vertu des lois sur la protection des données applicables ;
- Le "traitement" désigne toute opération ou tout ensemble d'opérations effectuées ou non à l'aide de procédés automatisés et appliquées à des données à caractère personnel, telles que la collecte, l'enregistrement, l'organisation, la structuration, la conservation, l'adaptation ou la modification, l'extraction, la consultation, l'utilisation, la divulgation par transmission, la diffusion ou toute autre forme de mise à disposition, le rapprochement ou l'interconnexion, la limitation, l'effacement ou la destruction. Les termes "traitement", "processus" et "traité" seront interprétés en conséquence ;
- Le terme "sous-traitant" désigne l'entité qui traite les données à caractère personnel pour le compte d'un contrôleur, y compris, le cas échéant, les termes "sous-traitant", "prestataire de services", "contractant" et tout terme équivalent ou similaire qui traite des mêmes responsabilités, ou de responsabilités similaires, en vertu des lois applicables en matière de protection des données, le cas échéant ;
- "Demande" : une demande émanant d'une personne concernée ou de toute personne agissant en son nom et visant à exercer ses droits en vertu des lois sur la protection des données
- "Transfert restreint" : transfert ou transfert ultérieur de données à caractère personnel à partir d'un pays où un tel transfert serait restreint ou interdit par les lois applicables en matière de protection des données (ou par les termes d'un accord de transfert de données mis en place pour traiter les restrictions de transfert de données des lois en matière de protection des données) sans mettre en œuvre des garanties telles que les clauses contractuelles types à établir en vertu de l'article 14 ci-dessous ;
- "Documentation de sécurité" : la documentation décrivant les normes de sécurité qui s'appliquent au service, telle qu'elle est fournie par Palantir ou en son nom de temps à autre ;
- "Vendre" ou "Vente" signifie vendre, louer, libérer, divulguer, diffuser, mettre à disposition, transférer ou communiquer de toute autre manière, oralement, par écrit, par voie électronique ou par d'autres moyens, les données à caractère personnel d'une personne concernée à un tiers à titre onéreux.
- Le terme "service" a la signification qui lui est donnée dans l'accord et dans le présent DPA.
- "Partager" signifie partager, louer, libérer, divulguer, diffuser, mettre à disposition, transférer ou communiquer de toute autre manière, oralement, par écrit ou par des moyens électroniques ou autres, les données à caractère personnel d'une personne concernée à un tiers à des fins de publicité comportementale inter-contexte, que ce soit ou non en échange d'une contrepartie monétaire ou d'une autre valeur, y compris les transactions dans lesquelles il n'y a pas d'échange d'argent ;
- "Sous-traitant" : tout sous-traitant ou prestataire de services qui traite des données à caractère personnel pour le compte de Palantir dans le but de fournir le service tel qu'il est défini dans l'accord, l'annexe A et toute autre annexe pertinente applicable de ce DPA.
- "Clauses contractuelles types" ou "CCS" signifie soit (a) les clauses types de protection des données approuvées conformément aux lois sur la protection des données du pays exportateur concerné pour légitimer les exportations de données à caractère personnel à partir de ce pays, soit (b) lorsque le pays exportateur concerné dispose de lois sur la protection des données qui réglementent l'exportation de données à caractère personnel mais pas de clauses types de protection des données approuvées, les CCAP de l'UE s'appliquent - dans chaque cas en incorporant les compléments appropriés, et lorsque plusieurs formes de ces clauses approuvées existent pour un pays donné, les clauses qui s'appliquent sont les suivantes : (i) pour toute situation où le client agit en tant que contrôleur des données personnelles du client, la forme de clauses s'appliquant aux transferts entre contrôleurs et sous-traitants ; et (ii) pour toute situation où le client agit en tant que sous-traitant des données personnelles du client, la forme de clauses s'appliquant aux transferts entre sous-traitants pour toute situation où le client agit en tant que sous-traitant des données personnelles du client, la forme de clauses s'appliquant aux transferts entre sous-traitants
- "Mesures techniques et organisationnelles" : les mesures techniques et organisationnelles convenues par les parties dans l'accord et toutes les mesures techniques et organisationnelles supplémentaires mises en œuvre par Palantir conformément à ses obligations en vertu des lois sur la protection des données applicables
2. DURÉE
2.1 Le présent DPA prendra effet à la date d'entrée en vigueur du DPA et restera en vigueur jusqu'à la destruction ou la restitution de toutes les données personnelles du client par Palantir conformément à l'accord, date à laquelle il sera automatiquement résilié.
3. CHAMP D'APPLICATION
3.1 Le présent DPA est incorporé à l'Accord et en fait partie, et établit les droits et obligations de Palantir et du Client en ce qui concerne les Données Personnelles du Client traitées par Palantir pour le compte du Client dans le cadre de la fourniture du Service. En cas de conflit de sens entre les dispositions de de l'Accord et le présent DPA, les dispositions du présent DPA prévaudront et contrôleront.
4. RÔLE DES PARTIES
4.1 Le Client et tout Affilié du Client concerné, nomme et donne des instructions à Palantir en tant que Processeur, ou Sous-Traitant selon le cas, des Données Personnelles du Client. En conséquence, les Parties doivent se conformer aux Lois sur la protection des données applicables en fonction de leur traitement respectif des Données personnelles du Client dans le cadre de l'Accord.
4.2 Entre les parties, le client est responsable en tant que contrôleur (ou sous-traitant, si le client traite des données personnelles avec le service pour un contrôleur tiers) et Palantir est responsable en tant que sous-traitant (ou soustraitant), en ce qui concerne les données personnelles du client traitées dans le cadre de l'accord.
4.3 Dans le cas où le Client agit en tant que Processeur (ou Sous-Traitant) en ce qui concerne les Données Personnelles du Client, le Client déclare et garantit à Palantir qu'il est valablement autorisé par le Contrôleur concerné à conclure l'Accord et le présent DPA et à fournir des Instructions du Client (telles que définies ci-dessous) au nom du Contrôleur en ce qui concerne les Données Personnelles du Client.
4.4 Dans le cas où le Client est un employé de Palantir ou d'une société affiliée de Palantir, le Client reconnaît qu'il n'agit pas au nom de Palantir ou d'une société affiliée de Palantir et qu'il agit en tant que contrôleur séparé et indépendant en ce qui concerne le traitement des données personnelles du Client par le biais de la technologie Palantir.
4.5 Dans le cas où le Client contrôle conjointement les Données Personnelles du Client avec un Contrôleur tiers, le Client déclare et garantit que son Traitement des Données Personnelles du Client en relation avec son utilisation de la Technologie Palantir est dûment autorisé par ce Contrôleur tiers et est effectué en conformité avec les Lois de Protection des Données applicables.
4.6 Dans le cas où le Client introduit un nouvel Utilisateur à la Technologie Palantir (que cet Utilisateur agisse pour son propre compte ou pour le compte d'un tiers), le Client doit s'assurer que cet Utilisateur conclut un accord séparé directement avec Palantir en relation avec cette utilisation (y compris toutes les Conditions de Service Palantir applicables et toutes les DPA associées) et reconnaît que l'utilisation de la Technologie Palantir par cet Utilisateur sera conditionnée par cette utilisation.
4.7 L'objet et les détails du traitement sont décrits dans le contrat et dans la présente DPA, y compris dans l'annexe B (objet et détails du traitement des données à caractère personnel du client) et dans toute autre annexe pertinente pour les services supplémentaires applicables.
4.8 Palantir traitera les invites et les sorties en tant que données d'utilisation, comme décrit plus en détail dans l'accord et la politique de confidentialité de l'AIP Now, afin de sécuriser le service, y compris la surveillance des abus ou des activités malveillantes de l'utilisateur.
5. TRAITEMENT DES DONNÉES PERSONNELLES PAR LES CLIENTS
5.1 Le Client s'assurera que tout Traitement des Données Personnelles du Client via l'utilisation du Service par le Client, y compris toutes les instructions fournies à Palantir en relation avec ce Traitement, sera conforme à toutes les Lois de Protection des Données applicables.
5.2 Le Client donne instruction à Palantir de traiter les Données Personnelles du Client : (a) pour fournir le Service spécifié dans le Contrat et la Documentation ou pour exécuter ses obligations en vertu de ceux-ci ; (b) tel qu'initié par le Client via l'utilisation du Service par le Client ou les Utilisateurs conformément au Contrat et à la Documentation ; et/ou (c) conformément à toute instruction supplémentaire en dehors du champ d'application du Contrat ou du présent DPA, tel que documenté dans toute autre instruction écrite donnée par le Client et reconnue par Palantir par écrit comme constituant des instructions aux fins du présent DPA (collectivement, les "Instructions du Client"). Le Client reconnaît que toute instruction supplémentaire du Client émise en vertu du point (c) ci-dessus peut entraîner des charges ou des frais supplémentaires pour le Client de la part de Palantir, qui seront payables conformément aux termes de l'Accord.
5.3 Le client est seul responsable du traitement légal des données personnelles du client dans le cadre de son utilisation de la technologie Palantir et/ou de sa réception de tout service professionnel connexe conformément aux lois sur la protection des données applicables, y compris, sans limitation, l'exactitude, la qualité et la légalité des données personnelles du client, les moyens par lesquels il acquiert et utilise les données personnelles du client, et les instructions du client concernant le traitement des données personnelles du client. Le Client déclare et garantit qu'il dispose (ou que son contrôleur dispose) d'une base juridique valable pour le traitement des données personnelles du Client et qu'il a (ou que son contrôleur a) fourni (ou fait fournir) toutes les notifications et obtenu (ou fait fournir) tous les consentements (y compris les consentements), autorisations, approbations et/ou accords (y compris, lorsque le Client est un sous-traitant ou un soustraitant, avec et de la part du (des) contrôleur(s) applicable(s)) requis en vertu des lois ou politiques applicables afin de permettre à Palantir de recevoir et de traiter les données personnelles du Client conformément à la présente DPA, à l'Accord et aux instructions du Client.
5.4 Il incombe au client de fournir des conseils aux utilisateurs concernant l'utilisation des services et, en particulier, l'utilisation des données à caractère personnel dans le cadre des services.
5.5 Les données personnelles du client ne comprennent pas
5.5.1 les identifiants liés au gouvernement (selon la définition de ce terme dans les lois applicables sur la protection des données), dans la mesure où le traitement de ces identifiants liés au gouvernement n'est pas autorisé par les lois applicables sur la protection des données ;
5.5.2 les données à caractère personnel relatives aux enfants (conformément à l'âge de la majorité dans les juridictions applicables), sauf si cela est autorisé par les lois sur la protection des données applicables ou si cela est conforme à ces lois ; ou
5.5.3 les données à caractère personnel qui sont sous le contrôle d'un autre responsable du traitement, sans son autorisation expresse.
6. TRAITEMENT DES DONNÉES PERSONNELLES DES CLIENTS PAR PALANTIR
6.1 Palantir traitera les Données Personnelles du Client dans le but de fournir au Client les services, à savoir la Technologie Palantir et les Services Professionnels conformément aux Instructions du Client et tout autre but pour lequel le Client fournit une autorisation via le Service, lorsque cette option est disponible ("Fins Professionnelles"), conformément aux termes de l'Accord et de ce DPA ainsi que toutes les exigences établies par les Lois de Protection des Données applicables. Pour éviter tout doute, le Client divulgue les Données Personnelles du Client à Palantir uniquement pour les Finalités Commerciales limitées et spécifiées énoncées dans l'Accord et les Instructions du Client. Palantir traitera les Données Personnelles du Client conformément aux instructions du Client et devra :
(a) désigner et maintenir un délégué à la protection des données, comme l'exigent les lois sur la protection des données, qui peut être contacté à l'adresse suivante :privacy@palantir.com ;
(b) ne pas vendre ou partager les données personnelles des clients ou conserver, utiliser, divulguer ou traiter les données personnelles des clients en dehors de la relation commerciale directe entre les parties ou à des fins autres que la réalisation des objectifs commerciaux conformément aux instructions du client, sauf si la loi ou la réglementation applicable ou les demandes ou ordonnances d'entités judiciaires, gouvernementales ou réglementaires (y compris, sans s'y limiter, les citations à comparaître) l'y obligent, auquel cas Palantir informera le client de cette obligation légale avant que le traitement n'ait lieu, sauf si la loi l'en empêche ;
(c) ne pas combiner les données personnelles des clients avec les données personnelles qu'elle reçoit d'autres sources ou qu'elle recueille lors de ses propres interactions avec une personne concernée, à condition que Palantir puisse combiner les données personnelles des clients si nécessaire pour atteindre ses objectifs commerciaux et qu'elle ne vende ni ne partage les données personnelles des clients ;
(d) mettre en œuvre des mesures techniques et organisationnelles appropriées pour protéger la confidentialité, l'intégrité, la disponibilité et la résilience des systèmes de Palantir traitant les données personnelles des clients. Palantir peut mettre à jour les mesures techniques et organisationnelles de temps à autre, à condition que ces mises à jour ne soient pas moins protectrices que les mesures techniques et organisationnelles d'origine. Dans la mesure où cette assistance exige que Palantir prenne des mesures supplémentaires au-delà de celles imposées à Palantir par les Lois sur la protection des données ou spécifiquement requises en vertu de l'Accord ; ou dans la mesure où les mesures techniques et organisationnelles pertinentes sont requises à la suite d'un acte ou d'une omission du Client ou d'une Partie agissant au nom du Client en violation du présent Contrat ou des Lois sur la protection des données, l'obligation de Palantir de fournir cette assistance sera soumise au paiement par le Client des frais raisonnables de Palantir en ce qui concerne cette assistance supplémentaire ; Les obligations de sécurité de Palantir en vertu du présent DPA s'appliquent sans préjudice des propres obligations de sécurité du Client en vertu des Lois sur la protection des données en vigueur ;
(e) s'assurer que toutes les personnes autorisées par Palantir à traiter les données personnelles du client, y compris les sous-traitants (tels que définis ci-dessous), sont liées par des obligations de confidentialité compatibles avec celles énoncées dans le présent DPA, l'accord ou autrement suffisantes pour répondre aux exigences des lois sur la protection des données ;
(f) prendre des mesures raisonnables pour renvoyer ou détruire les données à caractère personnel du client lorsqu'elles ne sont plus nécessaires aux fins de l'exécution des services concernés à la fin de l'accord, à moins que le stockage ne soit autrement requis en vertu des lois applicables en matière de protection des données ; et
(g) traiter les données à caractère personnel du client d'une manière compatible avec le même niveau de protection de la vie privée que celui exigé du client en vertu des lois applicables en matière de protection des données.
6.2 Le client donnera des instructions à Palantir sur l'objet et la durée du traitement, la nature et la finalité du traitement, le type de données à caractère personnel et les catégories de personnes concernées, en tenant compte des tâches et responsabilités spécifiques du sous-traitant dans le contexte du traitement à effectuer et du risque pour les droits et libertés de la personne concernée, dans le cadre des instructions du client. Nonobstant toute disposition contraire dans les présentes, le Client s'assurera que ses actes ou omissions, y compris en ce qui concerne les Instructions du Client à Palantir, ne mettent pas Palantir en infraction avec les Lois sur la Protection des Données.
6.3 Le Client a évalué le niveau de sécurité approprié au Traitement dans le contexte de ses obligations en vertu des Lois sur la Protection des Données et accepte que les Mesures Techniques et Organisationnelles soient cohérentes avec cette évaluation. Le Client reconnaît en outre que Palantir n'est pas en mesure d'évaluer, et n'a pas connaissance, des Données Personnelles spécifiques fournies par le Client à Palantir ou mises à la disposition de Palantir par le Client en relation avec les Services et que, par conséquent, les Mesures Techniques et Organisationnelles proposées par Palantir sont de nature générique et que Palantir n'est pas en mesure d'évaluer si elles reflètent ou non les risques particuliers posés par les Données Personnelles.
7. SOUS-PROCESSEURS
7.1 Le Client autorise spécifiquement l'engagement en tant que Sous-Traitants (a) entités énumérées dans l'Annexe A et/ou dans les annexes de Services supplémentaires spécifiques applicables dans le présent DPA et (b) de toutes les Sociétés Affiliées de Palantir de temps à autre, à condition que, avant d'autoriser ces Sous-Traitants à Traiter les Données Personnelles du Client, Palantir conclue un accord écrit avec le Sous-Traitant imposant des conditions qui sont cohérentes avec celles énoncées dans le présent DPA ou autrement suffisantes pour répondre aux exigences des Lois sur la Protection des Données.
7.2 Sous réserve de la section 7.3, le client autorise généralement Palantir à engager des sous-traitants supplémentaires ("sous-traitants supplémentaires"), à condition que, avant d'autoriser un tel sous-traitant supplémentaire à traiter les données personnelles du client, Palantir conclue un accord écrit avec le sous-traitant supplémentaire imposant des conditions qui sont compatibles avec celles énoncées dans le présent DPA ou autrement suffisantes pour répondre aux exigences des lois sur la protection des données.
