Skip to content

Cognism Customer Agreement

Version: August 2025

Cognism and Customer agree that the GTC shall govern the provision by Cognism and receipt by Customer of Cognism products and services as set out in the relevant Order. The Order, any applicable special terms or additional terms the parties may agree to when an Order is placed (“Special Terms”) and these GTC together constitute the agreement of the parties (collectively, the “Agreement”). In the event of any conflict between the Order terms and the GTC, the GTC shall prevail unless the Order expressly provides that it is modifying the GTC for the purposes of the Order. Any general terms and conditions which Customer purports to introduce by means of a purchase order or similar system shall not apply. 

General Terms and Conditions (“GTC”)

These GTC apply to all of Customer’s Orders entered into pursuant to this Agreement. Capitalized terms used have their meanings set out under Section 11 (Definitions). 

  1. License to use Cognism Services
    1. License grant. Subject to the payment of all applicable Subscription Fees and for the applicable Subscription Term, Cognism hereby grants Customer a non-exclusive, non-transferable, non-sub-licensable, revocable license to access Cognism online proprietary platform to use the Services, subject to the terms and conditions of this Agreement. The Services may include information (the “Profile Data”), access to and/or use of software, tool, feature or other technology (the “Cognism Technology”) Customer may use the Services solely for its internal business purposes. Customer is not permitted to sublicense, resell, transfer, offer for sale, disclose, distribute or make available any of the Profile Data or any part of the Services to any third party without Cognism’s prior written consent. 

    2. Restrictions. Unless expressly permitted under this Agreement or applicable law, Customer shall not: 
          1. reverse engineer, decompile, or disassemble the source code of the Services or any of the Cognism Technology, or attempt to do so;
          2. reproduce, modify, create, or prepare derivative works of any of the Services or related Documentation;
          3. work around technical limitations in a Service or restrictions in the related Documentation;
          4. attempt to gain unauthorized access to the Services, other accounts, computer systems, or networks connected to the Services;
          5. alter, destroy or otherwise remove any proprietary notices or labels from the Services;
          6. disclose the results of any of the Cognism Technology or program benchmark tests to any third parties without Cognism’s prior written consent;
          7. make the Services, including any Profile Data therein, publicly available for bots or other entities to crawl; or
          8. use the Services in any manner that violates applicable laws or regulations,

      Any breach of this Section 1.2 by Customer or its End Users shall be deemed an irremediable material breach of the Agreement. 
       
