1. DEFINITIONS AND INTERPRETATION

“Authorised User” means an individual whom You authorise to access the Sandbox in accordance with these terms.

“Your Data” means data, content or materials submitted to or otherwise processed through the Sandbox by or on Your behalf, including Personal Data.

"Exporter” means any controller or processor located in a regulated jurisdiction processing Personal Data which transfers Personal Data outside the regulated jurisdiction in which it is located.

“Sandbox” means the non-production environment made available by Us solely for testing and evaluation the Go platform.

“Personal Data” means any information relating to an identified or identifiable natural person or household, and includes “personal data”, “personal information”, “personally identifiable information” and any equivalent concept protected under applicable Data Protection Laws.

“Applicable Data Protection Laws” means all worldwide data protection and privacy laws and regulations applicable to the Customer Data (as defined below) including, as applicable, (I) Regulation 2016/679 (General Data Protection Regulation) (the "EU GDPR"); (ii) the EU e-Privacy Directive (Directive 2002/58/EC); (iii) any and all applicable national law made under or pursuant to (i) or (ii); (iv) the EU GDPR as it is saved and incorporated into UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR"); and (v) the California Consumer Privacy Act of 2018 and its corresponding regulations, as amended by the California Privacy Rights Act (collectively the “CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, and any other comprehensive US state privacy laws; and (vi) any amendment, consolidation or re-enactment thereof, any legislation of equivalent purpose or effect enacted, and any orders, guidelines, guidance and instructions issued under any of the above or by any other relevant national authorities;

"Importer” means any controller or processor processing personal data who receives personal data from the data Exporter under a Restricted Transfer.

“Personal Data Breach” means a confirmed breach of security, a “notification incident”, “breach of system security”, “breach of security of the system”, “security breach”, or analogous term under Applicable Data Protection Laws leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorized access to, Personal Data processed under this Agreement, including any that requires notification to a controller, regulator or affected individual under Applicable Data Protection Laws.

“Restricted Transfer” means a transfer of personal data that requires a transfer mechanism, localisation measure or other safeguard under applicable Data Protection Laws.

“Standard Contractual Clauses” means (i) where EU GDPR applies, the standard contractual clauses approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 available at http://data.europa.eu/eli/dec_impl/2021/914/oj (“EU SCCs”); and (ii) where the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR  issued by the UK’s Information Commissioner’s Office in accordance with s119A of the Data Protection Act 2018. (“UK Addendum”).

“Subprocessor” means any third party appointed by or on behalf of Us to process Personal Data in connection with the Sandbox.

“Supervisory Authority” means an independent public authority which is established by a Member State pursuant to Article 51 of GDPR.

Headings do not affect interpretation. References to “including” are illustrative and do not limit the preceding words.

2. ACCESS AND TERM

2.1 We grant You a limited, non-exclusive, non-transferable and revocable right for Your Authorised Users to access and use the Sandbox for as long as You continue to use it, unless and until We revoke access.

2.2 Access is provided free of charge. We are not obliged to continue providing the Sandbox, convert access into a paid service or provide any production service.

2.3 We may impose or change reasonable usage, user, storage or technical limits at any time.

3. SANDBOX LIMITATIONS

3.1 The Sandbox is a test environment only. It must not be used for live, operational, production, commercial, compliance, identity-verification, fraud-prevention or decision-making purposes.

3.2 Any examples, responses or outputs returned by the Sandbox are simulated, synthetic, dummy and must not be treated as genuine verification results or relied upon by You.  

3.3 We may modify, reset, restrict, suspend or withdraw the Sandbox, its functionality or any content at any time without liability.

4. YOUR OBLIGATIONS

4.1 You must use the Sandbox only for Your internal testing and evaluation purposes and in accordance with these Sandbox Terms and any reasonable instructions issued by Us.

4.2 You must ensure that only Authorised Users access the Sandbox, keep credentials secure, promptly notify Us of suspected unauthorised access and remain responsible for Your Authorised Users.