7.3 Au moins 30 jours avant que Palantir ne commence à utiliser un Sous-Traitant supplémentaire dans le cadre de la fourniture de Services au Client, la liste mise à jour des Sous-Traitants pour le Service sera disponible dans la Pièce A, également disponible ci-dessous, et Palantir fournira au Client un mécanisme pour obtenir la notification de cette mise à jour. Les parties conviennent que cette notification satisfait aux exigences de notification de la section 28.2 du GDPR et de la clause 9 du SCC. Lorsque le Client indique par écrit qu'il s'oppose au Traitement des Données Personnelles du Client par un tel Sous-Traitant additionnel , les Parties chercheront à résoudre les préoccupations du Client et, si nécessaire, le Client peut exercer ses droits applicables pour résilier l'Accord
7.4 Dans la mesure requise par la loi sur la protection des données, Palantir restera responsable envers le client de l'exécution des obligations du Sous-Traitant en relation avec le présent article 7 ("Responsabilité du Sous-Traitant en matière de protection des données"), et Palantir sera autorisé à ré-exécuter ou à faire ré-exécuter ces obligations, et le client reconnaît que cette ré-exécution diminuera toute réclamation que le client a contre Palantir en ce qui concerne toute responsabilité du Sous-Traitant en matière de protection des données.
8. AUDIT
8.1 Palantir fait appel à des auditeurs tiers pour vérifier l'adéquation de ses mesures de sécurité. Cet audit est réalisé au moins une fois par an, par des auditeurs tiers indépendants et réputés, à la sélection et aux frais de Palantir, et conformément à Service Organization Controls 2 (SOC2) ou à des normes industrielles substantiellement équivalentes, et aboutit à la génération d'un rapport d'audit ("Rapport") qui sera l'Information Confidentielle de Palantir. Le service et les opérations sont également certifiés conformes aux normes et aux accréditations énoncées dans l'onglet "conformité et accréditation" à l'adresse suivante : https://www.palantir.com/information-security/ ("Accréditations").
8.2 A la demande écrite du client, Palantir fournira au client un résumé confidentiel du rapport, la documentation prouvant la conformité avec les accréditations, et les informations de responsabilité décrites dans la section 10 de ce DPA afin que le client puisse raisonnablement vérifier la conformité de Palantir avec les obligations de sécurité des données et de protection des données en vertu de ce DPA. Sous réserve de l'article 8.3, si les lois sur la protection des données, les clauses contractuelles types ou le contrat exigent que Palantir fournisse au client l'accès aux installations ou aux informations de Palantir en plus du rapport et des informations de responsabilité, Palantir autorisera le client à vérifier le respect par Palantir des conditions générales du présent DPA tel qu'il s'applique aux données personnelles du client, dans la mesure expressément requise par le contrat, les clauses contractuelles types ou les lois sur la protection des données.
8.3 Afin de demander un audit des installations de Palantir en vertu du présent article 8 (et lorsqu'un tel audit est autorisé en vertu de l'article 8.2), le client doit notifier Palantir et les parties doivent convenir, dès que cela est raisonnablement possible mais toujours à l'avance, des dates raisonnables, de la durée et de la portée de l'audit, de l'identité et des qualifications de l'auditeur, et de tous les contrôles de sécurité et de confidentialité requis pour l'accès aux informations ou aux processus dans le cadre de cet audit. Palantir peut refuser la demande ou refuser suivre toute instruction demandée par le client concernant les audits. Dans la mesure où Palantir refuse une demande d'audit et que cet audit est sans ambiguïté requis en vertu des lois sur la protection des données applicables ou du DPA, le client a le droit de résilier l'accord conformément à l'accord. Le client supportera les coûts raisonnables de Palantir pour satisfaire aux exigences de la présente section. La portée de tout audit en vertu de la présente Section 8 sera limitée aux systèmes et installations de Palantir utilisés pour traiter les Données Personnelles du Client et la Documentation directement liée à ce Traitement.
8.4 Toutes les informations fournies ou mises à la disposition du Client, de son auditeur ou de tout autre tiers autorisé en vertu du présent DPA à avoir accès aux informations susmentionnées conformément à la présente section 8 seront des informations confidentielles de Palantir.
8.5 En cas de non-conformité matérielle confirmée de Palantir aux conditions du présent DPA, le client peut prendre des mesures raisonnables pour y remédier, y compris, sans s'y limiter, en exigeant la suspension de tout traitement des données à caractère personnel du client jusqu'à ce que le client détermine que la non-conformité a été corrigée. Dans le cas où Palantir détermine qu'elle ne peut plus respecter ses obligations en vertu du présent DPA, Palantir en informera rapidement le client.
9. RELATIONS AVEC LES AUTORITÉS DE PROTECTION DES DONNÉES ET ÉVALUATIONS DE L'IMPACT DE LA PROTECTION DES DONNÉES
9.1 Palantir coopérera, sur demande raisonnable et aux frais du client, avec toute autorité de protection des données dans l'exécution de ses tâches, en tenant compte de la nature du traitement par Palantir et des informations dont elle dispose.
9.2 Compte tenu de la nature du Service et des informations dont dispose Palantir, Palantir aidera le Client à se conformer aux obligations du Client en ce qui concerne les évaluations d'impact sur la protection des données (y compris une "évaluation des risques", une "évaluation de l'impact sur la vie privée", une "évaluation de la protection des données" ou toute documentation équivalente) et la consultation préalable ou la soumission obligatoire à une Autorité de protection des données, le cas échéant, en vertu des Lois sur la protection des données, en fournissant le Rapport, les Informations sur la responsabilité et la Documentation.
10. RESPONSABILITÉ
Dans la mesure où les lois sur la protection des données l'exigent, Palantir tiendra des registres électroniques de toutes les catégories d'activités de traitement effectuées pour le compte du client, contenant :
(a) le nom et les coordonnées des sous-traitants et des sous-traitants secondaires ;
(b) les détails des types de traitement effectués ;
(c) les détails de tout transfert de données personnelles du client vers un territoire ou une organisation internationale en dehors de l'EEE ou du Royaume-Uni, et la documentation des garanties appropriées (le cas échéant) ; et
(d) une description générale des mesures de sécurité techniques et organisationnelles utilisées dans le cadre du traitement,
ensemble, les "informations sur la responsabilité".
11. DROITS DE LA PERSONNE CONCERNÉE
11.1 En ce qui concerne les données personnelles du client, lorsque Palantir reçoit directement une demande d'une personne concernée, ou de toute personne autorisée à agir en son nom, toute réclamation ou plainte relative à ses droits en vertu des lois sur la protection des données, et à condition que Palantir puisse raisonnablement identifier, à partir des informations fournies, que la demande, la réclamation ou la plainte concerne le client et les données personnelles du client, alors, sauf interdiction par la loi applicable, Palantir transmettra la demande, la réclamation ou la plainte au client.
11.2 Le Service fournit au Client des contrôles, y compris des caractéristiques et des fonctionnalités de sécurité, que le Client peut utiliser pour récupérer, corriger, supprimer ou restreindre les Données Personnelles du Client . Le Client peut utiliser ces contrôles comme mesures techniques et organisationnelles pour se conformer à ses obligations en vertu des Lois sur la protection des données, pour répondre aux demandes des personnes concernées.
12. DATA INCIDENT
12.1 Palantir notifiera le Client dans un délai raisonnable après avoir pris connaissance (ou si les Lois sur la protection des données applicables l'exigent) avoir des motifs raisonnables de croire qu'il y a eu un Incident de données et fournira au Client toute information devant être incluse en vertu des Lois sur la protection des données applicables. Pour éviter toute ambiguïté, un Incident de Données n'inclura pas les actes ou omissions qui n'enfreignent pas la sécurité de Palantir ou la sécurité de tout Sous-Traitant ; les scans de ports, les tests de pénétration autorisés, et les attaques par déni de service ; ou tout accès ou traitement des Données Personnelles du Client qui est cohérent avec les Instructions du Client. La notification ou la réponse de Palantir à un Incident de Données conformément à la présente Section 12.1. ne sera pas interprétée comme une reconnaissance par Palantir de toute faute ou responsabilité en ce qui concerne l'Incident de Données.
12.2 Palantir fournira au Client une coopération et une assistance raisonnables dans le traitement d'un Incident de Données, en particulier en ce qui concerne (a) la prise de mesures commercialement raisonnables pour résoudre tout problème de confidentialité ou de sécurité des données impliquant des Données Personnelles du Client ; et (b) la fourniture au Client de l'assistance nécessaire et demandée pour permettre au Client de faire toutes les notifications appropriées aux individus affectés par l'Incident de Données ou à une Autorité de Surveillance dans la mesure du possible ; à condition que le Client maintienne et suive une politique efficace de réponse aux incidents cybernétiques, qui inclura l'utilisation du privilège professionnel légal, de litige ou de client-avocat, travaille de bonne foi avec Palantir en relation avec l'Incident de Données, ou, dans le cas où le Client agit en tant que particulier ou commerçant unique, à condition que le Client maintienne et suive des réponses efficaces et nécessaires à l'incident et des mesures d'atténuation raisonnablement attendues de tout particulier ou commerçant unique et convienne avec Palantir de la forme et de la méthode de toute annonce publique en relation avec l'Incident de Données.
12.3 Toute information fournie par Palantir en vertu de la présente section 12 sera l'information confidentielle de Palantir et la notification ou la réponse de Palantir à un incident de données en vertu de la présente section 12 ne sera pas interprétée comme une reconnaissance par Palantir ou, le cas échéant, par ses sous-traitants, de toute faute ou responsabilité en ce qui concerne l'exécution de tout service ou de tout service professionnel (selon le cas).
13. TRAINS DE DONNÉES
13.1 Palantir peut traiter des données à caractère personnel dans des pays autres que le pays dans lequel le client est établi et dans lequel Palantir ou ses sous-traitants disposent d'installations, d'employés ou d'infrastructures.
13.2 Lorsque le traitement des données personnelles du client dans le cadre de la fourniture du service implique un transfert restreint de données personnelles du client par ou pour le compte du client, à partir d'pays qui impose des restrictions sur le transfert de données personnelles vers des pays qui ne sont pas considérés comme des pays adéquats, alors :
(a) Les parties concluent par la présente un ensemble de CCAP. Les CCAP applicables et les compléments requis, le cas échéant, indiqués dans l'annexe D, sont par les présentes réputés incorporés dans le présent DPA et s'appliquent entre le client (en tant qu'exportateur) et Palantir (en tant qu'importateur)
(b) Palantir fournira des garanties appropriées, répondant aux exigences des CSC en ce qui concerne les transferts ultérieurs, en relation avec les transferts de données à caractère personnel entre les sociétés affiliées de Palantir dans le but de fournir des services ; et
(c) Palantir veillera à ce que tout transfert de données à caractère personnel des clients entre Palantir et tout sous-traitant tiers de Palantir soit soumis à des conditions contractuelles entre Palantir et le sous-traitant tiers concerné, prévoyant des garanties appropriées et contenant des clauses équivalentes aux CSC.
13.3 Aucune disposition du présent DPA ou du contrat ne modifie les droits ou obligations de Palantir ou du client en vertu des clauses contractuelles types.
14. RESPONSABILITÉ
14.1 Sous réserve du paragraphe 14.2, la responsabilité totale combinée de l'une des parties et de ses sociétés affiliées à l'égard de l'autre partie et de ses sociétés affiliées en vertu de l'accord et des clauses contractuelles types combinées ou en relation avec ceux-ci sera le plafond de responsabilité, et sous réserve des limitations de responsabilité, fixé dans l'accord pour la partie concernée.
14.2 Aucune disposition du présent DPA n'a pour effet de modifier, d'écarter ou d'amender les conditions de l'accord relatives à la responsabilité, y compris, mais sans s'y limiter, les exclusions et/ou les limitations de responsabilité.
14.3 Le Client s'assurera que toutes les Données du Client qu'il télécharge dans cadre de la fourniture du Service sont exactes et conformes à toutes les lois applicables. Le Client défendra et indemnisera Palantir pour tous les dommages, responsabilités, pénalités, amendes et dépenses (y compris de la part de tiers) résultant du manquement du Client à se conformer à la présente disposition ou à toutes les lois applicables en relation avec les Données du Client.
15. DROIT APPLICABLE ET JURIDICTION
15.1 Les parties modifient les termes du présent DPA dans les meilleurs délais si cette modification est nécessaire pour que les parties se conforment aux lois sur la protection des données, ou pour mettre en œuvre ou respecter les clauses contractuelles types ou tout autre mécanisme de conformité autorisé en vertu des lois sur la protection des données.
15.2 Le présent DPA, ainsi que tout litige ou réclamation (y compris tout litige ou réclamation non contractuel) découlant de ou en rapport avec lui, ou son objet ou sa formation, sera régi et interprété conformément aux lois qui régissent l'accord. Si, en vertu des lois sur la protection des données ou d'autres lois applicables, le présent DPA doit être régi par (a) les lois d'un État membre de l'Union européenne (et s'il ne l'est pas déjà), le présent DPA sera régi et interprété conformément aux lois de l'Irlande ; (b) les lois du Royaume-Uni, ce DPA sera régi et interprété conformément aux lois de l'Angleterre et du Pays de Galles, et/ou (c) les lois de toute autre juridiction, ce DPA sera régi et interprété conformément aux lois de cette juridiction, mais uniquement dans la mesure où cela est nécessaire pour satisfaire à ces lois.
15.3 Les parties conviennent irrévocablement que le forum défini dans l'accord aura la compétence exclusive pour régler tout litige pouvant résulter de ou en rapport avec le présent DPA et les documents à conclure en vertu de celui-ci et que, par conséquent, toute procédure résultant de ou en rapport avec le présent DPA sera intentée dans ce forum, toute procédure découlant du présent DPA ou en rapport avec celui-ci doit être engagée devant cette juridiction, sauf si une disposition impérative de la loi sur la protection des données ou d'autres lois applicables exige que les litiges découlant du présent DPA ou en rapport avec celui-ci et tout document devant être conclu en vertu de celui-ci soient entendus (a) dans un État membre de l'Union européenne, ces litiges devant alors être entendus en Irlande ; (b) au Royaume-Uni, ces litiges seront entendus en Angleterre et au Pays de Galles ; et/ou (c) dans tout autre forum, ces litiges seront entendus dans ce forum, dans la mesure où la loi le permet. Chacune des parties se soumet irrévocablement à la juridiction de ce forum et renonce à toute objection à une procédure dans un tel forum pour des raisons de lieu ou au motif que la procédure a été engagée dans un forum inapproprié.
16. CONDITIONS GÉNÉRALES
16.1 Si une disposition de ce DPA est invalide ou inapplicable, le reste du DPA reste valide et en vigueur. La disposition invalide ou inapplicable sera soit (i) modifiée si nécessaire pour assurer sa validité et son applicabilité, tout en préservant au mieux l'intention des parties, soit, si cela n'est pas possible, (ii) interprétée comme si la partie invalide ou inapplicable n'avait jamais été contenue dans le DPA.
16.2 Palantir peut notifier au client par écrit, de temps à autre, toute modification du présent DPA, y compris en ce qui concerne les transferts transfrontaliers, qui sont nécessaires à la suite d'un changement dans les lois sur la protection des données. Toute modification requise prendra effet à la date tombant 25 jours ouvrables après la date d'envoi de cette notification écrite par Palantir au client.
Pièce A
Liste des sous-traitants agréés
PARTIE I - Sous-traitants
Pour exécuter ses obligations en vertu des Conditions de service de Palantir et de l'Accord de protection des données de Palantir (ou de l'accord écrit alternatif entre le Client et Palantir, le cas échéant), Palantir Technologies Inc. et ses Affiliés peuvent utiliser des processeurs de données tiers ("Sous-traitants tiers") et des Affiliés de Palantir pour traiter les Données personnelles du Client. Les termes en majuscules utilisés mais non définis ici ont la signification prévue dans l'Accord.