    3. End Users. Customer may assign each Subscription License to one individual End User for use or access on any number of devices, including to their Affiliates’ employees or contractors, subject to the number of Subscription Licenses purchased under the relevant Order. Customer may not reassign a Subscription License to another End User, except where End User’s relationship with Customer ends. Each End User will be provided a unique username and password. Such usernames and passwords may not be shared and may not under any circumstances be used by anyone who is not an End User. Customer controls access to and use of the Services by End Users and is solely responsible for ensuring that all End Users comply with the terms of the Agreement.
    4. F
      Fair Usage. Except for Credits purchased by Customer, Services are subject to Fair Usage limitations.
    5. Previews. To the extent Customer uses any Services under a Preview, the Preview Terms available at https://www.cognism.com/customer-terms/preview-terms, as updated in accordance with those terms, apply. Previews are provided “AS-IS”, “WITH ALL FAULTS” and “AS AVAILABLE”. Cognism may change or discontinue Previews at any time without notice.
  2. Services
    1. Order. Each Order will set out the applicable Subscription Fees, the Subscription Term, the number of Subscription Licenses and the scope of the Services. Unless otherwise expressly set out in the Order, order forms expire unless accepted prior to their stated expiration date. Expansions of or additional Services may be mutually agreed in a separate Order and will run co-term with the Order they add to.
    2. Affiliates Customer’s Affiliate(s) may purchase Services under these GTC if such Affiliate directly enters into and signs a separate Order with Cognism, and, such Affiliate agrees to be bound by the terms of these GTC as if it were an original Party hereto. Where such Customer Affiliate signs an Order with Cognism, all references to “Customer” in the Agreement shall be deemed to refer to such Customer Affiliate.
    3. Feedback. Feedback by Customer is optional and voluntary. Feedback may be used by Cognism for any purpose without obligation of any kind as long as the Customer’s Confidential Information remains confidential.
    4. Service changes. Cognism has the right to make changes to the Services if such changes do not materially lessen the Services functionality. Cognism may provide additional terms specific to Customer’s use of updates or new features.
    5. Compliance with laws. Customer’s use of the Services must not breach any applicable laws, including, but not limited to, copyright or trademark laws, data protection and privacy laws, export control laws and regulations, including ones specific to its jurisdiction.
    6. Artificial Intelligence. Services may contain certain computational features, including artificial intelligence (“AI”) search, machine learning or similar functionality (“AI Features”), which are trained in Cognism’s local and offline environment for product and research development purposes, to improve and personalise user experiences based on Usage Data and Customer’s metadata, which will be used in de-identified and/or aggregate form. Cognism acknowledges and agrees that Customer Data provided by Customer as part of Cognism’s integration and enrich services is confidential. Cognism is committed to safeguarding Customer Data and respecting its users’ privacy. Customer Data will not be used to train public AI. In the event Customer set up data import, Cognism may ingest Customer Data via integration with a Third Party for data validation purposes unless Customer decides to opt out from that functionality.
  3. Data Ownership
    1. Intellectual Property and Reservation of rights. Cognism retains all rights, title and interest in and to the Services, including all intellectual property rights. Customer acknowledges and agrees that it does not acquire any ownership rights in the Services by virtue of this Agreement. Cognism reserves all rights not expressly granted in this Agreement, and no rights are granted or implied by waiver or estoppel.
    2. Third-Party Integrations. The Services may allow Customer to connect to or interact with one or several third-party service providers, for example, CRM platforms or email services (“Integration Third Parties”) solely for purposes permitted by the Services (“Integrations”). Customer is solely responsible for maintaining any agreement with any Integration Third-Party including for any credits, allowances, API calls, fees and other costs therein. To the extent Customer and/or End Users use the Services to transmit any Customer Data through the Integrations, Customer hereby instructs and authorizes Cognism to provide and/or receive such Customer Data to or from such Integration Third-Party. Integration Third Parties are not controlled by and are not agents of Cognism and Cognism takes no responsibility for their services, compliance, accuracy, actions or omissions or for their maintenance or treatment of Customer Data. Cognism will not be liable for and expressly disclaims all liability for any claim, damage or loss caused hereunder and is not responsible for any disclosure, modification or deletion of Customer Data resulting from access by an Integration Third-Party.
    3. Usage Data. Cognism strives to continually develop new features and improve the Services and may collect and process information regarding the configuration, performance, security, and Customer’s access to and use of the Services for its internal business purposes, including to develop, improve, support, secure and operate services, evaluating how End Users use the Services and to fulfil legal or regulatory obligations (“Usage Data”). The processing of Usage Data is based on Cognism’s legitimate interest to analyze trends to assess and improve the overall user experience in the Services to the extent necessary for Cognism’s legitimate interest under, and in accordance with applicable law. Usage Data shall be de-identified and/or aggregated and Cognism’s use thereof will not identify the Customer or its customers.
    4. DNC Disclaimer. Cognism verifies on a regular basis a select list of Do Not Call (“DNC”) registries and flags all contact data on such registries in the Services. Customers have the option to toggle visualization of such contact data on/off in their account. Cognism will not be liable for and expressly disclaims all liability for any claim, damage or loss caused hereunder resulting from Customer’s reliance on the accuracy of or access to contact data on any DNC list.
  4. Data Protection
    1. Personal Data. Each Party will process the business contact details or additional categories of Personal Data in connection with this Agreement as independent Data Controllers (as that term or similar variants may otherwise by defined under Applicable Data Privacy Laws) and will comply with the terms set out in the Data Sharing Agreement (“DSA”) under Schedule 1 herein. Customer and Cognism will implement appropriate technical and organizational measures to protect Personal Data against any misuse, and each party will comply with data protection law and regulation applicable to their respective business activities, including the processing of Personal Data in the context of using or providing the Services.
    2. DPA. Where Cognism processes Personal Data on behalf of the Customer for account management purposes in connection with Customer’s use of the Services, such processing will be subject to applicable data protection laws and to the Data Processing Agreement in effect from time to time and available at https://www.cognism.com/customer-terms/DPA, unless Customer and Cognism have entered into a separate written agreement governing such processing (in either case, “DPA”). Where Cognism processes Personal Data while performing the Services, Cognism may act as a data processor or data controller depending on the Services provided.
    3. Opt-Out. In furtherance of Cognism’s commitment to upholding the privacy rights of data subjects, Cognism shall make available, via its Compliance API functionality, a list of individuals who have requested to be excluded from Cognism’s database (the “Opt-Out List”). Customer hereby agrees to access and review the Opt-Out List on a regular basis, and in no event less than once every thirty (30) calendar days. Customer agrees that it shall, without undue delay, permanently delete and cease all processing of any business contact data relating to individuals identified on the Opt-Out List, unless Customer has established and can demonstrate some other independent lawful basis for its continued retention and processing of such data, and that such continued retention and processing will be in compliance with Applicable Data Privacy Laws.

  5. Pricing and payment
    1. Fees. Customer shall pay the subscription fees set out in the Order (“Subscription Fees”) according to the terms of the applicable Order. Payment obligations are non-cancelable and Subscription Fees are non-refundable, unless this Agreement or an applicable Order is terminated for cause pursuant to Section 10(c), in which case any prepaid, unearned Fees will be refunded. Customer is responsible for providing Cognism with their up-to-date complete and accurate billing and contact information.
    2. Late payment. If Customer fails to pay the Subscription Fees by the due date, Cognism has the right to charge the lower of 1.5% monthly interest on past due amounts or the maximum allowed under applicable law. Cognism also has the right to: (a) subject to a 10-day prior notice: (i) terminate the applicable Order or (ii) turn off access; and (b) take any other action available to it under applicable law. Fees continue to accrue while access is turned off.
    3. Taxes. Customer is solely responsible for all taxes, fees, duties and governmental assessments that are imposed or become due in connection with this Agreement. Unless otherwise specified in the Order, all fees, rates, and estimates exclude such taxes, fees, and governmental assessments.
    4. Purchase Order. If Customer uses a purchase order or similar system (“PO”), it must issue a PO upon execution of the Agreement, any renewal, and any future expansion. Any delay or failure in issuing a PO will not relieve Customer of its payment obligations under the Agreement. THE PARTIES HERETO AGREE TO EXPRESSLY REJECT, EXCLUDE AND WILL NOT BE BOUND BY ANY ADDITIONAL, INCONSISTENT OR CONFLICTING TERMS TO THIS AGREEMENT WHICH MAY APPEAR ON ANY PURCHASE ORDER, INCLUDING CUSTOMER'S PURCHASING TERMS, QUESTIONNAIRES, VENDOR ONBOARDING FORM AND OTHER GENERAL TERMS AND CONDITIONS PRESCRIBED OR FURNISHED BY CUSTOMER.
    5. Renewal Uplift. Cognism reserves the right to increase the Subscription Fees upon any Renewal Term, provided that such increase shall not exceed ten percent (10%).