4.3 You must not:

• use the Sandbox in production or to provide services to any third party;

• resell, sublicense, distribute or otherwise make the Sandbox available to any third party;

• circumvent security or usage controls, introduce malicious code, interfere with the Sandbox, or attempt unauthorised access;

• conduct penetration testing, vulnerability scanning or other security testing of the Sandbox without GBG’s prior written consent;

• reverse engineer, decompile, disassemble, copy or create derivative works of the Sandbox except to the extent that applicable law prevents this restriction; or

• use the Sandbox unlawfully or in a way that infringes any third-party rights.

4.4 Uploads. You must and shall ensure that Your Authorised Users do not provide, upload, submit or otherwise make available, through the Sandbox, any unrelated or sensitive information, including but not limited to bank account details, social security numbers (SSN), financial information, sensitive personal information as defined under Applicable Data Protection Law, non public personal information subject to Gramm-Leach-Billey-Act, personal health information subject to the Health Insurance Portability and Accountability Act or malicious content (collectively, “Prohibited Material”). Any information you provide must be limited to the information that reasonably necessary to the applicable test scenario and must exclude any Prohibited Material. We shall not be liable to You or any claim made by a third party for loss, damage, or liability arising from Your failure to comply with the provisions of this clause.

5. DATA PROTECTION

5.1 Roles and processing. You are the controller, business or equivalent responsible organisation and appoint Us as Your processor or service provider, as applicable, for Personal Data processed through the Sandbox. We will process Personal Data only on Your documented instructions and as necessary to provide, secure and administer the Sandbox, unless applicable law requires otherwise, in which case We will notify You beforehand unless prohibited.

5.2 Your responsibilities. You are responsible for the lawfulness, fairness, transparency, accuracy and minimisation of Your Data; all required notices, rights, permissions and consents; and determining that the Sandbox and its security are appropriate for the intended processing. You must not issue unlawful instructions, and We may suspend processing after notifying You if We reasonably consider an instruction unlawful. You acknowledge that the Sandbox is intended for test and evaluation data only. This we recommend that You do not submit Personal Data to the Sandbox and instead use synthetic, or anoymized data where reasonable practicable and You remain solely responsible for any decision to submit Personal Data to the Sandbox. You remain responsible for establishing the lawful basis for the processing, providing required notices and obtaining any necessary consents of such Personal Data.  

5.3 Confidentiality and security. We will ensure that persons authorised to process Personal Data are bound by confidentiality obligations and will maintain appropriate technical and organisational measures, taking into account the state of the art, implementation costs, the processing and risks to individuals, to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. You are responsible for securely configuring and using the Sandbox, controlling Authorised Users and credentials, and protecting systems and copies of Your Data under Your control.

5.4 Subprocessors. You generally authorise Us to appoint Subprocessors. We will impose materially equivalent written data-protection obligations and remain responsible for their performance. Where required by Applicable Data Protection Laws, We will make information about Our current Subprocessors available and give reasonable prior notice of changes. You may object within the notified period on reasonable data-protection grounds; if the Parties cannot resolve the objection in good faith, We may terminate the affected Sandbox access.

5.5 Assistance and Personal Data Breaches. Taking into account the nature of processing and information available to Us, We will reasonably assist You with individuals’ rights requests and Your obligations concerning security, Personal Data Breaches, impact or risk assessments and regulatory consultations. If We receive a rights request relating to Your Data, We will notify You and respond only on Your documented instructions or where required by law. We will notify You without undue delay after becoming aware of a Personal Data Breach affecting Your Data and provide information reasonably available to assist You with applicable notification obligations. You remain responsible for deciding whether and how to notify any regulator, individual or other person.

5.6 International transfers. We may process Personal Data where We or Our Subprocessors operate but will not make a Restricted Transfer unless a lawful transfer mechanism or other recognised safeguard is in place. Where required, the Standard Contractual Clauses apply as set out in Annex A. Where permitted, You authorise Us to enter into and rely on an applicable transfer mechanism on Your behalf.