Les tiers suivants sont spécifiquement autorisés par le client à effectuer des travaux en tant que sous-traitants tiers aux fins de l'accord.
| Sous-traitants tiers autorisés | ||||
| Sous-processeur | Objectif | Adresse du siège social | Localisation | Mécanisme de transfert |
| Amazon Web Services, Inc. | Hébergement et infrastructure en nuage, services d'alerte et de notification cryptée et services d'IA | 410 Terry Avenue North, Seattle, WA 98109, USA | Tel que sélectionné par le client dans le bon de commande ou, le cas échéant, dans d'autres parties du contrat. | Clauses contractuelles types |
| Microsoft Corporation | Hébergement et infrastructure en nuage, et services d'IA (Microsoft Azure) | One Microsoft Way Redmond, WA 98052, États-Unis | Le lieu de fourniture du service d'hébergement en nuage est celui choisi par le client dans le formulaire de commande ou, le cas échéant, dans d'autres parties du contrat. Le lieu de fourniture des services d'intelligence artificielle est l'est des États-Unis, le centre-sud des États-Unis, l'ouest de l'Europe et d'autres régions Azure au fur et à mesure de leur disponibilité. | Clauses contractuelles types |
| Google LLC | Hébergement et infrastructure cloud (Google Cloud Platform) et services d'intelligence artificielle. | 1600 Amphitheatre Parkway Mountain View, 94043 CA, USA | Le lieu de fourniture du service d'hébergement en nuage est celui choisi par le client dans le formulaire de commande ou, le cas échéant, dans d'autres parties du contrat. Le lieu de fourniture des services d'IA est l'ensemble des régions disponibles pour les fonctionnalités d'IA générative sur Google Vertex AI et d'autres régions au fur et à mesure de leur disponibilité. | Clauses contractuelles types |
| Proofpoint, Inc. | Service d'alerte et de notification cryptée. | 892 Ross Drive, Sunnyvale, CA 94089, USA | Tel que sélectionné par le client dans le bon de commande ou, le cas échéant, dans d'autres parties du contrat. | Clauses contractuelles types |
| Microsoft Corporation | Authentification de l'utilisateur en tant que fournisseur d'identité (lorsque le client l'a choisi comme fournisseur d'identité). | One Microsoft Way Redmond, WA 98052, États-Unis | États-Unis | Clauses contractuelles types |
| OpenAI LLC | Services d'IA | 3180 18th Street, San Francisco, CA 94110, USA | Le lieu de prestation du service d'IA peut être les États-Unis et d'autres régions en fonction des disponibilités. | Clauses contractuelles types |
| Oracle America, Inc. | Hébergement et infrastructure en nuage. | 500 Oracle Parkway, Redwood Shores, CA 94065 | Tel que sélectionné par le client dans le bon de commande ou, le cas échéant, dans d'autres parties de l'accord. | Clauses contractuelles types |
PARTIE II - Sociétés affiliées à Palantir
A condition qu'un niveau adéquat de protection des données conforme aux Lois sur la protection des données et au présent Accord soit assuré par Palantir, le Client autorise spécifiquement les Affiliés de Palantir, tels que listés ici et mis à jour de temps à autre, à agir en tant que Sous-Traitant(s) de Palantir, y compris en traitant les Données Personnelles du Client aux fins de l'Accord pour la fourniture du Service et/ou des Services Professionnels au Client. Le cas échéant, Palantir et son affilié respectif ont conclu les Clauses Contractuelles Standard. Ce traitement, le cas échéant, se fera sous le contrôle et la direction de Palantir et se fera sur des systèmes gérés ou autrement contrôlés par Palantir.
EXPOSÉ B
Objet et détails du traitement des données à caractère personnel des clients
Palantir Privacy Contact
Catégories de personnes dont les données à caractère personnel peuvent faire l'objet d'un traitement
Les personnes concernées comprennent les individus au sujet desquels des données personnelles sont fournies à Palantir via le service (le cas échéant) ou autrement par (ou selon les instructions) le client ou les utilisateurs du client.
Catégories de données personnelles des clients
Les Données Personnelles du Client fournies à Palantir pour le Traitement (y compris via le Service) par ou à la demande du Client ou des Utilisateurs du Client
Objet du traitement
la fourniture par Palantir du service et des services professionnels et l'exécution de ses obligations au titre de l'accord.
Nature et finalité du traitement
Palantir traitera les données personnelles du client conformément aux conditions de ce DPA dans le but de fournir le service et les services professionnels au client, ou comme l'exige par ailleurs la loi applicable.
Durée du traitement
Continu pour la durée de l'Accord, plus la période à partir de l'expiration de l'Accord jusqu'à la restitution ou la suppression de toutes les Données Personnelles du Client par Palantir conformément à l'Accord (y compris le présent DPA), aux Instructions du Client et à la loi applicable.
Objet, nature et durée du traitement par les sous-traitants ultérieurs
Comme indiqué dans l'annexe A. La durée de la sous-transformation est celle indiquée ci-dessus.
PIÈCE C - APOLLO SERVICES
Le terme en majuscule suivant aura la signification indiquée ci-dessous :
"Services Apollo" désigne le Service spécifique sélectionné par le Client dans le Bon de commande pour une solution SaaS de déploiement continu de bout en bout, permettant aux Utilisateurs de gérer de manière centralisée plusieurs versions de la Technologie Palantir dans des environnements indépendants et tel que décrit exclusivement dans la présente Annexe C pour les Services Apollo, à l'exclusion de l'application de l'Annexe A et de l'Annexe B du présent DPA ;
EXPOSÉ C-1
Liste des sous-traitants agréés
PARTIE I - Sous-traitants
Les tiers suivants sont spécifiquement autorisés par le client à effectuer des travaux en tant que sous-traitants tiers afin de fournir les services Apollo au client dans le cadre du contrat.
| Sous-traitants tiers autorisés | ||||
| Sous-processeur | Objectif | Adresse du siège social | Localisation | Mécanisme de transfert |
| Amazon Web Services, Inc. | Hébergement et infrastructure en nuage, services d'alerte et de notification cryptée | 410 Terry Avenue North, Seattle, WA 98109, USA | Tel que sélectionné par le client dans le bon de commande ou, le cas échéant, dans d'autres parties de l'accord. | Clauses contractuelles types |
| Microsoft Corporation | Authentification de l'utilisateur en tant que fournisseur d'identité (lorsque le client l'a choisi comme fournisseur d'identité). | One Microsoft Way Redmond, WA 98052, États-Unis | États-Unis | Clauses contractuelles types |
PARTIE II - Sociétés affiliées à Palantir
Comme décrit dans la "PARTIE II - Sociétés affiliées à Palantir" de l'annexe A.
PIÈCE C-2
Objet et détails du traitement des données à caractère personnel des clients
Les dispositions suivantes s'appliquent à la fourniture des services d'Apollo :
Catégories de personnes dont les données à caractère personnel peuvent faire l'objet d'un traitement
Les Personnes concernées comprennent les individus au sujet desquels des Données à caractère personnel sont fournies à Palantir par l'intermédiaire du Service Apollo ou d'une autre manière par (ou selon les instructions de) le Client ou les Utilisateurs du Client.
Catégories de données personnelles des clients
Les Données Personnelles du Client fournies à Palantir pour le Traitement via le Service Apollo par ou à la demande du Client ou des Utilisateurs du Client. Les catégories de Données à caractère personnel du Client comprennent les détails d'identification des Utilisateurs : nom, adresses, adresses électroniques et identifiants.
Objet du traitement
la fourniture par Palantir du service Apollo en vertu de l'accord.
Nature et finalité du traitement
Palantir traitera les Données à caractère personnel du Client détaillées ci-dessus conformément aux conditions du présent DPA dans le but de créer les comptes des Utilisateurs Apollo, de fournir le Service Apollo au Client, y compris l'analyse des vulnérabilités des environnements gérés, ou dans le cadre de toute autre obligation imposée par la loi applicable
Durée du traitement
Continu pour la durée de l'Accord, plus la période à partir de l'expiration de l'Accord jusqu'à la restitution ou la suppression de toutes les Données Personnelles du Client par Palantir conformément à l'Accord (y compris le présent DPA), aux Instructions du Client et à la loi applicable.
Objet, nature et durée du traitement par les sous-traitants ultérieurs
Comme indiqué dans l'annexe A. La durée de la sous-transformation est celle indiquée ci-dessus.
EXPOSÉ D
Compléments aux clauses contractuelles types
Le terme en majuscule suivant aura la signification indiquée ci-dessous :
L'"addendum britannique" désigne l'addendum sur le transfert international de données aux CCN de l'UE publié par le commissaire à l'information du Royaume-Uni en vertu de l'article 119A de la loi sur la protection des données de 2018, ou tout autre addendum susceptible de modifier ou de remplacer l'addendum de temps à autre.
Par "achèvement", on entend
(i) en ce qui concerne les CSC de l'UE pour les exportations en provenance de l'EEE :
a) la formulation facultative des clauses 7 et 11 est supprimée
b) dans la clause 8.9 de ces CCN, le paragraphe suivant est ajouté après le point d) :
"e) Nonobstant ce qui précède, tout audit sera limité dans sa portée et dans ses paramètres aux systèmes qui traitent les données à caractère personnel concernées.
Lorsque les audits comprennent des inspections, ils sont effectués avec un préavis raisonnable. Les parties conviennent mutuellement du champ d'application, du calendrier, de la durée, des exigences en matière de contrôle et de preuves de l'audit, à condition que cette obligation d'accord ne permette pas à l'importateur de données de retarder déraisonnablement l'exécution de l'audit.
Tout audit effectué en vertu de la présente clause (i) est aux frais de l'exportateur de données demandeur, et ces frais comprennent tous les coûts connexes raisonnables de l'importateur de données, y compris la rémunération des heures travaillées par le personnel de l'importateur de données ; (ii) ne peut, si l'exportateur de données cherche à retenir les services d'un auditeur indépendant, être effectué que par une partie approuvée à l'avance par l'importateur de données, cette approbation ne pouvant être refusée sans motif valable ; et (iii) est soumis à un accord de non-divulgation".
c) à la clause 9, l'option 1 est supprimée et le délai ne doit pas être inférieur à 30 jours ;
d) la formulation applicable à la clause 13(a) des CCAP de l'UE (telle que déterminée par les instructions entre crochets dans ces CCAP) est conservée et les deux alternatives restantes sont supprimées ;
e) à la clause 17 des CSC de l'UE, l'option 2 est supprimée et l'option 1 est complétée par des précisions sur le droit irlandais et à la clause 18(b) des CSC de l'UE, elle est complétée par des précisions sur les juridictions irlandaises ;
f) les parties mentionnées à l'annexe 1 seront complétées par les noms du client en tant qu'exportateur et de Palantir en tant qu'importateur, les transferts seront décrits dans la pièce B et dans toute autre pièce pertinente pour les services supplémentaires applicables dans le cadre de ce DPA et l'autorité de contrôle sera l'autorité de contrôle irlandaise ; dans l'annexe II, la liste des mesures techniques et organisationnelles sera les mesures techniques et organisationnelles et dans l'annexe III, la liste des sous-traitants secondaires sera celle mentionnée dans la pièce A ; et
g) dans le cas où les CCAP de l'UE seraient remplacées par rapport à celles en vigueur à la date d'entrée en vigueur, les CCAP révisées seront complétées de la manière la plus proche possible de celles décrites ci-dessus.
(ii) en ce qui concerne les CCN de l'UE, en ce qui concerne les exportations à partir d'autres juridictions que l'EEE, les compléments indiqués au point i) a) à g) ci-dessus s'appliquent, à l'exception de ce qui suit :
a) dans la clause 17 de ce CCAP de l'UE, la deuxième phrase est remplacée par le texte suivant : "Les parties conviennent qu'il s'agit du droit anglais", sauf si un autre droit régissant les CCAP de l'UE est requis en vertu de la loi sur la protection des données du pays concerné, auquel cas la clause 17 est complétée par les détails de la loi que cette loi sur la protection des données exige d'appliquer à ces CCAP de l'UE ;
b) La clause 18(b) est remplacée par le texte suivant : "18(b) Les parties conviennent que les tribunaux d'Angleterre et du Pays de Galles seront compétents, sauf si un autre pays, État ou territoire doit être compétent pour les CSC de l'UE en vertu de la loi sur la protection des données du pays concerné, auquel cas la clause 18(b) de ces CSC de l'UE sera complétée par des précisions sur le pays, l'État ou le territoire dont la loi sur la protection des données exige qu'il soit compétent pour les CSC de l'UE ;
c) les références dans le CCN de l'UE à "un tiers situé en dehors de l'Union européenne" sont remplacées par des références à "un tiers situé en dehors du pays ou du territoire dans lequel l'exportateur de données est établi
d) les références à "l'État membre" sont remplacées par des références au "pays ou territoire dans lequel l'exportateur de données est établi
e) toutes les références au GDPR dans ce CCN de l'UE sont remplacées par des références à la loi sur la protection des données du pays concerné et les références aux dispositions ou concepts du GDPR sont remplacées par des références aux dispositions ou concepts de cette loi sur la protection des données les plus étroitement liés au terme concerné tel qu'il est compris dans le GDPR
f) toutes les références aux États membres de l'Union européenne ou à l'Union européenne sont remplacées par des références au pays d'établissement de l'exportateur ;
g) sauf si la loi sur la protection des données l'exige, toutes les références dans le CCN de l'UE (a) aux droits des personnes concernées ou aux droits des tiers bénéficiaires ou (b) aux obligations ou à la responsabilité à l'égard des personnes concernées ou d'autres tiers sont supprimées et ignorées ; et
h) dans la mesure où l'une des références aux CCN de l'UE visées ci-dessus aux points (i) à (viii) est remplacée dans des dispositions modifiées ou des clauses ou instruments de remplacement ou approuvés ultérieurement après la date d'entrée en vigueur, les modifications prévues ci-dessus aux points (ii)(a)-(h) sont adaptées et/ou complétées si et dans la mesure où cela est approprié pour refléter le plus fidèlement possible l'effet de la première modification
(iii) en ce qui concerne les CCAP relatifs aux exportations du Royaume-Uni, les CCAP de l'UE s'appliquent telles qu'elles ont été modifiées par (i) l'addendum du commissaire à l'information (Information Commissioner's "UK Addendum to the EU Commission Standard Contractual Clauses") qui se trouve à l'adresse https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdfhttps://ico.org.uk/media/about-the-ico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf ou (ii) tout addendum de remplacement aux clauses contractuelles types de l'UE que le commissaire à l'information pourrait publier de temps à autre (ces addendas étant appelés "CCAP du Royaume-Uni"), les points suivants étant complétés (ou, dans le cas du point (ii), les points qui se rapprochent le plus des points suivants) :
a) dans la mesure où elles ne sont pas couvertes par ce qui précède, les dispositions énoncées aux points i) a) à g) ci-dessus s'appliquent, à l'exception de ce qui suit :
b) Le tableau 1 doit être complété par les noms du client en tant qu'exportateur et de Palantir en tant qu'importateur ;
c) dans le tableau 2, le module des CCN de l'UE sélectionné est déterminé conformément à la définition des CCN énoncée ci-dessous ;
d) dans le tableau 4, l'option "aucune des parties" doit être sélectionnée,
(iv) en ce qui concerne les CCAP relatifs aux exportations de Suisse, les CCAP de l'UE s'appliquent (en incorporant les compléments indiqués aux points (i)(a)-(g) ci-dessus), tels qu'amendés par (a) la décision d'orientation du PFPDT du 27 août 2021 trouvée sur https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222 établissant les amendements à apporter aux CCAP de l'UE en ce qui concerne les transferts soumis au PDAA suisse ou (b) toute décision de remplacement du PFPDT relative aux amendements à apporter aux CCAP de l'UE de temps à autre (ces amendements étant connus sous le nom de "CCAP suisse") ;
(v) en ce qui concerne les CCN relatifs aux exportations de tout autre pays, les compléments visés aux points (i)(a) à (g) ci-dessus sont apportés ou tout autre complément permettant d'obtenir le même résultat que ces compléments.
En ce qui concerne les transferts de données à caractère personnel qui peuvent avoir lieu dans le cadre de la fourniture du service, les conditions du module 2 (responsable du traitement vers sous-traitant), telles qu'elles figurent à l'annexe 1 de la pièce D, s'appliquent dans la mesure où le client est un responsable du traitement des données à caractère personnel du client. Les conditions du module 3 (de sous-traitant à sous-traitant), telles qu'elles figurent à l'annexe 2 de la pièce D, s'appliquent dans la mesure où le client est un sous-traitant (ou un sous-traitant secondaire) des données à caractère personnel du client. Pour les modules 2 et 3 des clauses contractuelles types, le choix de clauses spécifiques et/ou l'ajout d'informations requises s'appliquent comme suit :
(a) Le libellé applicable à la clause 13(a) des Clauses contractuelles types (tel que déterminé par les instructions entre crochets dans les Clauses contractuelles types) est conservé et les deux alternatives restantes sont supprimées ;
(b) les détails des sous-traitants ultérieurs que l'importateur de données a l'intention d'engager, tels qu'ils figurent dans l'annexe A et/ou dans toute autre annexe pertinente pour les services supplémentaires applicables, respectivement, au présent Accord , constituent la "liste convenue" de sous-traitants ultérieurs visée à la clause 9(a) des Clauses contractuelles types.
Annexe 1 à la pièce
CLAUSES CONTRACTUELLES TYPES
Module 2 : Du contrôleur au processeur
SECTION I
Clause 1
Objectif et champ d'application
(a) Les présentes clauses contractuelles types ont pour objet d'assurer le respect des exigences du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données (règlement général sur la protection des données) ([1] ) pour le transfert de données vers un pays tiers.