  6. Warranties
    1. Limited warranties and remedies. Cognism warrants that the Services will perform substantially in accordance with the applicable Documentation during Customer’s use. If it does not and Customer notifies Cognism in writing during the Subscription Term, Cognism will at its option (a) return the price Customer paid for the Subscription License; or (b) repair or replace the affected The remedies above are Customer’s sole remedies for breach of the warranties. Customer waives any warranty claims not made during the Subscription Term.
    2. Exclusions. This warranty shall not apply to non-conformities, errors, or problems (a) caused by acts within the control of Customer or any End Users; or (b) arising from: (i) Customer’s negligence or improper use of the Service, (ii) unauthorized modifications made to the Service by or on behalf of Customer, (iii) use of the Services in an unsupported operating environment or manner, or (iv) interoperability issues arising from devices or equipment or browsers used by Customer to access the Service or that arises from Customer’s or any third party’s software or systems (including Integration Third Parties). This warranty does not apply to Previews.
    3. Disclaimer. Except for the limited warranties above and subject to applicable law, Cognism makes no additional warranty, condition, representation, undertaking or guaranty of any kind to Customer, and Cognism specifically disclaims any and all express, implied or statutory warranties, conditions, representations, undertakings and guaranties, including, without limitation any with respect to quality, title, non-infringement, merchantability, or fitness for a particular purpose.

  7. Infringement claims
    1. Indemnification process. The parties will defend each other against claims described in this Section 7 and will pay the amount of any resulting adverse final judgment or approved settlement, provided that: (a) the party benefiting from the indemnity (“Indemnified Party”) shall give written notice to the party giving the indemnity (“Indemnifying Party”) of any claims or proceedings immediately following receipt of them, such notice to specify in sufficient details the nature of the claim; (b) the Indemnified Party shall make no admission of liability, agreement, compromise or attempt to settle a claim, and hereby give the Indemnifying Party the sole authority to defend or settle the claims or proceedings at the Indemnifying Party’s cost and expense; and (c) the Indemnified Party shall give the Indemnifying Party all reasonable assistance in connection with the claims or proceedings, at the Indemnifying Party’s cost and expense.
    2. Cognism obligations. Cognism will defend and indemnify Customer against any third-party claim that a Service made available by Cognism (but excluding any Previews) directly infringes a patent, copyright, trademark, or other proprietary right of a third party (“Infringement Claim”). Cognism shall not be liable for any Infringement Claim which is: (a) caused by Customer’s, or any of its End Users’, use of the Services in combination with software not supplied or approved by Cognism; or (b) resulting from modifications of the Services by or on behalf of Customer; or (c) based on use of any version of the Services other than the latest version supplied by Cognism, if such claim could have been avoided by the use of such supplied version; or (d) arises as a result of Customer’s, or any of its End Users’,  use of the Services in breach of this Agreement or any applicable laws. 
    3. Additional remedies. If an Infringement Claim is upheld or is reasonably believed by Customer to be upheld, or if any injunction or restraining order is issued, Cognism may, at its option, either (a) obtain the right for Customer to continue to use the applicable Services; (b) modify or replace the Service with a functional equivalent or (c) in the event that Cognism considers, acting reasonably that neither (a) or (b) are commercially reasonable options, terminate the relevant Order(s) and refund any license fees, including amounts paid in advance for any usage period after the effective termination date of such Order(s).
    4. Customer obligations. Customer will defend and indemnify Cognism and its Affiliates against any third-party claim that: (a) any Customer Data directly infringes a patent, copyright, trademark, or other proprietary right of a third party; or (b) Customer’s use of any Service in violation of any applicable laws or of the terms of this Agreement.
    5. This Section 7 describes the parties’ sole remedies and entire liability for such claims, subject to the limitations set out in Section 8 (Limitation of liability).

  8. Limitation of liability
    1. General limitation. Each party’s maximum aggregate liability to the other in contract, tort, negligence, for breach of statutory duty or otherwise arising out of or in connection with this Agreement is limited to direct damages finally awarded in an amount not to exceed the amounts paid or payable by Customer hereunder during the twelve (12) months prior to the date on which such claim or cause of action arose, except for damages directly arising out of or in connection with Previews, in which case Cognism’s maximum aggregate liability shall not exceed US $100 (one hundred US Dollars).
    2. Exclusions. In no event will either party be liable for indirect, incidental, special, punitive, or consequential damages, or loss of use, loss of profits, or interruption of business; however caused and, whether in contract, tort or under any other theory of liability, whether or not the party has been advised of the possibility of such damage.
    3. Exceptions. To the extent permitted under applicable law, neither party shall limit or exclude its liability for: (a) bodily injury and death caused by the negligence of either party; (b) either party’s indemnity obligations given under Section 7 (Infringement Claims); (c) either party’s breach of Section 9 (Confidentiality); or (d) either party’s breach of the other party’s intellectual property rights.