5.7 US privacy terms. Where US Applicable Data Protection Laws apply, We act as Your service provider and process Personal Data only for the specific purposes in clause 5.1, on Your documented instructions and within Our direct business relationship with You.

For the purposes of this clause, “FCRA” means the US Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. You acknowledge and agree that: (a) the Sandbox is not provided by a “consumer reporting agency”, and neither the Sandbox nor any output constitutes a “consumer report”, as defined in the FCRA; and (b) the Sandbox and any output must not be used as a factor in determining eligibility for credit, insurance, employment or any other purpose for which a consumer report may be used under the FCRA or any similar consumer credit law in the United States of America.

We will not: (a) sell or share Personal Data; (b) use it for targeted or cross-context behavioural advertising; (c) retain, use or disclose it outside the purposes in clause 5.1 or outside Our direct business relationship with You; or (d) combine it with personal information received from another person or collected through Our own interaction with an individual. We certify that We understand and will comply with these restrictions.

We will provide the same level of privacy protection required of You under applicable US state privacy laws, permit You to take reasonable and appropriate steps to help ensure compliance, notify You if We can no longer comply and, on notice of unauthorised use, stop and remediate it. Taking into account the nature of processing, We will reasonably assist You with verified consumer requests, opt-out or consent obligations, assessments and regulatory enquiries relating to Your Data.

We will require each Subprocessor processing US Personal Data to be bound by written terms that provide materially equivalent protection. For clarity, no product-specific, financial-services, biometric, health-data or other sector-specific provisions apply unless expressly agreed in writing.

5.8 Information and audits. At Your request, We shall permit and contribute to audits of the processing activities covered by these terms, at reasonable intervals of not less than 12 months, or if there are indications of non-compliance. In deciding on a review or an audit, You may consider relevant certifications held by GBG.   

You may choose to conduct the audit by yourself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of Ours and shall, where appropriate, be carried out with reasonable notice. The Parties shall make the information referred to in this clause, including the results of any audits, available to the competent Supervisory Authority on request

5.9 Return and deletion. On termination or written request, We will, at Your choice and where technically feasible, return or delete Personal Data and remaining copies, except where law requires retention or protected backup copies remain until overwritten in the ordinary course and are not actively processed other than for restoration or legal compliance.

5.10 Personal Data Breach and breach notification requirements. 

You shall notify Us, in writing, and supplemented as additional information becomes available of any Personal Data Breach without undue delay, and in any event within twenty-four (24) hours after You become aware of the Personal Data Breach.

Content of Notice. To the extent known and as further information becomes available, Your notice shall include: (a) a description of the nature of the Personal Data Breach, including the categories and approximate number of Consumers and records concerned; (b) the date and time of the Personal Data Breach and of its discovery; (c) the categories of Personal Data affected; (d) the likely and actual consequences of the Personal Data Breach; (e) the measures taken or proposed to be taken to address the Personal Data Breach and to mitigate its possible adverse effects; and (f) the name and contact details of a single point of contact from whom We may obtain further information.

Cooperation and Mitigation. You shall (a) take reasonable steps to investigate, contain, mitigate, and remediate the Personal Data Breach; (b) preserve all evidence relating to the Personal Data Breach; (c) provide Us with such cooperation and assistance as is reasonably necessary for Us and our Subprocessors to meet Our respective notification, investigation, and remediation obligations under Applicable Data Protection Laws (d) not make any notification to any regulator, Consumer, or other third party regarding the Personal Data Breach that identifies (or could reasonably be expected to identify) Us or our Subprocessors without Our prior written consent, except to the extent required by law.

Costs. You shall bear all reasonable costs incurred by Us in connection with a Personal Data Breach to the extent the Personal Data Breach arises from You or Your subcontractors’ acts, omissions, or breach of the Terms, including the reasonable costs of notification, credit monitoring, identity restoration services, regulatory investigation response, and forensic investigation.