(b) Les parties :
(i) la (les) personne(s) physique(s) ou morale(s), autorité(s) publique(s), agence(s) ou autre(s) organisme(s) (ci-après dénommé(s) "entité(s)") qui transfère(nt) les données à caractère personnel, telles qu'elles sont énumérées à l'annexe I.A (ci-après dénommé(s) "exportateur(s) de données"), et
(ii) l'entité ou les entités d'un pays tiers recevant les données à caractère personnel de l'exportateur de données, directement ou indirectement par l'intermédiaire d'une autre entité également partie aux présentes clauses, dont la liste figure à l'annexe I.A (ci-après dénommée "l'importateur de données")
ont accepté les présentes clauses contractuelles types (ci-après dénommées "clauses").
(c) Les présentes clauses s'appliquent au transfert de données à caractère personnel tel que spécifié à l'annexe I.B.
(d) L'appendice aux présentes clauses contenant les annexes qui y sont mentionnées fait partie intégrante des présentes clauses.
Article 2
Effet et invariabilité des clauses
(a) Les présentes Clauses énoncent des garanties appropriées, y compris des droits opposables aux personnes concernées et des voies de recours effectives, conformément à l'article 46, paragraphe 1, et à l'article 46, paragraphe 2, point c), du règlement (UE) 2016/679 et, en ce qui concerne les transferts de données des responsables du traitement vers les sous-traitants et/ou des sous-traitants vers les sous-traitants, des clauses contractuelles types conformément à l'article 28, paragraphe 7, du règlement (UE) 2016/679, à condition qu'elles ne soient pas modifiées, sauf pour sélectionner le(s) module(s) approprié(s) ou pour ajouter ou mettre à jour des informations dans l'appendice. Le présent site n'empêche pas les Parties d'inclure les clauses contractuelles types établies dans les présentes Clauses dans un contrat plus large et/ou d'ajouter d'autres clauses ou garanties supplémentaires, à condition qu'elles ne contredisent pas, directement ou indirectement, les présentes Clauses ou qu'elles ne portent pas atteinte aux libertés ou droits fondamentaux des personnes concernées.
(b) Les présentes clauses sont sans préjudice des obligations auxquelles l'exportateur de données est soumis en vertu du règlement (UE) 2016/679.
Article 3
Bénéficiaires tiers
(a) Les personnes concernées peuvent invoquer et faire appliquer les présentes clauses, en tant que tiers bénéficiaires, à l'encontre de l'exportateur et/ou de l'importateur de données, avec les exceptions suivantes :
(i) Article 1, article 2, article 3, article 6, article 7 ;
(ii) Clause 8.1(b), 8.9(a), (c), (d) et (e)
(iii) Article 9, points a), c), d) et e)
(iv) Article 12, points a), d) et f) ;
(v) L'article 13 ;
(vi) Clause 15.1(c), (d) et (e) ;
(vii) Article 16, point e) ;
(viii) Article 18, points a) et b).
(b) Le paragraphe a) est sans préjudice des droits des personnes concernées en vertu du règlement (UE) 2016/679.
Article 4
Interprétation
(a) Lorsque les présentes clauses utilisent des termes qui sont définis dans le règlement (UE) 2016/679, ces termes ont la même signification que dans ledit règlement.
(b) Les présentes clauses doivent être lues et interprétées à la lumière des dispositions du règlement (UE) 2016/679.
(c) Les présentes clauses ne doivent pas être interprétées d'une manière qui entre en conflit avec les droits et obligations prévus par le règlement (UE) 2016/679.
Article 5
Hiérarchie
En cas de contradiction entre les présentes clauses et les dispositions des accords connexes entre les parties, existant au moment où les présentes clauses sont convenues ou conclues par la suite, les présentes clauses prévalent.
Article 6
Description du (des) transfert(s)
Les détails du ou des transferts, et en particulier les catégories de données à caractère personnel qui sont transférées et la ou les finalités pour lesquelles elles sont transférées, sont précisés à l'annexe I.B.
Article 7
Clause d'amarrage
[laissé intentionnellement vide]
SECTION II - OBLIGATIONS DES PARTIES
Article 8
Garanties en matière de protection des données
L'exportateur de données garantit qu'il a déployé des efforts raisonnables pour déterminer que l'importateur de données est en mesure, grâce à la mise en œuvre de mesures techniques et organisationnelles appropriées, de satisfaire aux obligations qui lui incombent en vertu des présentes clauses.
8.1 Instructions
(a) L'importateur de données ne traite les données à caractère personnel que sur instruction documentée de l'exportateur de données. L'exportateur de données peut donner de telles instructions pendant toute la durée du contrat.
(b) L'importateur de données informe immédiatement l'exportateur de données s'il n'est pas en mesure de suivre ces instructions.
8.2 Limitation de l'objet
L'importateur de données ne traite les données à caractère personnel qu'aux fins spécifiques du transfert, telles qu'indiquées à l'annexe I.B, à moins que l'exportateur de données ne lui donne d'autres instructions.
8.3 Transparence
Sur demande, l'exportateur de données met gratuitement à la disposition de la personne concernée une copie des présentes clauses, y compris l'appendice tel qu'il a été complété par les parties. Dans la mesure nécessaire pour protéger les secrets d'affaires ou d'autres informations confidentielles, y compris les mesures décrites à l'annexe II et les données à caractère personnel, l'exportateur de données peut expurger une partie du texte de l'appendice des présentes clauses avant d'en partager une copie, mais il fournit un résumé significatif lorsque la personne concernée ne serait autrement pas en mesure d'en comprendre le contenu ou d'exercer ses droits. Sur demande, les parties fournissent à la personne concernée les raisons des expurgations, dans la mesure du possible sans révéler les informations expurgées. La présente clause est sans préjudice des obligations de l'exportateur de données en vertu des articles 13 et 14 du règlement (UE) 2016/679.
8.4 Précision
Si l'importateur de données se rend compte que les données à caractère personnel qu'il a reçues sont inexactes ou périmées, il en informe l'exportateur de données dans les meilleurs délais. Dans ce cas, l'importateur de données coopère avec l'exportateur de données pour effacer ou rectifier les données.
8.5 Durée du traitement et effacement ou restitution des données
Le traitement par l'importateur de données n'a lieu que pour la durée spécifiée à l'annexe I.B. Après la fin de la prestation des services de traitement, l'importateur de données, au choix de l'exportateur de données, supprime toutes les données à caractère personnel traitées pour le compte de l'exportateur de données et certifie à ce dernier qu'il l'a fait, ou renvoie à l'exportateur de données toutes les données à caractère personnel traitées pour son compte et supprime les copies existantes. Jusqu'à ce que les données soient supprimées ou renvoyées, l'importateur de données continue de veiller au respect des présentes clauses. Si les lois locales applicables à l'importateur de données interdisent la restitution ou la suppression des données à caractère personnel, l'importateur de données garantit qu'il continuera à assurer le respect des présentes clauses et qu'il ne les traitera que dans la mesure et pour la durée requises par ces lois locales. Ceci est sans préjudice de la clause 14, en particulier de l'obligation faite à l'importateur de données en vertu de la clause 14(e) d'informer l'exportateur de données pendant toute la durée du contrat s'il a des raisons de croire qu'il est ou est devenu soumis à des lois ou des pratiques non conformes aux exigences de la clause 14(a).
8.6 Sécurité du traitement
(a) L'importateur de données et, lors de la transmission, également l'exportateur de données, mettent en œuvre les mesures techniques et organisationnelles appropriées pour assurer la sécurité des données, y compris la protection contre les violations de la sécurité entraînant accidentellement ou de manière illicite la destruction, la perte, l'altération, la divulgation non autorisée de ces données ou l'accès non autorisé à celles-ci (ci-après dénommées "violations de données à caractère personnel"). Pour évaluer le niveau de sécurité approprié, les parties tiennent dûment compte de l'état de la technique, des coûts de mise en œuvre, de la nature, de la portée, du contexte et de la (des) finalité(s) du traitement, ainsi que des risques que celui-ci comporte pour les personnes concernées. Les parties envisagent en particulier de recourir au cryptage ou à la pseudonymisation, y compris pendant la transmission, lorsque la finalité du traitement peut être atteinte de cette manière. En cas de pseudonymisation, les informations supplémentaires permettant d'attribuer les données à caractère personnel à une personne concernée spécifique restent, dans la mesure du possible, sous le contrôle exclusif de l'exportateur de données. Pour se conformer aux obligations qui lui incombent en vertu du présent paragraphe, l'importateur de données met au moins en œuvre les mesures techniques et organisationnelles spécifiées à l'annexe II. L'importateur de données effectue des contrôles réguliers pour s'assurer que ces mesures continuent d'offrir un niveau de sécurité approprié.
(b) L'importateur de données n'accorde l'accès aux données à caractère personnel aux membres de son personnel que dans la mesure strictement nécessaire à la mise en œuvre, à la gestion et au suivi du contrat. Il veille à ce que les personnes autorisées à traiter les données à caractère personnel se soient engagées à respecter la confidentialité ou soient soumises à une obligation légale appropriée de confidentialité.
(c) En cas de violation de données à caractère personnel concernant des données à caractère personnel traitées par l'importateur de données en vertu des présentes clauses, l'importateur de données prend les mesures appropriées pour remédier à la violation, y compris des mesures visant à en atténuer les effets négatifs. L'importateur de données notifie également l'exportateur de données dans un délai raisonnable après avoir pris connaissance de la violation. Cette notification contient les coordonnées d'un point de contact où de plus amples informations peuvent être obtenues, une description de la nature de la violation (y compris, si possible, les catégories et le nombre approximatif de personnes concernées et de dossiers de données à caractère personnel concernés), ses conséquences probables et les mesures prises ou proposées pour remédier à la violation, y compris, le cas échéant, les mesures visant à en atténuer les éventuels effets néfastes. Lorsqu'il n'est pas possible de fournir toutes les informations en même temps, et dans la mesure où il n'est pas possible de le faire, la notification initiale contient les informations disponibles à ce moment-là et les informations supplémentaires sont fournies ultérieurement, au fur et à mesure qu'elles sont disponibles, sans retard excessif.
(d) L'importateur de données coopère avec l'exportateur de données et l'aide à respecter ses obligations au titre du règlement (UE) 2016/679, en particulier pour notifier l'autorité de contrôle compétente et les personnes concernées affectées, en tenant compte de la nature du traitement et des informations dont dispose l'importateur de données.
8.7 Données sensibles
Lorsque le transfert porte sur des données à caractère personnel qui révèlent l'origine raciale ou ethnique, les opinions politiques, les convictions religieuses ou philosophiques, ou l'appartenance syndicale, des données génétiques ou des données biométriques aux fins d'identifier une personne physique de manière unique, des données concernant la santé ou la vie sexuelle ou l'orientation sexuelle d'une personne, ou des données relatives à des condamnations pénales et à des infractions (ci-après dénommées "données sensibles"), l'importateur de données applique les restrictions spécifiques et/ou les garanties supplémentaires décrites à l'annexe I, point B.
8.8 Transferts ultérieurs
L'importateur de données ne divulgue les données à caractère personnel à un tiers que sur instruction documentée de l'exportateur de données. En outre, les données ne peuvent être divulguées à un tiers situé en dehors de l'Union européenne ([2] ) (dans le même pays que l'importateur de données ou dans un autre pays tiers, ci-après dénommé "transfert ultérieur") que si le tiers est ou accepte d'être lié par les présentes Clauses, en vertu du Module approprié, ou si :
(i) le transfert ultérieur est effectué vers un pays bénéficiant d'une décision d'adéquation en vertu de l'article 45 du règlement (UE) 2016/679 qui couvre le transfert ultérieur ;
(ii) le tiers assure par ailleurs des garanties appropriées conformément aux articles 46 ou 47 Règlement du (UE) 2016/679 en ce qui concerne le traitement en question ;
(iii) le transfert ultérieur est nécessaire à la constatation, à l'exercice ou à la défense de droits en justice dans le cadre de procédures administratives, réglementaires ou judiciaires spécifiques ; ou
(iv) le transfert ultérieur est nécessaire pour protéger les intérêts vitaux de la personne concernée ou d'une autre personne physique.
Tout transfert ultérieur est subordonné au respect par l'importateur de données de toutes les autres garanties prévues par les présentes clauses, en particulier la limitation de la finalité.
8.9 Documentation et conformité
(a) L'importateur de données traite rapidement et de manière adéquate les demandes de renseignements de l'exportateur de données relatives au traitement prévu par les présentes clauses.
(b) Les parties doivent être en mesure de démontrer qu'elles respectent les présentes clauses. En particulier, l'importateur de données conserve une documentation appropriée sur les activités de traitement effectuées pour le compte de l'exportateur de données.
(c) L'importateur de données met à la disposition de l'exportateur de données toutes les informations nécessaires pour démontrer le respect des obligations énoncées dans les présentes clauses et, à la demande de l'exportateur de données, autorise et contribue à des audits des activités de traitement couvertes par les présentes clauses, à des intervalles raisonnables ou s'il existe des indices de non-conformité. Lorsqu'il décide d'un examen ou d'un audit, l'exportateur de données peut tenir compte des certifications pertinentes détenues par l'importateur de données.
(d) L'exportateur de données peut choisir d'effectuer l'audit lui-même ou de mandater un auditeur indépendant. Les audits peuvent comprendre des inspections dans les locaux ou les installations physiques de l'importateur de données et sont, le cas échéant, effectués avec un préavis raisonnable.
(e) Les parties mettent les informations visées aux paragraphes b) et c), y compris les résultats de tout audit, à la disposition de l'autorité de surveillance compétente qui en fait la demande.
Article 9
Utilisation de sous-traitants
(a) OPTION 2 AUTORISATION GÉNÉRALE ÉCRITE : L'importateur de données dispose de l'autorisation générale de l'exportateur de données pour l'engagement de sous-traitants secondaires figurant sur une liste convenue. L'importateur de données informe spécifiquement l'exportateur de données par écrit de toute modification envisagée de cette liste par l'ajout ou le remplacement de sous-traitants ultérieurs au moins 14 jours à l'avance, ce qui donne à l'exportateur de données un délai suffisant pour pouvoir s'opposer à ces modifications avant l'engagement du ou des sous-traitants ultérieurs. L'importateur de données fournit à l'exportateur de données les informations nécessaires pour lui permettre d'exercer son droit d'opposition.
(b) Lorsque l'importateur de données engage un sous-traitant ultérieur pour effectuer des activités de traitement spécifiques (pour le compte de l'exportateur de données), il le fait au moyen d'un contrat écrit qui prévoit, en substance, les mêmes obligations en matière de protection des données que celles qui lient l'importateur de données en vertu des présentes clauses, y compris en ce qui concerne les droits des tiers bénéficiaires pour les personnes concernées. ([3] ) Les parties conviennent qu'en se conformant à la présente clause, l'importateur de données remplit les obligations qui lui incombent en vertu de la clause 8.8. L'importateur de données veille à ce que le sous-traitant ultérieur respecte les obligations auxquelles l'importateur de données est soumis en vertu de ces clauses.
(c) L'importateur de données fournit, à la demande de l'exportateur de données, une copie de l'accord de sous-traitance et de toute modification ultérieure à l'exportateur de données. Dans la mesure où cela est nécessaire pour protéger des secrets d'affaires ou d'autres informations confidentielles, y compris des données à caractère personnel, l'importateur de données peut expurger le texte de l'accord avant d'en communiquer une copie.
(d) L'importateur de données reste pleinement responsable vis-à-vis de l'exportateur de données de l'exécution des obligations du sous-traitant ultérieur en vertu de son contrat avec l'importateur de données. L'importateur de données notifie à l'exportateur de données tout manquement du sous-traitant ultérieur aux obligations qui lui incombent en vertu de ce contrat.
(e) L'importateur de données convient avec le sous-traitant ultérieur d'une clause de tiers bénéficiaire en vertu de laquelle - dans le cas où l'importateur de données a effectivement disparu, a cessé d'exister en vertu du droit ou est devenu insolvable - l'exportateur de données a le droit de résilier le contrat de sous-traitance ultérieur et d'ordonner au sous-traitant ultérieur d'effacer ou de restituer les données à caractère personnel.
Article 10
Droits des personnes concernées
(a) L'importateur de données notifie sans délai à l'exportateur de données toute demande qu'il a reçue d'une personne concernée. Il ne répond pas lui-même à cette demande, sauf s'il a été autorisé à le faire par l'exportateur de données.
(b) L'importateur de données aide l'exportateur de données à s'acquitter de ses obligations de répondre aux demandes des personnes concernées concernant l'exercice de leurs droits en vertu du règlement (UE) 2016/679. À cet égard, les parties définissent à l'annexe II les mesures techniques et organisationnelles appropriées, en tenant compte de la nature du traitement, par lesquelles l'assistance doit être fournie, ainsi que la portée et l'étendue de l'assistance requise.
(c) En remplissant ses obligations au titre des paragraphes a) et b), l'importateur de données se conforme aux instructions de l'exportateur de données.
Article 11
Recours
(a) L'importateur de données informe les personnes concernées, dans un format transparent et aisément accessible, par le biais d'une notification individuelle ou sur son site internet, de l'existence d'un point de contact habilité à traiter les réclamations. Il traite rapidement toute réclamation qu'il reçoit d'une personne concernée.