  9. Confidentiality
    1. Confidential Information. Confidential Information does not include information that: 
      1. becomes publicly available without a breach of a confidentiality obligation;
      2. was received lawfully from another source without a confidentiality obligation;
      3. is independently developed without use or reference of the disclosing party’s Confidential Information;
      4. is Personal Data, which are subject to Section 4 (Data Protection); or
      5. is Feedback. 
    2. Protection of Confidential Information. Either party who receives Confidential Information (“Receiving Party”) will take reasonable steps to protect the Confidential Information of the other party (“Disclosing Party”). The Receiving Party will only use the Disclosing Party’s Confidential Information as part of the parties’ business relationship. Neither party will disclose Confidential Information to third parties. The Receiving Party may only share Confidential Information with its Representatives on a need-to-know basis, under non-disclosure obligations at least as protective as the terms of this Section. Each party remains responsible for the use of Confidential Information by its Representatives. A party must promptly notify the other party if it discovers any unauthorized use or disclosure.
    3. Disclosure required by law. Notwithstanding anything to the contrary herein, the Receiving Party may disclose the Disclosing Party’s Confidential Information in order to comply with applicable law and/or an order from a court or other governmental body of competent jurisdiction, and, in connection with compliance with such an order only, if the Receiving Party: (a) to the extent permitted by law, gives the Disclosing Party prior written notice to such disclosure if the time between that order and such disclosure reasonably permits or, if time does not permit, gives the Disclosing Party written notice of such disclosure promptly after complying with that order and (b) fully cooperates with the Disclosing Party, at the Disclosing Party's cost and expense, in seeking a protective order, or confidential treatment, or taking other measures to oppose or limit such disclosure. Each party must not release any more of the other party's Confidential Information than is, in the opinion of its counsel, reasonably necessary to comply with an applicable order.
    4. Remedies. If the Receiving Party discloses or uses (or threatens to disclose or use) any Confidential Information in breach of this Section 9, the Disclosing Party shall have the right, in addition to any other remedies available to it, to seek injunctive relief to enjoin such acts, it being specifically acknowledged by the Parties that any other available remedies are inadequate.
    5. Duration of confidentiality obligation. These confidentiality obligations apply: (a) for Customer Data, until it is deleted from the Services; and (b) for all other Confidential Information, for a period of five years after the Receiving Party receives the Confidential Information.

  10. Term and termination
    1. Term. This Agreement will commence on the last signature date of the initial Order entered into between the parties (“Effective Date”) and will continue in full force and effect until (a) terminated by either party pursuant to the termination rights set forth in this Section 10, or (b) the twelve (12) month anniversary of the termination of the last effective Order Form. Except as otherwise specified in an Order, an Order will take effect from the Effective Date, will remain in force for the Subscription Term (“Initial Term”) and shall automatically renew for a period equal to the length of the Initial Term or one year, whichever is longer (each a “Renewal Term”), unless and until either party gives the other written notice of non-renewal at least sixty (60) days prior to the end of the then-current Subscription Term. 
    2. Termination for cause. Without limiting other remedies available to it under applicable law, either party may terminate this Agreement and/or any Order immediately by providing written notice to the other party in the event the other party:

      1. commits any material breach of its duties and fails to remedy that breach within 30 days of receiving written notice of that breach, unless the breach is incapable of remedy in which case the Agreement or the Order may be terminated by written notice immediately; or
      2. passes a resolution for its winding up, or a court of competent jurisdiction makes an order for its winding up or dissolution, or an administration order is made in relation to the other party, or a receiver is appointed over, or the other party makes an arrangement or composition with its creditors generally or makes an application to a court of competent jurisdiction for protection from its creditors generally, or the other party ceases to trade.
    3. Termination for regulatory reasons. Cognism may modify, discontinue, or terminate a Service in any country or jurisdiction where there is any current or future government regulation, obligation, or other requirement, that (a) is not generally applicable to businesses operating there; (b) presents a hardship for Cognism to continue offering the Service without modification; or (c) causes Cognism to believe these terms or the Service may conflict with any such regulation, obligation, or requirement. If Cognism terminates a subscription for regulatory reasons, Customer will receive, as its sole remedy, a reimbursement for any prepaid, unused Subscription Fees.
    4. Effects of Termination. Any termination of this Agreement and/or Order shall be without prejudice to any other rights or remedies a party may be entitled to hereunder or at law. The termination of an Order shall not terminate this Agreement, but the termination of this Agreement shall operate to terminate all active Orders. Upon the effective date of termination of the then-current Order, Customer shall cease all use of the Services and all licenses granted under this Agreement shall terminate immediately. Subject to Customer’s continued compliance with applicable law, Customer may only continue to use Data that was legally obtained from Cognism under the Agreement and that was stored on Customer’s systems during the Term, except for Previews in which case, Customer shall delete and destroy all Data obtained as part of the Previews. Customer understands and acknowledges that any use of such Data after the termination of this Agreement will be made at its own risk and responsibility, and that Cognism will not provide any Services with regards to such Data. Customer shall continue to comply with all of its obligations under applicable data privacy and marketing laws and regulations when using such Data, and shall be solely and fully liable for its use. Except as necessary to comply with applicable law, each Party will promptly return to the other or destroy, as requested by the other party, all of the other party’s applicable Confidential Information within its possession or control and will certify in writing, if requested, that it has complied with its obligations to return or destroy all such Confidential Information.