6. SUPPORT, AVAILABILITY AND CHANGES

6.1 The Sandbox is provided “as is” and “as available”. No service levels, uptime commitments, support, maintenance, disaster recovery, backup, roadmap or response times apply.

6.2 GBG may provide reasonable assistance at its discretion but is not obliged to correct defects or preserve configurations, integrations, Customer Data or outputs, except as expressly required by clause 5 or applicable law.

7. INTELLECTUAL PROPERTY AND FEEDBACK

7.1 We and our licensors retain all intellectual property rights in the Sandbox, its software, documentation, configurations, templates and materials. Except for the limited right in clause 2.1, no rights are granted to You.

7.2 You retain ownership of Your Data. We may process You Data only as permitted by clause 5 and You grant Us the limited rights necessary to do so.

7.3 We may use any feedback or suggestions provided by You without restriction or payment, provided that We do not identify You or disclose its Confidential Information.

8. CONFIDENTIALITY

8.1 Each Party must keep the other Party’s non-public business, technical and commercial information confidential and use it only to exercise its rights or perform its obligations under these Sandbox Terms.

8.2 A Party may disclose Confidential Information to its group companies, personnel, professional advisers and service providers who need to know it and are subject to confidentiality obligations or where required by law.

8.3 Confidential Information excludes information that is public other than through breach, was lawfully known without restriction, is independently developed without use of the other Party’s information or is lawfully received from a third party without restriction.

9. WARRANTIES AND LIABILITY

9.1 To the fullest extent permitted by law, We exclude all warranties, conditions and other terms, express or implied, relating to the Sandbox, including accuracy, completeness, availability, merchantability, satisfactory quality, fitness for purpose and non-infringement. You are solely responsible for evaluating the Sandbox and must not rely on it for any live or business-critical purpose.

9.2 Nothing in these Sandbox Terms limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be limited or excluded.

9.3 Subject to clause 9.2, We are not liable for loss of profit, revenue, business, anticipated savings, goodwill, reputation or data, or for any indirect or consequential loss, arising out of or in connection with the Sandbox.

9.4 Subject to clauses 9.2 and 9.3, Our total aggregate liability arising out of or in connection with these Sandbox Terms is limited to £1,000.

10. SUSPENSION AND TERMINATION

10.1 Either Party may terminate Sandbox access at any time by written notice. We may suspend or terminate access immediately if You breach these Sandbox Terms, create a security or legal risk, or use the Sandbox outside of its permitted purpose.

10.2 On expiry or termination, You must immediately stop using the Sandbox and delete any of Our materials in its possession, except to the extent retention is required by law. We will handle Your Data in accordance with clause 5.9.

10.3 Clauses intended by their nature to survive will continue, including clauses 5, 7, 8, 9, 10.2, 11 and 12.

11. GENERAL

11.1 These Sandbox Terms and the document incorporating them constitute the entire agreement regarding the Sandbox and supersede prior discussions relating to it.

11.2 You may not assign or transfer its rights or obligations without Our prior written consent. We may assign these Sandbox Terms to a group company or in connection with a reorganisation, merger or sale of business.

11.3 If any provision is invalid or unenforceable, it will be modified to the minimum extent necessary or deleted, and the remaining provisions will continue in force.

11.4 No delay or failure to exercise a right is a waiver. No third party has any right to enforce these Sandbox Terms.

11.5 We may update these Sandbox Terms from time to time to reflect changes to the Sandbox, applicable law, regulatory requirements, security practices or Our business operations. The date on which these Sandbox Terms were last updated will be shown at the bottom of the page. We will notify You of any material changes. Your continued use of the Sandbox following any update constitutes acceptance of the updated Sandbox Terms.

12. GOVERNING LAW AND JURISDICTION

12.1 If You are incorporated or otherwise legally established in the United States, these Sandbox Terms and any non-contractual obligations arising out of or in connection with them are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules, and the Parties irrevocably submit to the exclusive jurisdiction of the state courts located in Delaware and the United States federal courts located in Delaware.