(b) En cas de litige entre une personne concernée et l'une des parties en ce qui concerne le respect des présentes clauses, cette partie met tout en œuvre pour résoudre le problème à l'amiable en temps utile. Les parties se tiennent mutuellement informées de ces litiges et, le cas échéant, coopèrent pour les résoudre.
(c) Lorsque la personne concernée invoque un droit de tiers bénéficiaire en vertu de la clause 3, l'importateur de données accepte la décision de la personne concernée :
(i) déposer une plainte auprès de l'autorité de contrôle de l'État membre de sa résidence habituelle ou de son lieu de travail, ou auprès de l'autorité de contrôle compétente en vertu de la clause 13 ;
(ii) porter le litige devant les tribunaux compétents au sens de la clause 18.
(d) Les parties acceptent que la personne concernée puisse être représentée par un organisme, une organisation ou une association à but non lucratif dans les conditions prévues à l'article 80, paragraphe 1, du règlement (UE) 2016/679.
(e) L'importateur de données doit se conformer à une décision contraignante en vertu du droit de l'UE ou de l'État membre applicable.
(f) L'importateur de données convient que le choix effectué par la personne concernée ne portera pas atteinte à ses droits substantiels et procéduraux de demander réparation conformément aux lois applicables.
Article 12
Responsabilité
(a) Chaque partie est responsable à l'égard de l'autre ou des autres parties de tout dommage qu'elle cause à l'autre ou aux autres parties en raison d'une violation des présentes clauses.
(b) L'importateur de données est responsable envers la personne concernée, et la personne concernée a le droit d'être indemnisée, pour tout dommage matériel ou moral que l'importateur de données ou son sous-traitant secondaire cause à la personne concernée en violant les droits du tiers bénéficiaire en vertu des présentes clauses.
(c) Nonobstant le paragraphe b), l'exportateur de données est responsable envers la personne concernée, et la personne concernée a le droit de recevoir une indemnisation, pour tout dommage matériel ou moral que l'exportateur de données ou l'importateur de données (ou son sous-traitant ultérieur) cause à la personne concernée en violant les droits du tiers bénéficiaire en vertu des présentes Clauses. Ceci est sans préjudice de la responsabilité de l'exportateur de données et, lorsque l'exportateur de données est un sous-traitant agissant pour le compte d'un responsable du traitement, de la responsabilité du responsable du traitement en vertu du règlement (UE) 2016/679 ou du règlement (UE) 2018/1725, selon le cas.
(d) Les parties conviennent que si l'exportateur de données est tenu responsable, en vertu du paragraphe c), des dommages causés par l'importateur de données (ou son sous-traitant), il a le droit de réclamer à l'importateur de données la partie de l'indemnisation correspondant à la responsabilité de l'importateur de données dans le dommage.
(e) Lorsque plusieurs parties sont responsables de tout dommage causé à la personne concernée à la suite d'une violation des présentes clauses, toutes les parties responsables sont conjointement et solidairement responsables et la personne concernée a le droit d'intenter une action en justice contre l'une quelconque de ces parties.
(f) Les parties conviennent que si l'une d'entre elles est tenue pour responsable en vertu du paragraphe (e), elle est en droit de réclamer à l'autre (aux autres) partie(s) la part de l'indemnisation correspondant à sa (leur) responsabilité dans le dommage.
(g) L'importateur de données ne peut pas invoquer le comportement d'un sous-traitant ultérieur pour se soustraire à sa propre responsabilité.
Article 13
Supervision
(a) [Lorsque l'exportateur de données est établi dans un État membre de l'UE :] L'autorité de contrôle chargée de veiller au respect par l'exportateur de données du règlement (UE) 2016/679 en ce qui concerne le transfert de données, comme indiqué à l'annexe I.C, agit en tant qu'autorité de contrôle compétente.
[Lorsque l'exportateur de données n'est pas établi dans un État membre de l'UE, mais relève du champ d'application territorial du règlement (UE) 2016/679 conformément à son article 3, paragraphe 2, et a désigné un représentant conformément à l'article 27, paragraphe 1, du règlement (UE) 2016/679 :]. L'autorité de contrôle de l'État membre dans lequel le représentant au sens de l'article 27, paragraphe 1, du règlement (UE) 2016/679 est établi, comme indiqué à l'annexe I.C, agit en tant qu'autorité de contrôle compétente.
[Lorsque l'exportateur de données n'est pas établi dans un État membre de l'UE, mais relève du champ d'application territorial du règlement (UE) 2016/679 conformément à son article 3, paragraphe 2, sans toutefois devoir désigner un représentant conformément à l'article 27, paragraphe 2, du règlement (UE) 2016/679 :]. L'autorité de contrôle de l'un des États membres dans lesquels se trouvent les personnes concernées dont les données à caractère personnel sont transférées en vertu des présentes clauses en relation avec l'offre de biens ou de services qui leur est faite, ou dont le comportement est suivi, comme indiqué à l'annexe I.C, agit en tant qu'autorité de contrôle compétente.
(b) L'importateur de données accepte de se soumettre à la juridiction de l'autorité de contrôle compétente et de coopérer avec elle dans le cadre de toute procédure visant à assurer le respect des présentes clauses. En particulier, l'importateur de données accepte de répondre aux demandes de renseignements, de se soumettre à des audits et de se conformer aux mesures adoptées par l'autorité de contrôle, y compris les mesures correctives et compensatoires. Il fournit à l'autorité de contrôle la confirmation écrite que les mesures nécessaires ont été prises.
SECTION III - LOIS ET OBLIGATIONS LOCALES EN CAS D'ACCÈS PAR LES AUTORITÉS PUBLIQUES
Article 14
Lois et pratiques locales affectant le respect des clauses
(a) Les parties garantissent qu'elles n'ont aucune raison de croire que les lois et pratiques du pays tiers de destination applicables au traitement des données à caractère personnel par l'importateur de données, y compris toute obligation de divulguer des données à caractère personnel ou toute mesure autorisant l'accès des autorités publiques, empêchent l'importateur de données de remplir les obligations qui lui incombent en vertu des présentes clauses. Il est entendu que les lois et pratiques qui respectent l'essence des droits et libertés fondamentaux et n'excèdent pas ce qui est nécessaire et proportionné dans une société démocratique pour sauvegarder l'un des objectifs énumérés à l'article 23, paragraphe 1, du règlement (UE) 2016/679, ne sont pas en contradiction avec les présentes clauses.
(b) Les parties déclarent qu'en fournissant la garantie visée au paragraphe (a), elles ont tenu dûment compte, en particulier, des éléments suivants :
(i) les circonstances particulières du transfert, notamment la longueur de la chaîne de traitement, le nombre d'acteurs impliqués et les canaux de transmission utilisés ; les transferts ultérieurs envisagés ; le type de destinataire ; la finalité du traitement ; les catégories et le format des données à caractère personnel transférées ; le secteur économique dans lequel le transfert a lieu ; le lieu de stockage des données transférées ;
(ii) les lois et pratiques du pays tiers de destination - y compris celles exigeant la divulgation de données aux autorités publiques ou autorisant l'accès de ces autorités - pertinentes à la lumière des circonstances particulières du transfert, ainsi que les limitations et garanties applicables ([4] ) ;
(iii) toute garantie contractuelle, technique ou organisationnelle pertinente mise en place pour compléter les garanties prévues par les présentes clauses, y compris les mesures appliquées lors de la transmission et du traitement des données à caractère personnel dans le pays de destination.
(c) L'importateur de données garantit que, dans le cadre de l'évaluation visée au point b), il s'est efforcé de fournir à l'exportateur de données les informations pertinentes et convient qu'il continuera à coopérer avec l'exportateur de données pour assurer le respect des présentes clauses.
(d) Les parties conviennent de documenter l'évaluation visée au point b) et de la mettre à la disposition de l'autorité de surveillance compétente sur demande.
(e) L'importateur de données accepte de notifier rapidement à l'exportateur de données si, après avoir accepté les présentes clauses et pendant la durée du contrat, il a des raisons de croire qu'il est ou est devenu soumis à des lois ou à des pratiques non conformes aux exigences du paragraphe a), y compris à la suite d'une modification des lois du pays tiers ou d'une mesure (telle qu'une demande de divulgation) indiquant une application de ces lois dans la pratique qui n'est pas conforme aux exigences du paragraphe a).
(f) À la suite d'une notification au titre du paragraphe e), ou si l'exportateur de données a des raisons de croire que l'importateur de données ne peut plus remplir ses obligations au titre des présentes clauses, l'exportateur de données identifie rapidement les mesures appropriées (par exemple, les mesures techniques ou organisationnelles visant à garantir la sécurité et la confidentialité) à adopter par l'exportateur de données et/ou l'importateur de données pour remédier à la situation. L'exportateur de données suspend le transfert de données s'il considère qu'aucune garantie appropriée ne peut être assurée pour ce transfert, ou si l'autorité de contrôle compétente lui en donne l'instruction. Dans ce cas, l'exportateur de données a le droit de résilier le contrat, dans la mesure où il concerne le traitement de données à caractère personnel en vertu des présentes clauses. Si le contrat implique plus de deux parties, l'exportateur de données ne peut exercer ce droit de résiliation qu'à l'égard de la partie concernée, à moins que les parties n'en aient convenu autrement. Lorsque le contrat est résilié en vertu de la présente clause, la clause 16, points d) et e), s'applique.
Article 15
Obligations de l'importateur de données en cas d'accès par les autorités publiques
15.1 Notification
(a) L'importateur de données s'engage à notifier rapidement à l'exportateur de données et, si possible, à la personne concernée (si nécessaire avec l'aide de l'exportateur de données), s'il
(i) reçoit une demande juridiquement contraignante émanant d'une autorité publique, y compris des autorités judiciaires, en vertu des lois du pays de destination, en vue de la divulgation de données à caractère personnel transférées conformément aux présentes clauses ; cette notification comprend des informations sur les données à caractère personnel demandées, l'autorité requérante, la base juridique de la demande et la réponse apportée ; ou
(ii) a connaissance d'un accès direct des autorités publiques aux données à caractère personnel transférées en vertu des présentes clauses, conformément à la législation du pays de destination ; cette notification comprend toutes les informations dont dispose l'importateur.
(b) Si la législation du pays de destination interdit à l'importateur de données de notifier l'exportateur de données et/ou la personne concernée, l'importateur de données s'engage à faire de son mieux pour obtenir une dérogation à l'interdiction, en vue de communiquer le plus d'informations possible, dans les meilleurs délais. L'importateur de données accepte de documenter ses meilleurs efforts afin de pouvoir les démontrer à la demande de l'exportateur de données.
(c) Si la législation du pays de destination le permet, l'importateur de données accepte de fournir à l'exportateur de données, à intervalles réguliers pendant la durée du contrat, autant d'informations pertinentes que possible sur les demandes reçues (en particulier, le nombre de demandes, le type de données demandées, l'autorité/les autorités requérante(s), si les demandes ont été contestées et l'issue de ces contestations, etc.
(d) L'importateur de données s'engage à conserver les informations visées aux points a) à c) pendant la durée du contrat et à les mettre à la disposition de l'autorité de contrôle compétente sur demande.
(e) Les paragraphes (a) à (c) sont sans préjudice de l'obligation de l'importateur de données, conformément à la clause 14(e) et à la clause 16, d'informer rapidement l'exportateur de données lorsqu'il n'est pas en mesure de se conformer à ces clauses.
15.2 Examen de la légalité et de la minimisation des données
(a) L'importateur de données accepte d'examiner la légalité de la demande de divulgation, en particulier de vérifier si elle reste dans les limites des pouvoirs accordés à l'autorité publique requérante, et de contester la demande si, après une évaluation minutieuse, il conclut qu'il y a des motifs raisonnables de considérer que la demande est illégale en vertu des lois du pays de destination, des obligations applicables en vertu du droit international et des principes de la courtoisie internationale. L'importateur de données exerce, dans les mêmes conditions, les voies de recours. Lorsqu'il conteste une demande, l'importateur de données demande des mesures provisoires en vue de suspendre les effets de la demande jusqu'à ce que l'autorité judiciaire compétente ait statué sur son bien-fondé. Il ne divulgue pas les données à caractère personnel demandées tant qu'il n'est pas tenu de le faire en vertu des règles de procédure applicables. Ces exigences sont sans préjudice des obligations de l'importateur de données au titre de la clause 14, point e).
(b) L'importateur de données accepte de documenter son évaluation juridique et toute contestation de la demande de divulgation et, dans la mesure où la législation du pays de destination le permet, de mettre la documentation à la disposition de l'exportateur de données. Il la met également à la disposition de l'autorité de contrôle compétente sur demande.
(c) L'importateur de données s'engage à fournir la quantité minimale d'informations autorisée lorsqu'il répond à une demande de divulgation, sur la base d'une interprétation raisonnable de la demande.
SECTION IV - DISPOSITIONS FINALES
Article 16
Non-respect des clauses et résiliation
(a) L'importateur de données informe rapidement l'exportateur de données s'il n'est pas en mesure de respecter les présentes clauses, quelle qu'en soit la raison.
(b) Si l'importateur de données ne respecte pas les présentes clauses ou n'est pas en mesure de les respecter, l'exportateur de données suspend le transfert de données à caractère personnel à l'importateur de données jusqu'à ce que le respect des clauses soit à nouveau assuré ou que le contrat soit résilié. Cette disposition est sans préjudice de la clause 14, point f).
(c) L'exportateur de données a le droit de résilier le contrat, dans la mesure où il concerne le traitement de données à caractère personnel en vertu des présentes clauses, lorsque :
(i) l'exportateur de données a suspendu le transfert de données à caractère personnel à l'importateur de données conformément au paragraphe b) et le respect des présentes clauses n'est pas rétabli dans un délai raisonnable et, en tout état de cause, dans un délai d'un mois à compter de la suspension ;
(ii) l'importateur de données enfreint de manière substantielle ou persistante les présentes clauses ; ou
(iii) l'importateur de données ne se conforme pas à une décision contraignante d'un tribunal compétent ou d'une autorité de contrôle concernant les obligations qui lui incombent en vertu des présentes clauses.
Dans ce cas, il informe l'autorité de contrôle compétente de ce non-respect. Lorsque le contrat implique plus de deux parties, l'exportateur de données ne peut exercer ce droit de résiliation qu'à l'égard de la partie concernée, à moins que les parties n'en aient convenu autrement.
(d) Les données à caractère personnel qui ont été transférées avant la résiliation du contrat conformément au paragraphe c) sont, au choix de l'exportateur de données, immédiatement renvoyées à l'exportateur de données ou effacées dans leur intégralité. Il en va de même pour toute copie des données. L'importateur de données certifie l'effacement des données à l'exportateur de données. Jusqu'à ce que les données soient effacées ou renvoyées, l'importateur de données continue de veiller au respect des présentes clauses. Si la législation locale applicable à l'importateur de données interdit la restitution ou la suppression des données à caractère personnel transférées, l'importateur de données garantit qu'il continuera à veiller au respect des présentes clauses et qu'il ne traitera les données que dans la mesure et pour la durée requises par cette législation locale.
(e) Chaque partie peut révoquer son accord d'être liée par les présentes clauses lorsque (i) la Commission européenne adopte une décision en vertu de l'article 45, paragraphe 3, du règlement (UE) 2016/679 qui couvre le transfert de données à caractère personnel auquel les présentes clauses s'appliquent ; ou (ii) le règlement (UE) 2016/679 devient partie intégrante du cadre juridique du pays vers lequel les données à caractère personnel sont transférées. Ceci est sans préjudice d'autres obligations s'appliquant au traitement en question en vertu du Règlement (UE) 2016/679.
Article 17
Droit applicable
Les présentes clauses sont régies par le droit de l'un des États membres de l'Union européenne, à condition que ce droit autorise les droits des tiers bénéficiaires. Les parties conviennent que le droit irlandais sera applicable.
Article 18
Choix du for et de la juridiction
(a) Tout litige découlant des présentes clauses sera réglé par les tribunaux d'un État membre de l'UE.
(b) Les parties conviennent que ces tribunaux seront ceux de l'Irlande.
(c) Une personne concernée peut également intenter une action en justice contre l'exportateur de données et/ou l'importateur de données devant les tribunaux de l'État membre dans lequel elle a sa résidence habituelle.
(d) Les parties conviennent de se soumettre à la compétence de ces tribunaux.
ANNEXE I
A. LISTE DES PARTIES
Exportateur(s) de données :
Nom : Nom du client tel qu'indiqué dans le contrat.
Adresse : Adresse du client telle que mentionnée dans le contrat.
Nom, fonction et coordonnées de la personne de contact : Point de contact pour le client, comme indiqué dans l'accord.
Activités en rapport avec les données transférées en vertu des présentes clauses : Client dans le cadre de l'accord
Rôle (contrôleur/processeur) : Contrôleur
Importateur(s) de données
Nom : Nom de Palantir tel qu'indiqué dans l'accord.
Adresse : Adresse de Palantir telle que mentionnée dans l'accord.