  11. Miscellaneous
    1. Independent contractors. The parties are independent contractors. Customer and Cognism may develop products independently, provided either party does not breach their obligations of confidentiality under this Agreement nor otherwise impedes, affects or diminishes any of the other party’s Confidential Information.
    2. Amendments. Except for Cognism’s modification or update of the Documentation or the Subscription Service, or any policies as necessary to comply with applicable law, rules, regulations, no modification of this Agreement is legally binding against the other Party unless in writing and signed or electronically accepted by both Parties, except where Customer has agreed the GTC without negotiation, in which case the then-current version of the GTC will apply.
    3. Assignment. Either party may, without consent from the other party, assign this Agreement to an Affiliate but only to the extent that such assignment would not result in an impairment of the other party’s rights under this Agreement. Any other assignment of this Agreement must be approved by the other party in writing. Such notification to Cognism shall be made to the account manager at Cognism with a mandatory copy to legal@cognism.com. Any attempted assignment without required approval will be void.
    4. Compliance with trade laws. The parties acknowledge that the Services may be subject to U.S. and other countries’ export jurisdictions. Each party will comply with all laws and regulations applicable to the import or export of the Services, including, but not limited to, the U.S. Export Administration Regulations, International Traffic in Arms Regulations, UN, U.S. or EU economic sanctions, and sanctions regulations administered by the U.S. Office of Foreign Assets Control (“Trade Laws”). Customer will not take any action that causes Cognism to breach U.S. or other applicable Trade Laws, including, for the avoidance of doubt, and without limitation, Customer will not permit any End User to access or use any Services in a sanctioned or embargoed country or region or in violation of any Trade Laws. If Customer learns of a potential breach of Trade Laws relating to the performance of this Agreement, or a potential breach of the terms in this Section 11.4, it will alert Cognism as soon as possible and in any event no more than 5 business days after acquiring this knowledge. Cognism may suspend or terminate this Agreement to the extent that it reasonably concludes that continued performance would cause it to breach applicable Trade Laws, or put it at risk of becoming the subject of economic sanctions under such Trade Laws.
    5. Anti-Bribery and Corruption. Each party acknowledges and agrees that, in connection with this Agreement, it has not received or been offered any illegal or improper bribe, kickback, payment, gift, hospitality or thing of value from the other party’s employees or agents, but excluding permitted reasonable gifts and entertainment provided in the ordinary course of business which do not breach applicable laws and each party will promptly notify the other party if it learns of any breach of this provision.
    6. Severability. If any part of this Agreement is held to be unenforceable, the rest of the Agreement will remain in full force and effect.
    7. Waiver. Failure to enforce any provision of this Agreement will not constitute a waiver. Any waiver must be in writing and signed by the waiving party. The parties acknowledge that in entering into this Agreement, they do not do so on the basis of, and do not rely on, any representations, warranties or other provisions except as expressly provided herein and all conditions, warranties and other terms implied by statute or common law are hereby excluded to the fullest extent permitted by law.
    8. No third-party beneficiaries. This Agreement does not create any third-party beneficiary rights except as expressly provided by its terms.
    9. Survival. All provisions survive termination of this Agreement except those requiring performance only during the term of the Agreement 
    10. Notices. Notices to Cognism may be submitted via email to legal@cognism.com. If Customer wishes to formally service notice on Cognism, it must do so in writing to Cognism’s registered agent: 

      Cognism Limited

      C/O Worldwide Corporate Advisors, St Clements House, 27 Clements Lane, London EC4N 7AE, UK 

      Notices will be treated as delivered on the date received at the address, date shown on the return receipt, email transmission date, or date on the courier confirmation of delivery. Notices to Customer will be sent to the individual at the address Customer identifies on its account as its contact for notices. Customer shall ensure its contact for notices is up to date during each renewal. Cognism may send notices and other information to Customer by email or other electronic form. 

    11. Settlement in Good-Faith. The parties shall attempt to settle disputes arising out of or in connection with the Agreement by good-faith negotiations between senior management of each party, to commence within two (2) weeks from the date of a written request from an affected party. If negotiations do not resolve the dispute within one (1) month from request, a party may proceed as set forth in Section 11.12. Commencement of any dispute resolution process shall not relieve either party from its continued duties and obligations under the Agreement, including but not limited to any payments due and payable.
            1. US. If Customer’s Order lists Cognism, Inc. as a party, this Agreement will be governed by and construed in accordance with the laws of the Commonwealth of Massachusetts without regard to its conflict of law principles and federal laws of the United States. Any legal action or proceeding will be brought exclusively in the federal or state courts located in Boston, Massachusetts. The parties to this Agreement consent to personal jurisdiction and venue there.
            2. Rest of the World. If Customer’s Order lists Cognism Limited or any other Cognism entity as a party, this Agreement will be governed by the laws of England and Wales. Any legal action or proceeding will be brought exclusively in the courts located in London. The parties consent to personal jurisdiction and venue there.