12.2 In all other cases, these Sandbox Terms and any non-contractual obligations arising out of or in connection with them are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

ANNEX A – STANDARD CONTRACTUAL CLAUSES

The following terms shall apply when We processes Personal Data originating in Europe or the United Kingdom. 

1. EEA Restricted Transfer

To the extent that Exporter transfers Personal Data originating from the EEA to Importer located outside the EEA, unless the Parties may rely on an alternative transfer mechanism or basis under the Applicable Data Protection Laws, the EU SCCs will be deemed entered into by the Parties, and incorporated into these Sandbox Terms by reference, and completed as follows:

1.2 Module Two (Controller to Processor) of the EU SCCs applies where the Exporter acts as controller and the Importer acts as processor.

Population of the EU SCCs:

1.5 For Module Two, where applicable:

a) In Clause 7, the optional docking clause will not apply;

b) In Clause 9, Option 2 will apply, and the time period for prior notice of Subprocessor changes shall be 30 days

c) In Clause 11, the optional language will not apply;

d) In Clause 17, the Parties agree that the EU SCCs shall be governed by the law of Ireland in relation to any EEA and Swiss restricted transfer;

e) For the purposes of Clause 18, the Parties agree that any dispute arising from the EU SCCs in relation to any EEA and Swiss restricted transfer shall be resolved by the courts of Ireland and Clause 18(b) is completed accordingly.

1.4 Population of the Annexes to the EU SCCs:

a) Annex I.A (List of Parties) shall be deemed to incorporate the information set out in these terms.

b) Annex I.B (Description of Transfer) shall be deemed to incorporate the information set out in clause 5 of these terms.

c) For purposes of Annex I.C (Competent Supervisory Authority), the competent Supervisory Authority shall be in accordance with the criteria set out in the Clause 13(a) of the EU SCCs;

d) Annex II (Technical and Organisational Measures) shall be deemed to incorporate Annex B of these terms.

2. UK Restricted Transfers

The EU SCCs also apply in the context of UK Restricted Transfers as varied by the UK Addendum. For data transfers from the United Kingdom that are subject to the UK Addendum, the UK Addendum will be deemed entered into by the Parties and incorporated into these Sandbox Terms by reference as follows:

2.1    a) Part 1 of the UK Addendum. As permitted by Section 17 of the UK Addendum, the Parties agree that:

i. Tables 1, 2, and 3 of Part 1 of the UK Addendum are completed respectively with the information set out in these Sandbox Terms (as applicable); and

ii. Table 4 of Part 1 of the UK Addendum is completed by the box labelled ‘Data Importer’ being deemed to have been ticked.

b) Part 2 of the UK Addendum. The Parties agree to be bound by the mandatory clauses of the UK Addendum.

c) In relation to any UK Restricted Transfer to which they apply, where the context permits and requires, any reference in this DPA to the SCCs shall be read as a reference to those SCCs as varied in the manner set out in this paragraph 2 of Annex V.

2.2 For purposes of the UK Addendum:

a) Annex I.A (List of Parties) shall be deemed to incorporate the information as set out in these terms.

b) Annex I.B (Description of Transfer) shall be deemed to incorporate the information as set out in clause 5 of these terms.

c) Annex II (Technical and Organisational Measures) shall be deemed to incorporate Annex B of these Sandbox Terms.

3. Swiss Restricted Transfers

The EU SCCs apply to Swiss Restricted Transfers, subject to the following amendments and additional provisions:

a) References to the GDPR are to be understood as references to the revised FADP.

b) the competent Supervisory Authority (to be named in Annex I.C) is the Swiss Federal Data Protection and Information Commissioner; and

c) the term 'Member State' must not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of bringing legal proceedings against the Exporter and/or Importer before the courts of Switzerland.

4. Conflict.

To the extent there is any conflict or inconsistency between this Annex A, and any other terms in these Sandbox Terms, this Annex A will prevail.