Nom, fonction et coordonnées de la personne de contact : Délégué à la protection des données, dpo@palantir.com
Activités en rapport avec les données transférées en vertu des présentes clauses : Fournisseur dans le cadre de l'accord
Rôle (contrôleur/processeur) : Processeur
B. DESCRIPTION DU TRANSFERT
Catégories de personnes concernées dont les données à caractère personnel sont transférées
Comme décrit dans la section "Catégories de personnes dont les données à caractère personnel peuvent faire l'objet d'un traitement" de l'annexe B et dans toute autre annexe pertinente pour les services supplémentaires applicables.
Catégories de données à caractère personnel transférées
Comme décrit dans les "Catégories de données à caractère personnel des clients" de l'annexe B et de toute autre annexe pertinente pour les services supplémentaires applicables.
Données sensibles transférées (le cas échéant) et restrictions ou garanties appliquées qui tiennent pleinement compte de la nature des données et des risques encourus, comme par exemple une limitation stricte de la finalité, des restrictions d'accès (y compris un accès réservé au personnel ayant suivi une formation spécialisée), la tenue d'un registre d'accès aux données, des restrictions pour les transferts ultérieurs ou des mesures de sécurité supplémentaires.
Les données personnelles révélant l'origine raciale ou ethnique, les opinions politiques, les croyances religieuses ou philosophiques, ou l'appartenance syndicale, les données génétiques, les données biométriques, les données de santé, les données concernant la vie sexuelle ou l'orientation sexuelle d'une personne physique, dans la mesure où les Données Personnelles du Client comprennent de telles données sensibles et sont fournies à Palantir pour le Traitement (y compris via le Service) par ou sur l'ordre du Client ou des Utilisateurs du Client. Dans ce cas, le Client devra clairement identifier ces données sensibles à Palantir par écrit avant de les fournir. Les garanties et restrictions appliquées sont décrites à l'annexe II.
La fréquence du transfert (par exemple, si les données sont transférées de manière ponctuelle ou continue).
De manière continue.
Nature du traitement
Comme décrit dans la section "Nature et finalité du traitement" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
Finalité(s) du transfert et du traitement ultérieur des données
Comme décrit dans la section "Nature et finalité du traitement" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
la durée de conservation des données à caractère personnel ou, si cela n'est pas possible, les critères utilisés pour déterminer cette durée
Comme décrit à la rubrique "Durée du traitement" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
Pour les transferts aux (sous-)traitants, préciser également l'objet, la nature et la durée du traitement.
Comme décrit à la rubrique "Objet, nature et durée du traitement par les sous-traitants ultérieurs" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
C. AUTORITÉ DE SURVEILLANCE COMPÉTENTE
Identifier la ou les autorité(s) de contrôle compétente(s) conformément à la clause 13
L'autorité de contrôle déterminée conformément à la clause 13 et précisée à l'adresse https://edpb.europa.eu/about-edpb/about-edpb/members_en (avec ses mises à jour successives).
ANNEXE II
DES MESURES TECHNIQUES ET ORGANISATIONNELLES, Y COMPRIS DES MESURES TECHNIQUES ET ORGANISATIONNELLES VISANT À GARANTIR LA SÉCURITÉ DES DONNÉES
Description des mesures techniques et organisationnelles mises en œuvre par le ou les importateurs de données (y compris toute certification pertinente) pour garantir un niveau de sécurité approprié, compte tenu de la nature, de la portée, du contexte et de la finalité du traitement, ainsi que des risques pour les droits et libertés des personnes physiques.
Les caractéristiques et fonctionnalités de sécurité mises à la disposition du client, décrites dans la clause 4.1 du RGPD, ainsi que dans la documentation relative à la sécurité, et les mesures techniques et organisationnelles décrites dans la clause 4.3(c) du RGPD.
Pour les transferts aux (sous)-traitants, décrivez également les mesures techniques et organisationnelles spécifiques que le (sous)-traitant doit prendre pour pouvoir fournir une assistance au responsable du traitement et, pour les transferts d'un sous-traitant à un soustraitant, à l'exportateur de données.
Les contrôles à la disposition du client décrits dans la clause 4.1 du DPA, tels qu'ils sont décrits dans la documentation relative à la sécurité.
ANNEXE 2 À LA PIÈCE À CONVICTION D
CLAUSES CONTRACTUELLES TYPES
Module 3 : De processeur à processeur
SECTION I
Clause 1
Objectif et champ d'application
(a) Les présentes clauses contractuelles types ont pour objet d'assurer le respect des exigences du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données (règlement général sur la protection des données) ([5] ) pour le transfert de données à caractère personnel vers un pays tiers.
(b) Les parties :
(i) la (les) personne(s) physique(s) ou morale(s), autorité(s) publique(s), agence(s) ou autre(s) organisme(s) (ci-après dénommé(s) "entité(s)") qui transfère(nt) les données à caractère personnel, telles qu'elles sont énumérées à l'annexe I.A (ci-après dénommé(s) "exportateur(s) de données"), et
(ii) l'entité ou les entités d'un pays tiers recevant les données à caractère personnel de l'exportateur de données, directement ou indirectement par l'intermédiaire d'une autre entité également partie aux présentes clauses, dont la liste figure à l'annexe I.A (ci-après dénommée "l'importateur de données")
ont accepté les présentes clauses contractuelles types (ci-après dénommées "clauses").
(c) Les présentes clauses s'appliquent au transfert de données à caractère personnel tel que spécifié à l'annexe I.B.
(d) L'appendice aux présentes clauses contenant les annexes qui y sont mentionnées fait partie intégrante des présentes clauses.
Article 2
Effet et invariabilité des clauses
(a) Les présentes Clauses énoncent des garanties appropriées, y compris des droits opposables aux personnes concernées et des voies de recours effectives, conformément à l'article 46, paragraphe 1, et à l'article 46, paragraphe 2, point c), du règlement (UE) 2016/679 et, en ce qui concerne les transferts de données des responsables du traitement vers les sous-traitants et/ou des sous-traitants vers les sous-traitants, des clauses contractuelles types conformément à l'article 28, paragraphe 7, du règlement (UE) 2016/679, à condition qu'elles ne soient pas modifiées, sauf pour sélectionner le(s) module(s) approprié(s) ou pour ajouter ou mettre à jour des informations dans l'appendice. Le présent site n'empêche pas les Parties d'inclure les clauses contractuelles types établies dans les présentes Clauses dans un contrat plus large et/ou d'ajouter d'autres clauses ou garanties supplémentaires, à condition qu'elles ne contredisent pas, directement ou indirectement, les présentes Clauses ou qu'elles ne portent pas atteinte aux libertés ou droits fondamentaux des personnes concernées.
(b) Les présentes clauses sont sans préjudice des obligations auxquelles l'exportateur de données est soumis en vertu du règlement (UE) 2016/679.
Article 3
Bénéficiaires tiers
(a) Les personnes concernées peuvent invoquer et faire appliquer les présentes clauses, en tant que tiers bénéficiaires, à l'encontre de l'exportateur et/ou de l'importateur de données, avec les exceptions suivantes :
(i) Article 1, article 2, article 3, article 6, article 7 ;
(ii) Clause 8.1(a), (c) et (d) et clause 8.9(a), (c), (d), (e), (f) et (g)
(iii) Article 9, points a), c), d) et e) ;
(iv) Article 12, points a), d) et f) ;
(v) L'article 13 ;
(vi) Clause 15.1(c), (d) et (e) ;
(vii) Article 16, point e) ;
(viii) Article 18, points a) et b).
(b) Le paragraphe a) est sans préjudice des droits des personnes concernées en vertu du règlement (UE) 2016/679.
Article 4
Interprétation
(a) Lorsque les présentes clauses utilisent des termes qui sont définis dans le règlement (UE) 2016/679, ces termes ont la même signification que dans ledit règlement.
(b) Les présentes clauses doivent être lues et interprétées à la lumière des dispositions du règlement (UE) 2016/679.
(c) Les présentes clauses ne doivent pas être interprétées d'une manière qui entre en conflit avec les droits et obligations prévus par le règlement (UE) 2016/679.
Article 5
Hiérarchie
En cas de contradiction entre les présentes clauses et les dispositions des accords connexes entre les parties, existant au moment où les présentes clauses sont convenues ou conclues par la suite, les présentes clauses prévalent.
Article 6
Description du (des) transfert(s)
Les détails du ou des transferts, et en particulier les catégories de données à caractère personnel qui sont transférées et la ou les finalités pour lesquelles elles sont transférées, sont précisés à l'annexe I.B.
Article 7
Clause d'amarrage
[laissé en blanc intentionnellement]
SECTION II - OBLIGATIONS DES PARTIES
Article 8
Garanties en matière de protection des données
L'exportateur de données garantit qu'il a déployé des efforts raisonnables pour déterminer que l'importateur de données est en mesure, grâce à la mise en œuvre de mesures techniques et organisationnelles appropriées, de satisfaire aux obligations qui lui incombent en vertu des présentes clauses.
8.1 Instructions
(a) L'exportateur de données a informé l'importateur de données qu'il agit en tant que sous-traitant selon les instructions de son (ses) responsable(s) du traitement, que l'exportateur de données met à la disposition de l'importateur de données avant le traitement.
(b) L'importateur de données ne traite les données à caractère personnel que sur instruction documentée du responsable du traitement, telle que communiquée à l'importateur de données par l'exportateur de données, et sur toute instruction documentée supplémentaire de l'exportateur de données. Ces instructions supplémentaires ne doivent pas aller à l'encontre des instructions du responsable du traitement. Le responsable du traitement ou l'exportateur de données peut donner d'autres instructions documentées concernant le traitement des données pendant toute la durée du contrat.
(c) L'importateur de données informe immédiatement l'exportateur de données s'il n'est pas en mesure de suivre ces instructions. Lorsque l'importateur de données n'est pas en mesure de suivre les instructions du responsable du traitement, l'exportateur de données en informe immédiatement le responsable du traitement.
(d) L'exportateur de données garantit qu'il a imposé à l'importateur de données les mêmes obligations en matière de protection des données que celles prévues dans le contrat ou autre acte juridique en vertu du droit de l'Union ou de l'État membre conclu entre le responsable du traitement et l'exportateur de données ( ).
8.2 Limitation de l'objet
L'importateur de données ne traite les données à caractère personnel qu'aux fins spécifiques du transfert, telles qu'indiquées à l'annexe I.B., sauf sur instructions supplémentaires du responsable du traitement, communiquées à l'importateur de données par l'exportateur de données, ou par l'exportateur de données.
8.3 Transparence
Sur demande, l'exportateur de données met gratuitement à la disposition de la personne concernée une copie des présentes clauses, y compris l'appendice tel qu'il a été complété par les parties. Dans la mesure où cela est nécessaire pour protéger des secrets d'affaires ou d'autres informations confidentielles, y compris des données à caractère personnel, l'exportateur de données peut expurger une partie du texte de l'appendice avant d'en communiquer une copie, mais il fournit un résumé significatif lorsque la personne concernée ne serait autrement pas en mesure de comprendre son contenu ou d'exercer ses droits. Sur demande, les parties fournissent à la personne concernée les raisons des expurgations, dans la mesure du possible sans révéler les informations expurgées.
8.4 Précision
Si l'importateur de données se rend compte que les données à caractère personnel qu'il a reçues sont inexactes ou périmées, il en informe l'exportateur de données dans les meilleurs délais. Dans ce cas, l'importateur de données coopère avec l'exportateur de données pour rectifier ou effacer les données.
8.5 Durée du traitement et effacement ou restitution des données
Le traitement par l'importateur de données n'a lieu que pour la durée spécifiée à l'annexe I.B. Après la fin de la prestation des services de traitement, l'importateur de données, au choix de l'exportateur de données, supprime toutes les données à caractère personnel traitées pour le compte du responsable du traitement et certifie à l'exportateur de données qu'il l'a fait, ou renvoie à l'exportateur de données toutes les données à caractère personnel traitées pour son compte et supprime les copies existantes. Jusqu'à ce que les données soient supprimées ou renvoyées, l'importateur de données continue de veiller au respect des présentes clauses. Si les lois locales applicables à l'importateur de données interdisent la restitution ou la suppression des données à caractère personnel, l'importateur de données garantit qu'il continuera à assurer le respect des présentes clauses et qu'il ne les traitera que dans la mesure et pour la durée requises par ces lois locales. Ceci est sans préjudice de la clause 14, en particulier de l'obligation faite à l'importateur de données en vertu de la clause 14(e) d'informer l'exportateur de données pendant toute la durée du contrat s'il a des raisons de croire qu'il est ou est devenu soumis à des lois ou des pratiques non conformes aux exigences de la clause 14(a).
8.6 Sécurité du traitement
(a) L'importateur de données et, lors de la transmission, l'exportateur de données mettent en œuvre les mesures techniques et organisationnelles appropriées pour assurer la sécurité des données, y compris la protection contre les violations de la sécurité entraînant accidentellement ou de manière illicite la destruction, la perte, l'altération, la divulgation non autorisée de ces données ou l'accès non autorisé à celles-ci (ci-après dénommées "violations de données à caractère personnel"). Pour évaluer le niveau de sécurité approprié, elles tiennent dûment compte de l'état de la technique, des coûts de mise en œuvre, de la nature, de la portée, du contexte et de la (des) finalité(s) du traitement, ainsi que des risques que le traitement comporte pour la personne concernée. Les parties envisagent en particulier de recourir au cryptage ou à la pseudonymisation, y compris pendant la transmission, lorsque la finalité du traitement peut être atteinte de cette manière. En cas de pseudonymisation, les informations supplémentaires permettant d'attribuer les données à caractère personnel à une personne concernée spécifique restent, dans la mesure du possible, sous le contrôle exclusif de l'exportateur de données ou du responsable du traitement. Pour se conformer aux obligations qui lui incombent en vertu du présent paragraphe, l'importateur de données met au moins en œuvre les mesures techniques et organisationnelles spécifiées à l'annexe II. L'importateur de données effectue des contrôles réguliers pour s'assurer que ces mesures continuent d'offrir un niveau de sécurité approprié.
(b) L'importateur de données n'accorde l'accès aux données aux membres de son personnel que dans la mesure strictement nécessaire à la mise en œuvre, à la gestion et au suivi du contrat. Il veille à ce que les personnes autorisées à traiter les données à caractère personnel se soient engagées à respecter la confidentialité ou soient soumises à une obligation légale appropriée de confidentialité.
(c) En cas de violation de données à caractère personnel concernant des données à caractère personnel traitées par l'importateur de données en vertu des présentes clauses, l'importateur de données prend les mesures appropriées pour remédier à la violation, y compris des mesures pour en atténuer les effets négatifs. L'importateur de données notifie également, dans les meilleurs délais, l'exportateur de données et, le cas échéant et dans la mesure du possible, le responsable du traitement, après avoir pris connaissance de la violation. Cette notification contient les coordonnées d'un point de contact où de plus amples informations peuvent être obtenues, une description de la nature de la violation (y compris, si possible, les catégories et le nombre approximatif de personnes concernées et de dossiers de données à caractère personnel concernés), ses conséquences probables et les mesures prises ou proposées pour remédier à la violation de données, y compris les mesures visant à en atténuer les éventuelles conséquences négatives. Lorsqu'il n'est pas possible de fournir toutes les informations en même temps, et dans la mesure où il n'est pas possible de le faire, la notification initiale contient les informations disponibles à ce moment-là et des informations supplémentaires sont fournies ultérieurement, au fur et à mesure qu'elles sont disponibles, sans retard injustifié.
(d) L'importateur de données coopère avec l'exportateur de données et l'aide à se conformer aux obligations qui lui incombent en vertu du règlement (UE) 2016/679, notamment pour notifier son responsable du traitement afin que ce dernier puisse à son tour notifier l'autorité de contrôle compétente et les personnes concernées, en tenant compte de la nature du traitement et des informations dont dispose l'importateur de données.
8.7 Données sensibles
Lorsque le transfert porte sur des données à caractère personnel qui révèlent l'origine raciale ou ethnique, les opinions politiques, les convictions religieuses ou philosophiques, ou l'appartenance syndicale, des données génétiques ou des données biométriques aux fins d'identifier une personne physique de manière unique, des données concernant la santé ou la vie sexuelle ou l'orientation sexuelle d'une personne, ou des données relatives à des condamnations pénales et à des infractions (ci-après dénommées "données sensibles"), l'importateur de données applique les restrictions spécifiques et/ou les garanties supplémentaires énoncées à l'annexe I, point B.