    12. The above choices of venue do not prevent either party from seeking injunctive relief in any jurisdiction with respect to a breach of intellectual property rights or confidentiality obligations. 

      The 1980 United Nations Convention on Contracts for the International Sale of Goods and its related instruments will not apply to this Agreement. 
    13. Cognism Affiliates and contractors. Cognism may perform its obligations under this Agreement through its Affiliates and use contractors to provide certain services. Cognism remains responsible for their performance.
    14. Collaboration partners and publicity. Customer agrees that Cognism may disclose the fact that Customer is a client of Cognism. Throughout the Term, Customer grants Cognism the right to reference Customer’s name and logo in marketing materials and on Cognism’s website. Upon execution of the Agreement, Cognism may either (a) issue a press release announcing the relationship between Cognism and Customer, or (b) submit a joint press release to Customer for Customer’s approval, such approval not to be unreasonably withheld or delayed. Customer agrees to be a reference account for Cognism, provided however that Cognism will provide Customer with reasonable notice and obtain Customer’s consent before scheduling any reference calls.
    15. Anti-Slavery. In performing its obligations under this Agreement, each party shall comply with all applicable anti-slavery and human trafficking laws, statutes, regulations and codes from time to time in force including, without limitation, the UK Modern Slavery Act 2015. Cognism shall ensure that any contracts with its sub-contractors require compliance with such laws.
    16. Entire Agreement. This Agreement constitute the entire agreement and understanding between the parties with respect to the subject matter hereof and replaces any prior oral or written communications relating to the Services.

  12. Definitions

    “Affiliate” means any legal entity that controls, is controlled by, or is under common control with a party. In this context control means ownership of more than a 50% interest in an entity.

    “Cognism” means the entity listed as a party on the Order.

    “Confidential Information” means non-public information in any form that is marked as “confidential” or that a reasonable person should understand is confidential or proprietary given the nature of the information and the circumstances under which it is disclosed, including pricing, the terms of this Agreement, and other terms set forth in an Order. Confidential Information of Cognism includes, but is not limited to, non-public information regarding features, functionality and performance of the Services, API, and software code. Confidential Information of Customer includes Customer Data and Customer’s account authentication credentials.

    “Credits” means one-time-use individual record exports above the Fair Usage limitations, which must be used during the Subscription Term in which they are purchased. Credits expire at the end of the relevant Subscription Term, do not carry over and are not refundable.

    “Customer” means the entity listed as Customer in the relevant Order.

    “Customer Data” means Data that Customer transmits to, uploads to, transfers to, processes on, stores in, or causes to interface with, Customer’s account(s) associated with the Subscription Services, but specifically excludes Usage Data.

    “Data” means text, data, images and any other materials that are displayed or otherwise made available through the Services.

    “Documentation” means all documentation and other instructional material made available by Cognism regarding the use of the Service, including any applicable Order.

    “End User” means any person or machine account that Customer permits to use a Service or access Customer Data.

    “Fair Usage” means the limitations applicable to Customer’s use of the Services (excluding Credits):

    (i)    monthly contact view limit per End User: 2,000 individual records;
    (ii)    export view limit per End User: 25 individual records at a time; and
    (iii)    monthly export per End User: 2,000 individual records;

    “Feedback” means a comment or suggestion volunteered by a party about the other party’s business, products or services.

    “Non-Cognism Application” means a web-based, offline, mobile, or other software application functionality that is provided by Customer or a third party and interoperates with the Services.

    “Order” means the method by which Customer agrees to purchase Subscription Licenses to use a Service, including by order form.

    “Personal Data” shall have the meaning assigned to the terms “personal data” or “personal information” or “personally identifiable information” or similar terms under applicable data protection laws.

    “Previews” means Services provided for preview, evaluation, demonstration or trial purposes, or pre-release versions of the Services.

    “Service” means the Cognism-hosted service to which Customer may subscribe as set out in the relevant Order, but excluding Previews and Non-Cognism Applications.

    “Representatives” means a party’s employees, Affiliates, contractors, advisors and consultants.

    “Subscription License” means the license assigned to an End User.

    “Subscription Term” means the license period agreed between the parties in the relevant Order.

 

Schedule 1 - Data Sharing Agreement

This data sharing agreement, including any annexes (“DSA”) forms part of the Agreement and is effective and supersedes any previously applicable terms relating to their subject matter from the date on which Customer signed or the parties otherwise agreed to this DSA.

By accepting to enter into this DSA both parties warrant that they: (a) have full legal authority to be bound to this DSA; (b) have read and understand this DSA; and (c) agree to this DSA.

Cognism email address for notices under this DSA: legal@cognism.com

Customer email address for notices under this DSA: as outlined in the Agreement.

RECITALS

(A)  For the purpose of providing the Services under the Agreement, both parties may receive Personal Data.

(B) The parties have entered into this DSA to provide for the sharing of Personal Data, and to ensure that there are appropriate provisions and arrangements in place to properly safeguard the information shared between the parties. 

AGREED TERMS

  1. Definitions
    • The following terms shall have the meanings set out below.

    “Data Protection Law” means the law and regulation applicable to processing of Personal Data under the Agreement in any part of the world where Cognism provides the Services, including but not limited to European Law and US Law;

    “Data Sharing Particulars” means, in relation to any sharing: (a) the subject matter, duration, nature and purpose of the processing; (b) the type of Personal Data being processed; and (c) the categories of data subjects; as set out in more detail in Schedule 1;

    “European Law” means the law and regulation of the European Union (“EU”), the European Economic Area (“EEA”), their member states, Switzerland, and the United Kingdom applicable to the processing of Personal Data under the Agreement (including, as applicable, (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) ("EU GDPR"); (ii) the EU GDPR as retained into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 ("UK GDPR"); (iii) the Swiss Federal Data Protection Act in force from 1 September 2023 and its corresponding ordinances (“Swiss DPA”); (iv) the EU e-Privacy Directive (Directive 2002/58/EC); and (v) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii), (iii), (iv) and any amending, updating or replacing legislation or regulation from time to time in force;

    “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;

    “Permitted Purpose” means the purpose of the processing as set out in more detail in Annex 1 (Data Sharing Particulars);

    “Personal Data” shall have the meaning assigned to the terms “personal data” or “personal information” or “personally identifiable information” or similar terms under Data Protection Law;

    “Services” means those services provided by Cognism under the Agreement;

    “US Law” means the law and regulation of the United States applicable to the processing of Personal Data under the Agreement, including (i) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 - 1798.199, 2022) and its implementing regulations (“CCPA”), (ii) the Virginia Consumer Data Protection Act, when effective, (iii) the Colorado Privacy Act and its implementing regulations, when effective, (iv) the Utah Consumer Privacy Act, when effective; and (v) Connecticut SB6, An Act Concerning Personal Data Privacy and Online Monitoring, when effective, (vi) the Texas Data Privacy and Security Act of 2023, when effective, (vii) the Tennessee Information Protection Act, when effective, (viii) the Oregon Consumer Privacy Act of 2023, when in force, (ix) the Montana Consumer Data Privacy Act of 2023, when in force, (x) the Indiana Consumer Data Protection Act of 2023, when in force, (xi) the Iowa Data Privacy Act of 2023, when in force, (xii) the Delaware Personal Data Privacy Act of 2023, when in force, (xiii) the applicable data protection laws made at federal or state level from time to time in force; and any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i) - (xiii) and any amending, updating or replacing legislation or regulation from time to time in force. 
  2. DATA PROTECTION
    1. For the purposes of this DSA, “controller”, “processor”, “data subject”, "Personal Data" and "process" shall have the meanings set out in the EU GDPR and "process" and "processed", will be construed accordingly, and will include both manual and automatic processing.  
    2. The parties shall each process Personal Data under this Agreement. The parties acknowledge that the factual arrangement between them dictates the classification of each party in respect of the Data Protection Law. Notwithstanding the foregoing, the parties shall be considered as independent and separate controllers with respect to the Processing of Personal Data under this DSA as further set out in Annex 1 (Data Sharing Particulars.) For the avoidance of doubt, the parties are not joint controllers for the purposes of Data Protection Law.
    3. The parties acknowledge that Personal Data shared under this Agreement, including the Personal Data provided to the Customer under the Services, will be used for the purposes and with the means determined by the other Party  as a Controller. 
    4. The parties acknowledge that in the event of any conflict between the provisions of this Agreement and other agreements governing the processing of personal data shared between the parties as Controllers, the provisions herein shall prevail.
    5. Each of the parties acknowledges and agrees that Annex 1 (Data Sharing Particulars) is an accurate description of the Data Sharing Particulars. 
    6. Where a party is acting as a Controller in relation to this DSA, it shall comply with all its obligations under the Data Protection Law, and that party shall also ensure that it records due notification to any relevant regulator, such notice to include its use and processing of the Personal Data.
    7. Where either party collects Personal Data which it subsequently transfers to the other party, it shall:
      1. ensure that it is not subject to any prohibition or restriction which would prevent or restrict it from disclosing or transferring the Personal Data to the other party, as required under this DSA;
      2. ensure that all fair processing notices have been given and are sufficient in scope and kept up-to-date in order to meet the Transparency Requirements (as defined under Data Protection Law) to enable each party,  subject to such party’s own compliance with the Data Protection Law, to process the Personal Data in order to obtain the benefit of its rights, and to fulfil its obligations, under this Agreement in accordance with the Data Protection Law. For the avoidance of doubt, the parties do not warrant to each other that the other party’s independent use of the Personal Data shall be compliant with the Data Protection Law. The parties acknowledge that such use will be outside the control and visibility of the other party, and therefore each party must and will independently ensure that (i) they have a lawful basis for their Processing of such Personal Data, and (ii) such use and Processing of the Personal Data is compliant with the Data Protection Law;
      3. inform the other party about the legal basis under the Data Protection Legislation on which it bases the Processing and transfer of Personal Data to the other party;
      4. ensure that the Personal Data is adequate, relevant, limited to what is necessary in relation to the Permitted Purpose and, where necessary, up-to-date; and
      5. ensure that the Personal Data is transferred between the parties by a secure means.