8.8 Transferts ultérieurs
L'importateur de données ne divulgue les données à caractère personnel à un tiers que sur instructions documentées du responsable du traitement, telles que communiquées à l'importateur de données par l'exportateur de données. En outre, les données ne peuvent être divulguées à un tiers situé en dehors de l'Union européenne ([6] ) (dans le même pays que l'importateur de données ou dans un autre pays tiers, ci-après dénommé "transfert ultérieur") que si le tiers est ou accepte d'être lié par les présentes Clauses, en vertu du Module approprié, ou si :
(i) le transfert ultérieur est effectué vers un pays bénéficiant d'une décision d'adéquation en vertu de l'article 45 du règlement (UE) 2016/679 qui couvre le transfert ultérieur ;
(ii) le tiers assure par ailleurs des garanties appropriées conformément aux articles 46 ou 47 du règlement (UE) 2016/679 ;
(iii) le transfert ultérieur est nécessaire à la constatation, à l'exercice ou à la défense de droits en justice dans le cadre de procédures administratives, réglementaires ou judiciaires spécifiques ; ou
(iv) le transfert ultérieur est nécessaire pour protéger les intérêts vitaux de la personne concernée ou d'une autre personne physique.
Tout transfert ultérieur est subordonné au respect par l'importateur de données de toutes les autres garanties prévues par les présentes clauses, en particulier la limitation de la finalité.
8.9 Documentation et conformité
(a) L'importateur de données traite rapidement et de manière adéquate les demandes de l'exportateur de données ou du responsable du traitement qui ont trait au traitement effectué en vertu des présentes clauses.
(b) Les parties doivent être en mesure de démontrer qu'elles respectent les présentes clauses. En particulier, l'importateur de données conserve une documentation appropriée sur les activités de traitement effectuées pour le compte du responsable du traitement.
(c) L'importateur de données met toutes les informations nécessaires pour démontrer le respect des obligations énoncées dans les présentes clauses à la disposition de l'exportateur de données, qui les communique au responsable du traitement.
(d) L'importateur de données permet à l'exportateur de données d'effectuer des audits des activités de traitement couvertes par les présentes clauses, à des intervalles raisonnables ou s'il existe des indices de non-conformité, et y contribue. Il en va de même lorsque l'exportateur de données demande un audit sur instruction du responsable du traitement. Lorsqu'il décide d'un audit, l'exportateur de données peut prendre en compte les certifications pertinentes détenues par l'importateur de données.
(e) Lorsque l'audit est effectué sur instruction du responsable du traitement, l'exportateur de données met les résultats à la disposition du responsable du traitement.
(f) L'exportateur de données peut choisir d'effectuer l'audit lui-même ou de mandater un auditeur indépendant. Les audits peuvent comprendre des inspections dans les locaux ou les installations physiques de l'importateur de données et sont, le cas échéant, effectués avec un préavis raisonnable.
(g) Les parties mettent les informations visées aux points b) et c), y compris les résultats de tout audit, à la disposition de l'autorité de surveillance compétente qui en fait la demande.
Article 9
Utilisation de sous-traitants
(a) OPTION 2 AUTORISATION GÉNÉRALE ÉCRITE : L'importateur de données dispose de l'autorisation générale du responsable du traitement pour l'engagement de sous-traitants secondaires figurant sur une liste convenue. L'importateur de données informe spécifiquement le responsable du traitement par écrit de toute modification envisagée de cette liste par l'ajout ou le remplacement de sous-traitants ultérieurs au moins 14 jours à l'avance, ce qui donne au responsable du traitement un délai suffisant pour pouvoir s'opposer à ces modifications avant l'engagement du ou des sous-traitants ultérieurs. L'importateur de données fournit au responsable du traitement les informations nécessaires pour lui permettre d'exercer son droit d'opposition. L'importateur de données informe l'exportateur de données de l'engagement du ou des sous-traitants ultérieurs.
(b) Lorsque l'importateur de données engage un sous-traitant ultérieur pour effectuer des activités de traitement spécifiques (pour le compte du responsable du traitement), il le fait au moyen d'un contrat écrit qui prévoit, en substance, les mêmes obligations en matière de protection des données que celles qui lient l'importateur de données en vertu des présentes clauses, y compris en ce qui concerne les droits des tiers bénéficiaires pour les personnes concernées. ([7] ) Les parties conviennent qu'en se conformant à la présente clause, l'importateur de données remplit les obligations qui lui incombent en vertu de la clause 8.8. L'importateur de données veille à ce que le sous-traitant ultérieur respecte les obligations auxquelles l'importateur de données est soumis en vertu de ces clauses.
(c) L'importateur de données fournit, à la demande de l'exportateur de données ou du responsable du traitement, une copie de cet accord de sous-traitance et de toute modification ultérieure. Dans la mesure où cela est nécessaire pour protéger des secrets d'affaires ou d'autres informations confidentielles, y compris des données à caractère personnel, l'importateur de données peut expurger le texte de l'accord avant d'en communiquer une copie.
(d) L'importateur de données reste pleinement responsable vis-à-vis de l'exportateur de données de l'exécution des obligations du sous-traitant ultérieur en vertu de son contrat avec l'importateur de données. L'importateur de données notifie à l'exportateur de données tout manquement du sous-traitant ultérieur aux obligations qui lui incombent en vertu de ce contrat.
(e) L'importateur de données convient avec le sous-traitant ultérieur d'une clause de tiers bénéficiaire en vertu de laquelle - dans le cas où l'importateur de données a effectivement disparu, a cessé d'exister en droit ou est devenu insolvable - l'exportateur de données a le droit de résilier le contrat de sous-traitance ultérieur et d'ordonner au sous-traitant ultérieur d'effacer ou de restituer les données à caractère personnel.
Article 10
Droits des personnes concernées
(a) L'importateur de données notifie sans délai à l'exportateur de données et, le cas échéant, au responsable du traitement, toute demande qu'il a reçue d'une personne concernée, sans répondre à cette demande à moins d'y avoir été autorisé par le responsable du traitement.
(b) L'importateur de données aide, le cas échéant en coopération avec l'exportateur de données, le responsable du traitement à s'acquitter de ses obligations de répondre aux demandes des personnes concernées concernant l'exercice de leurs droits en vertu du règlement (UE) 2016/679 ou du règlement (UE) 2018/1725, selon le cas. À cet égard, les parties définissent à l'annexe II les mesures techniques et organisationnelles appropriées, en tenant compte de la nature du traitement, par lesquelles l'assistance est fournie, ainsi que la portée et l'étendue de l'assistance requise.
(c) En remplissant ses obligations au titre des paragraphes a) et b), l'importateur de données se conforme aux instructions du responsable du traitement, telles qu'elles ont été communiquées par l'exportateur de données.
Article 11
Recours
(a) L'importateur de données informe les personnes concernées, dans un format transparent et aisément accessible, par le biais d'une notification individuelle ou sur son site internet, de l'existence d'un point de contact habilité à traiter les réclamations. Il traite rapidement toute réclamation qu'il reçoit d'une personne concernée.
(b) En cas de litige entre une personne concernée et l'une des parties en ce qui concerne le respect des présentes clauses, cette partie met tout en œuvre pour résoudre le problème à l'amiable en temps utile. Les parties se tiennent mutuellement informées de ces litiges et, le cas échéant, coopèrent pour les résoudre.
(c) Lorsque la personne concernée invoque un droit de tiers bénéficiaire en vertu de la clause 3, l'importateur de données accepte la décision de la personne concernée :
(i) déposer une plainte auprès de l'autorité de contrôle de l'État membre de sa résidence habituelle ou de son lieu de travail, ou auprès de l'autorité de contrôle compétente en vertu de la clause 13 ;
(ii) porter le litige devant les tribunaux compétents au sens de la clause 18.
(d) Les parties acceptent que la personne concernée puisse être représentée par un organisme, une organisation ou une association à but non lucratif dans les conditions prévues à l'article 80, paragraphe 1, du règlement (UE) 2016/679.
(e) L'importateur de données doit se conformer à une décision contraignante en vertu du droit de l'UE ou de l'État membre applicable.
(f) L'importateur de données convient que le choix effectué par la personne concernée ne portera pas atteinte à ses droits substantiels et procéduraux de demander réparation conformément aux lois applicables.
Article 12
Responsabilité
(a) Chaque partie est responsable à l'égard de l'autre ou des autres parties de tout dommage qu'elle cause à l'autre ou aux autres parties en raison d'une violation des présentes clauses.
(b) L'importateur de données est responsable envers la personne concernée, et la personne concernée a le droit d'être indemnisée, pour tout dommage matériel ou moral que l'importateur de données ou son sous-traitant secondaire cause à la personne concernée en violant les droits du tiers bénéficiaire en vertu des présentes clauses.
(c) Nonobstant le paragraphe b), l'exportateur de données est responsable envers la personne concernée, et la personne concernée a le droit de recevoir une indemnisation, pour tout dommage matériel ou moral que l'exportateur de données ou l'importateur de données (ou son sous-traitant ultérieur) cause à la personne concernée en violant les droits du tiers bénéficiaire en vertu des présentes Clauses. Ceci est sans préjudice de la responsabilité de l'exportateur de données et, lorsque l'exportateur de données est un sous-traitant agissant pour le compte d'un responsable du traitement, de la responsabilité du responsable du traitement en vertu du règlement (UE) 2016/679 ou du règlement (UE) 2018/1725, selon le cas.
(d) Les parties conviennent que si l'exportateur de données est tenu responsable, en vertu du paragraphe c), des dommages causés par l'importateur de données (ou son sous-traitant), il a le droit de réclamer à l'importateur de données la partie de l'indemnisation correspondant à la responsabilité de l'importateur de données dans le dommage.
(e) Lorsque plusieurs parties sont responsables de tout dommage causé à la personne concernée à la suite d'une violation des présentes clauses, toutes les parties responsables sont conjointement et solidairement responsables et la personne concernée a le droit d'intenter une action en justice contre l'une quelconque de ces parties.
(f) Les parties conviennent que si l'une d'entre elles est tenue pour responsable en vertu du paragraphe (e), elle est en droit de réclamer à l'autre (aux autres) partie(s) la part de l'indemnisation correspondant à sa (leur) responsabilité dans le dommage.
(g) L'importateur de données ne peut pas invoquer le comportement d'un sous-traitant ultérieur pour se soustraire à sa propre responsabilité.
Article 13
Supervision
(a) [Lorsque l'exportateur de données est établi dans un État membre de l'UE :] L'autorité de contrôle chargée de veiller au respect par l'exportateur de données du règlement (UE) 2016/679 en ce qui concerne le transfert de données, comme indiqué à l'annexe I.C, agit en tant qu'autorité de contrôle compétente.
[Lorsque l'exportateur de données n'est pas établi dans un État membre de l'UE, mais relève du champ d'application territorial du règlement (UE) 2016/679 conformément à son article 3, paragraphe 2, et a désigné un représentant conformément à l'article 27, paragraphe 1, du règlement (UE) 2016/679 :]. L'autorité de contrôle de l'État membre dans lequel le représentant au sens de l'article 27, paragraphe 1, du règlement (UE) 2016/679 est établi, comme indiqué à l'annexe I.C, agit en tant qu'autorité de contrôle compétente.
[Lorsque l'exportateur de données n'est pas établi dans un État membre de l'UE, mais relève du champ d'application territorial du règlement (UE) 2016/679 conformément à son article 3, paragraphe 2, sans toutefois devoir désigner un représentant conformément à l'article 27, paragraphe 2, du règlement (UE) 2016/679 :]. L'autorité de contrôle de l'un des États membres dans lesquels se trouvent les personnes concernées dont les données à caractère personnel sont transférées en vertu des présentes clauses en relation avec l'offre de biens ou de services qui leur est faite, ou dont le comportement est suivi, comme indiqué à l'annexe I.C, agit en tant qu'autorité de contrôle compétente.
(b) L'importateur de données accepte de se soumettre à la juridiction de l'autorité de contrôle compétente et de coopérer avec elle dans le cadre de toute procédure visant à assurer le respect des présentes clauses. En particulier, l'importateur de données accepte de répondre aux demandes de renseignements, de se soumettre à des audits et de se conformer aux mesures adoptées par l'autorité de contrôle, y compris les mesures correctives et compensatoires. Il fournit à l'autorité de contrôle la confirmation écrite que les mesures nécessaires ont été prises.
SECTION III - LOIS ET OBLIGATIONS LOCALES EN CAS D'ACCÈS PAR LES AUTORITÉS PUBLIQUES
Article 14
Lois et pratiques locales affectant le respect des clauses
(a) Les parties garantissent qu'elles n'ont aucune raison de croire que les lois et pratiques du pays tiers de destination applicables au traitement des données à caractère personnel par l'importateur de données, y compris toute obligation de divulguer des données à caractère personnel ou toute mesure autorisant l'accès des autorités publiques, empêchent l'importateur de données de remplir les obligations qui lui incombent en vertu des présentes clauses. Il est entendu que les lois et pratiques qui respectent l'essence des droits et libertés fondamentaux et n'excèdent pas ce qui est nécessaire et proportionné dans une société démocratique pour sauvegarder l'un des objectifs énumérés à l'article 23, paragraphe 1, du règlement (UE) 2016/679, ne sont pas en contradiction avec les présentes Clauses.
(b) Les parties déclarent qu'en fournissant la garantie visée au paragraphe (a), elles ont tenu dûment compte, en particulier, des éléments suivants :
(i) les circonstances particulières du transfert, notamment la longueur de la chaîne de traitement, le nombre d'acteurs impliqués et les canaux de transmission utilisés ; les transferts ultérieurs envisagés ; le type de destinataire ; la finalité du traitement ; les catégories et le format des données à caractère personnel transférées ; le secteur économique dans lequel le transfert a lieu ; le lieu de stockage des données transférées ;
(ii) les lois et pratiques du pays tiers de destination - y compris celles exigeant la divulgation de données aux autorités publiques ou autorisant l'accès de ces autorités - pertinentes à la lumière des circonstances particulières du transfert, ainsi que les limitations et garanties applicables ( ) ;[8]
(iii) toute garantie contractuelle, technique ou organisationnelle pertinente mise en place pour compléter les garanties prévues par les présentes clauses, y compris les mesures appliquées lors de la transmission et du traitement des données à caractère personnel dans le pays de destination.
(c) L'importateur de données garantit que, dans le cadre de l'évaluation visée au point b), il s'est efforcé de fournir à l'exportateur de données les informations pertinentes et convient qu'il continuera à coopérer avec l'exportateur de données pour assurer le respect des présentes clauses.
(d) Les parties conviennent de documenter l'évaluation visée au point b) et de la mettre à la disposition de l'autorité de surveillance compétente sur demande.
(e) L'importateur de données accepte de notifier rapidement à l'exportateur de données si, après avoir accepté les présentes clauses et pendant la durée du contrat, il a des raisons de croire qu'il est ou est devenu soumis à des lois ou à des pratiques non conformes aux exigences du paragraphe a), y compris à la suite d'une modification des lois du pays tiers ou d'une mesure (telle qu'une demande de divulgation) indiquant une application de ces lois dans la pratique qui n'est pas conforme aux exigences du paragraphe a). L'exportateur de données transmet la notification au responsable du traitement.
(f) la suite d'une notification en vertu du paragraphe e), ou si l'exportateur de données a par ailleurs des raisons de croire que l'importateur de données ne peut plus remplir ses obligations au titre des présentes clauses , l'exportateur de données identifie rapidement les mesures appropriées (par exemple, les mesures techniques ou organisationnelles visant à garantir la sécurité et la confidentialité) à adopter par l'exportateur de données et/ou l'importateur de données pour remédier à la situation, le cas échéant en consultation avec le responsable du traitement. L'exportateur de données suspend le transfert de données s'il estime qu'aucune garantie appropriée ne peut être assurée pour ce transfert, ou si le responsable du traitement ou l'autorité de contrôle compétente lui en donne l'instruction. Dans ce cas, l'exportateur de données a le droit de résilier le contrat, dans la mesure où il concerne le traitement de données à caractère personnel en vertu des présentes clauses. Si le contrat implique plus de deux parties, l'exportateur de données ne peut exercer ce droit de résiliation qu'à l'égard de la partie concernée, à moins que les parties n'en aient convenu autrement. Lorsque le contrat est résilié en vertu de la présente clause, la clause 16, points d) et e), s'applique.
Article 15
Obligations de l'importateur de données en cas d'accès par les autorités publiques
15.1 Notification
(a) L'importateur de données s'engage à notifier rapidement à l'exportateur de données et, si possible, à la personne concernée (si nécessaire avec l'aide de l'exportateur de données), s'il
(i) reçoit une demande juridiquement contraignante émanant d'une autorité publique, y compris des autorités judiciaires, en vertu des lois du pays de destination, en vue de la divulgation de données à caractère personnel transférées conformément aux présentes clauses ; cette notification comprend des informations sur les données à caractère personnel demandées, l'autorité requérante, la base juridique de la demande et la réponse apportée ; ou
(ii) a connaissance d'un accès direct des autorités publiques aux données à caractère personnel transférées en vertu des présentes clauses, conformément à la législation du pays de destination ; cette notification comprend toutes les informations dont dispose l'importateur.
L'exportateur de données transmet la notification au responsable du traitement.
(b) Si la législation du pays de destination interdit à l'importateur de données de notifier l'exportateur de données et/ou la personne concernée, l'importateur de données s'engage à faire de son mieux pour obtenir une dérogation à l'interdiction, en vue de communiquer le plus d'informations possible, dans les meilleurs délais. L'importateur de données accepte de documenter ses meilleurs efforts afin de pouvoir les démontrer à la demande de l'exportateur de données.
(c) Si la législation du pays de destination le permet, l'importateur de données accepte de fournir à l'exportateur de données, à intervalles réguliers pendant la durée du contrat, autant d'informations pertinentes que possible sur les demandes reçues (en particulier, le nombre de demandes, le type de données demandées, l'autorité/les autorités requérante(s), si les demandes ont été contestées et l'issue de ces contestations, etc. L'exportateur de données transmet les informations au responsable du traitement.
(d) L'importateur de données s'engage à conserver les informations visées aux paragraphes a) à c) pendant la durée du contrat et à les mettre à la disposition de l'autorité de contrôle compétente sur demande.
(e) Les paragraphes a) à c) sont sans préjudice de l'obligation de l'importateur de données, conformément à la clause 14, point e), et à la clause 16, d'informer rapidement l'exportateur de données lorsqu'il n'est pas en mesure de se conformer à ces clauses.
15.2 Examen de la légalité et de la minimisation des données
(a) L'importateur de données accepte d'examiner la légalité de la demande de divulgation, en particulier de vérifier si elle reste dans les limites des pouvoirs accordés à l'autorité publique requérante, et de contester la demande si, après une évaluation minutieuse, il conclut qu'il y a des motifs raisonnables de considérer que la demande est illégale en vertu des lois du pays de destination, des obligations applicables en vertu du droit international et des principes de la courtoisie internationale. L'importateur de données exerce, dans les mêmes conditions, les voies de recours. Lorsqu'il conteste une demande, l'importateur de données demande des mesures provisoires en vue de suspendre les effets de la demande jusqu'à ce que l'autorité judiciaire compétente ait statué sur son bien-fondé. Il ne divulgue pas les données à caractère personnel demandées tant qu'il n'est pas tenu de le faire en vertu des règles de procédure applicables. Ces exigences sont sans préjudice des obligations de l'importateur de données au titre de la clause 14, point e).
(b) L'importateur de données accepte de documenter son évaluation juridique et toute contestation de la demande de divulgation et, dans la mesure où la législation du pays de destination le permet, de mettre la documentation à la disposition de l'exportateur de données. Il la met également à la disposition de l'autorité de contrôle compétente sur demande. L'exportateur de données met l'évaluation à la disposition du responsable du traitement.
(c) L'importateur de données s'engage à fournir la quantité minimale d'informations autorisée lorsqu'il répond à une demande de divulgation, sur la base d'une interprétation raisonnable de la demande.
SECTION IV - DISPOSITIONS FINALES
Article 16
Non-respect des clauses et résiliation
(a) L'importateur de données informe rapidement l'exportateur de données s'il n'est pas en mesure de respecter les présentes clauses, quelle qu'en soit la raison.
(b) Si l'importateur de données ne respecte pas les présentes clauses ou n'est pas en mesure de les respecter, l'exportateur de données suspend le transfert de données à caractère personnel à l'importateur de données jusqu'à ce que la conformité soit à nouveau assurée ou que le contrat soit résilié. Cette disposition est sans préjudice de la clause 14, point f).
(c) L'exportateur de données a le droit de résilier le contrat, dans la mesure où il concerne le traitement de données à caractère personnel en vertu des présentes clauses, lorsque :
(i) l'exportateur de données a suspendu le transfert de données à caractère personnel à l'importateur de données conformément au paragraphe b) et le respect des présentes clauses n'est pas rétabli dans un délai raisonnable et, en tout état de cause, dans un délai d'un mois à compter de la suspension ;
(ii) l'importateur de données enfreint de manière substantielle ou persistante les présentes clauses ; ou
(iii) l'importateur de données ne se conforme pas à une décision contraignante d'un tribunal compétent ou d'une autorité de contrôle concernant les obligations qui lui incombent en vertu des présentes clauses.
Dans ces cas, il informe l'autorité de contrôle compétente et le responsable du traitement de ce non-respect. Lorsque le contrat implique plus de deux parties, l'exportateur de données ne peut exercer ce droit de résiliation qu'à l'égard de la partie concernée, à moins que les parties n'en aient convenu autrement.
(d) Les données à caractère personnel qui ont été transférées avant la résiliation du contrat conformément au paragraphe c) sont, au choix de l'exportateur de données, immédiatement renvoyées à l'exportateur de données ou effacées dans leur intégralité. Il en va de même pour toute copie des données. L'importateur de données certifie l'effacement des données à l'exportateur de données. Jusqu'à ce que les données soient effacées ou renvoyées, l'importateur de données continue de veiller au respect des présentes clauses. Si la législation locale applicable à l'importateur de données interdit la restitution ou la suppression des données à caractère personnel transférées, l'importateur de données garantit qu'il continuera à veiller au respect des présentes clauses et qu'il ne traitera les données que dans la mesure et pour la durée requises par cette législation locale.
(e) Chaque partie peut révoquer son accord d'être liée par les présentes clauses lorsque (i) la Commission européenne adopte une décision en vertu de l'article 45, paragraphe 3, du règlement (UE) 2016/679 qui couvre le transfert de données à caractère personnel auquel les présentes clauses s'appliquent ; ou (ii) le règlement (UE) 2016/679 devient partie intégrante du cadre juridique du pays vers lequel les données à caractère personnel sont transférées. Ceci est sans préjudice d'autres obligations s'appliquant au traitement en question en vertu du règlement (UE) 2016/679.
Article 17
Droit applicable
Les présentes clauses sont régies par le droit de l'un des États membres de l'Union européenne, à condition que ce droit autorise les droits des tiers bénéficiaires. Les parties conviennent que le droit irlandais sera applicable.
Article 18
Choix du for et de la juridiction
(a)Tout litige découlant des présentes clauses sera réglé par les tribunaux d'un État membre de l'UE.
(b) Les parties conviennent que ces tribunaux seront ceux de l'Irlande.
(c) Une personne concernée peut également intenter une action en justice contre l'exportateur de données et/ou l'importateur de données devant les tribunaux de l'État membre dans lequel elle a sa résidence habituelle.
(d) Les parties conviennent de se soumettre à la compétence de ces tribunaux.
ANNEXE
ANNEXE I
A. LISTE DES PARTIES
Exportateur(s) de données :
Nom : Nom du client tel qu'indiqué dans le contrat.
Adresse : Adresse du client telle que mentionnée dans le contrat.
Nom, fonction et coordonnées de la personne de contact : Point de contact pour le client, comme indiqué dans l'accord.
Activités en rapport avec les données transférées en vertu des présentes clauses : Client dans le cadre de l'accord
Rôle (contrôleur/processeur) : Processeur
Importateur(s) de données :
Nom : Nom de Palantir tel qu'indiqué dans l'accord.
Adresse : Adresse de Palantir telle que mentionnée dans l'accord.
Nom, fonction et coordonnées de la personne de contact : Délégué à la protection des données, dpo@palantir.com
Activités en rapport avec les données transférées en vertu des présentes clauses : Fournisseur dans le cadre de l'accord
Rôle (contrôleur/processeur) : Processeur
B. DESCRIPTION DU TRANSFERT
Catégories de personnes concernées dont les données à caractère personnel sont transférées
Comme décrit dans la section "Catégories de personnes dont les données à caractère personnel peuvent faire l'objet d'un traitement" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
Catégories de données à caractère personnel transférées
Comme décrit dans les "Catégories de données à caractère personnel du client" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
Données sensibles transférées (le cas échéant) et restrictions ou garanties appliquées qui tiennent pleinement compte de la nature des données et des risques encourus, comme par exemple une limitation stricte de la finalité, des restrictions d'accès (y compris un accès réservé au personnel ayant suivi une formation spécialisée), la tenue d'un registre d'accès aux données, des restrictions pour les transferts ultérieurs ou des mesures de sécurité supplémentaires.
Les données personnelles révélant l'origine raciale ou ethnique, les opinions politiques, les croyances religieuses ou philosophiques, ou l'appartenance syndicale, les données génétiques, les données biométriques, les données de santé, les données concernant la vie sexuelle ou l'orientation sexuelle d'une personne physique, dans la mesure où les Données Personnelles du Client comprennent de telles données sensibles et sont fournies à Palantir pour le Traitement (y compris via le Service) par ou sur l'ordre du Client ou des Utilisateurs du Client. Dans ce cas, le Client identifiera clairement ces données sensibles à Palantir par écrit avant de les fournir. Les garanties et restrictions appliquées sont décrites à l'annexe II.
La fréquence du transfert (par exemple, si les données sont transférées de manière ponctuelle ou continue).
De manière continue.
Nature du traitement
Comme décrit dans la section "Nature et finalité du traitement" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
Finalité(s) du transfert et du traitement ultérieur des données
Comme décrit dans la section "Nature et finalité du traitement" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
la durée de conservation des données à caractère personnel ou, si cela n'est pas possible, les critères utilisés pour déterminer cette durée
Comme décrit à la rubrique "Durée du traitement" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
Pour les transferts aux (sous-)traitants, préciser également l'objet, la nature et la durée du traitement.
Comme décrit à la rubrique "Objet, nature et durée du traitement par les sous-traitants ultérieurs" de l'annexe B et, le cas échéant, dans toute autre annexe pertinente pour les services supplémentaires applicables.
C. AUTORITÉ DE SURVEILLANCE COMPÉTENTE
Identifier la ou les autorité(s) de contrôle compétente(s) conformément à la clause 13
L'autorité de contrôle déterminée conformément à la clause 13 et précisée à l'adresse https://edpb.europa.eu/about-edpb/about-edpb/members_en (avec ses mises à jour successives).
ANNEXE II
DES MESURES TECHNIQUES ET ORGANISATIONNELLES, Y COMPRIS DES MESURES TECHNIQUES ET ORGANISATIONNELLES VISANT À GARANTIR LA SÉCURITÉ DES DONNÉES
Description des mesures techniques et organisationnelles mises en œuvre par le ou les importateurs de données (y compris toute certification pertinente) pour garantir un niveau de sécurité approprié, compte tenu de la nature, de la portée, du contexte et de la finalité du traitement, ainsi que des risques pour les droits et libertés des personnes physiques.
Les caractéristiques et fonctionnalités de sécurité mises à la disposition du client et décrites dans le DPA, ainsi que la documentation relative à la sécurité, et les mesures techniques et organisationnelles décrites dans le DPA.
Pour les transferts aux (sous)-traitants, décrivez également les mesures techniques et organisationnelles spécifiques que le (sous)-traitant doit prendre pour pouvoir fournir une assistance au responsable du traitement et, pour les transferts d'un sous-traitant à un soustraitant, à l'exportateur de données.
Les contrôles à la disposition du client décrits dans le DPA, tels qu'ils sont décrits dans la documentation de sécurité.
- Lorsque l'exportateur de données est un sous-traitant soumis au règlement (UE) 2016/679 agissant pour le compte d'une institution ou d'un organe de l'Union en tant que responsable du traitement, le recours à ces clauses lorsqu'il fait appel à un autre sous-traitant (sous-traitance secondaire) non soumis au règlement (UE) 2016/679 garantit également le respect de l'article 29, paragraphe 4, du règlement (UE) 2018/1725 du Parlement européen et du Conseil du 23 octobre 2018 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel par les institutions de l'Union, organes et agences de l'Union et à la libre circulation de ces données, et abrogeant le règlement (CE) n° 45/2001 et la décision n° 1247/2002/CE (JO L 295 du 21.11.2018, p. 39), dans la mesure où les présentes clauses et les obligations en matière de protection des données énoncées dans le contrat ou autre acte juridique entre le responsable du traitement et le sous-traitant conformément à l'article 29, paragraphe 3, du règlement (UE) 2018/1725 sont alignées. Ce sera notamment le cas lorsque le responsable du traitement et le sous-traitant s'appuient sur les clauses contractuelles types incluses dans la décision 2021/915. ↑
- L'accord sur l'Espace économique européen (accord EEE) prévoit l'extension du marché intérieur de l'Union européenne aux trois États de l'EEE que sont l'Islande, le Liechtenstein et la Norvège. La législation de l'Union en matière de protection des données, y compris le règlement (UE) 2016/679, est couverte par l'accord EEE et a été incorporée à l'annexe XI de celui-ci. Par conséquent, toute divulgation par l'importateur de données à un tiers situé dans l'EEE n'est pas considérée comme un transfert ultérieur aux fins des présentes clauses. ↑
- Cette exigence peut être satisfaite par l'adhésion du sous-traitant ultérieur aux présentes clauses dans le cadre du module approprié, conformément à la clause 7. ↑
- En ce qui concerne l'impact de ces lois et pratiques sur le respect de ces clauses, différents éléments peuvent être pris en compte dans le cadre d'une évaluation globale. Ces éléments peuvent inclure une expérience pratique pertinente et documentée de cas antérieurs de demandes de divulgation de la part des autorités publiques, ou l'absence de telles demandes, couvrant une période suffisamment représentative. Il s'agit en particulier de registres internes ou d'autres documents, établis de manière continue conformément au principe de diligence raisonnable et certifiés au niveau de la direction générale, pour autant que ces informations puissent être légalement partagées avec des tiers. Lorsque cette expérience pratique est invoquée pour conclure que l'importateur de données ne sera pas empêché de se conformer à ces clauses, elle doit être étayée par d'autres éléments pertinents et objectifs, et il appartient aux parties d'examiner attentivement si ces éléments ont, ensemble, un poids suffisant, en termes de fiabilité et de représentativité, pour étayer cette conclusion. En particulier, les parties doivent examiner si leur expérience pratique est corroborée et non contredite par des informations fiables, disponibles publiquement ou autrement accessibles, sur l'existence ou l'absence de demandes dans le même secteur et/ou sur l'application de la loi dans la pratique, telles que la jurisprudence et les rapports d'organismes de contrôle indépendants. ↑
- Lorsque l'exportateur de données est un sous-traitant soumis au règlement (UE) 2016/679 agissant pour le compte d'une institution ou d'un organe de l'Union en tant que responsable du traitement, le recours à ces clauses lorsqu'il fait appel à un autre sous-traitant (sous-traitance secondaire) non soumis au règlement (UE) 2016/679 garantit également le respect de l'article 29, paragraphe 4, du règlement (UE) 2018/1725 du Parlement européen et du Conseil du 23 octobre 2018 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel par les institutions de l'Union, organes et agences de l'Union et à la libre circulation de ces données, et abrogeant le règlement (CE) n° 45/2001 et la décision n° 1247/2002/CE (JO L 295 du 21.11.2018, p. 39), dans la mesure où les présentes clauses et les obligations en matière de protection des données énoncées dans le contrat ou autre acte juridique entre le responsable du traitement et le sous-traitant conformément à l'article 29, paragraphe 3, du règlement (UE) 2018/1725 sont alignées. Ce sera notamment le cas lorsque le responsable du traitement et le sous-traitant s'appuient sur les clauses contractuelles types incluses dans la décision 2021/915. ↑
- L'accord sur l'Espace économique européen (accord EEE) prévoit l'extension du marché intérieur de l'Union européenne aux trois États de l'EEE que sont l'Islande, le Liechtenstein et la Norvège. La législation de l'Union en matière de protection des données, y compris le règlement (UE) 2016/679, est couverte par l'accord EEE et a été incorporée à l'annexe XI de celui-ci. Par conséquent, toute divulgation par l'importateur de données à un tiers situé dans l'EEE n'est pas considérée comme un transfert ultérieur aux fins des présentes clauses. ↑
- Cette exigence peut être satisfaite par l'adhésion du sous-traitant ultérieur aux présentes clauses dans le cadre du module approprié, conformément à la clause 7. ↑
- En ce qui concerne l'impact de ces lois et pratiques sur le respect de ces clauses, différents éléments peuvent être pris en compte dans le cadre d'une évaluation globale. Ces éléments peuvent inclure une expérience pratique pertinente et documentée de cas antérieurs de demandes de divulgation de la part des autorités publiques, ou l'absence de telles demandes, couvrant une période suffisamment représentative. Il s'agit en particulier de registres internes ou d'autres documents, établis de manière continue conformément au principe de diligence raisonnable et certifiés au niveau de la direction générale, pour autant que ces informations puissent être légalement partagées avec des tiers. Lorsque cette expérience pratique est invoquée pour conclure que l'importateur de données ne sera pas empêché de se conformer à ces clauses, elle doit être étayée par d'autres éléments pertinents et objectifs, et il appartient aux parties d'examiner attentivement si ces éléments ont, ensemble, un poids suffisant, en termes de fiabilité et de représentativité, pour étayer cette conclusion. En particulier, les parties doivent examiner si leur expérience pratique est corroborée et non contredite par des informations fiables, disponibles publiquement ou autrement accessibles, sur l'existence ou l'absence de demandes dans le même secteur et/ou sur l'application de la loi dans la pratique, telles que la jurisprudence et les rapports d'organismes de contrôle indépendants. ↑