  3. SECURITY OF DATA SHARING 
    1. Each party shall implement and maintain (in accordance with Data Protection Law) appropriate technical and organisational measures as set out in Annex 3 herein (“TOMs”), taking into account the state of the art, the implementation costs, and the nature, scope, circumstances and purpose of the processing, as well as the different probability of occurrence and the severity of the risk of the rights and freedoms of the persons concerned in order to ensure a level of protection appropriate to such risk.
  4. PERSONAL DATA BREACHES AND REPORTING PROCEDURES
    1. The parties shall each comply with its obligation under Data Protection Law to report a Personal Data Breach to the appropriate supervisory authority and (where applicable) data subjects. 
  5. DATA SUBJECTS' RIGHTS
    1. The parties each agree to provide such assistance as is reasonably required to enable the other party to comply with requests from Data Subjects to exercise their rights under the Data Protection Law within the time limits imposed by the Data Protection Law.
    2. Where relevant (such determination to be made in the sharing party’s sole determination), and to the extent applicable, each party shall notify the other of any Data Subject Request or supervisory authority correspondence, which relates directly to the processing of Personal Data under this Agreement, and to the extent legally permissible, shall only disclose such Personal Data in response to any Data Subject Request or supervisory authority correspondence where it has obtained the other party’s prior written consent.
    3. Cognism hereby warrants: (i) it has collected all Personal Data provided to Customer as part of the Services in compliance with the Data Protection Laws; (ii) it will promptly honor any opt-out requests it receives from Data Subjects in the Services in accordance with the Data Protection Law; and (iii) it will maintain a list of Data Subjects who have requested that their Personal Data be removed from the Services in its global opt-out API, which Customer will have access to, and can check from time to time.
  6. INTERNATIONAL TRANSFERS OF PERSONAL DATA
    1. To the extent Personal Data is transferred from a jurisdiction requiring Standard Contractual Clauses (“SCCs”) to a non-Adequate Jurisdiction, the relevant SCCs contained in Annex 5 to this DSA will apply.
    2. For the purposes of the SCCs the following additional provisions shall apply:
      1. Cognism shall be regarded as the data exporter and Customer shall be regarded as the data importer;
      2. the parties agree to observe the terms of the SCCs without substantive modification; and
      3. the parties’ signature to this DSA shall be considered as a signature for the SCCs.
      4. In the event of any conflict between the provisions of (1) the SCCs; and (2) the remaining terms of this DSA, then the SCCs, or any replacement thereof, shall take precedence.  The terms of this DSA shall not vary the SCCs in any way.
  7. LIABILITY
    1. Each Party’s liability under this DSA shall be construed in a manner consistent with the limitations of liability set out in the Agreement.
  8. GOVERNING LAW AND JURISDICTION
    1. This DSA and any non-contractual obligations arising out of or in connection with it shall be governed by and interpreted in accordance with the English law.
    2. Each party irrevocably submits to the exclusive jurisdiction of the courts of England over any claim or matter arising under, or in connection with, this DSA. 

 

Annex One
Data sharing particulars
Where the parties are acting as both controllers in their own right

A.    DATA PROCESSING AND TRANSFER OF PERSONAL DATA

Question

Answer

Subject matter and duration of the Processing of Personal Data

As stated in the Agreement

The nature and purpose of the Processing of Personal Data

As necessary to provide the Cognism Services to Customer in accordance with the documented instructions provided in the Agreement and this DSA.

Categories of Personal Data

Business personnel

Legal basis for processing

Legitimate interest

Type of Personal Data

Profile of contact data, including name, employer, job title, business email address, telephone number

Sensitive Data

None

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)

Continuous for the duration of the Agreement.

 

 

B.    COMPETENT SUPERVISORY AUTHORITY

Question

Answer

Identify the competent supervisory authorities (e.g. in accordance with Clause 13 of the EU SCCs)

In respect of the EU SCCs, means the competent supervisory authority determined in accordance with Clause 13 of the EU SCCs.

In respect of the UK Addendum, means the UK Information Commissioner's Office.

 

 

 

Annex Two
Data Sharing Responsibilities

Activity

Responsibility for making policy and decisions

Responsibility for implementing policy and decisions

Lawful basis for processing of personal data

Each party

Each party will be responsible for deciding their own lawful basis

Purposes for which personal data may be collected

Each party

Each party responsible for compliance with data protection principles

Data minimisation

Each party

Each party responsible for compliance with data protection principles

Data accuracy

Each party

Each party responsible for compliance with data protection principles

Data storage limitation

Each party

Each party responsible for compliance with data protection principles

Integrity and confidentiality

Each party

Each party responsible for compliance with data protection principles

Accountability

Each party

Each party responsible for compliance with data protection principles

Information notices

Each party

Each party responsible for compliance with data protection principles

Data subject rights

Each party

Each party will be responsible for responding to requests from data subjects to exercise their rights in respect of the processing they undertake

Data protection by design and default

Each party

Each party responsible for compliance with data protection principles

Appointment of Processor

Each party

Each party will do that independently

Records of processing activities

Each party

Each party shall keep separate records of processing activities in line with the main contract

Information notices

Each party

Each party responsible for compliance with data protection principles

Co-operation with supervisory authority

Each party

Each party will follow supervisory authority’s guidance/applicable guidance

Security of processing

Each party

Each party has provided details about data security

Notification of data breach

Each party

Each party shall inform the other about notifications of data breaches

 

Annex Three
TOMs 

Integrity:

  • User authorizations are restricted by roles.
  • Least privilege principle. 

Storage:

  • All of the data is stored in a secure, redundant and highly available databases on AWS. 

Encryption:

  • All data at rest is encrypted with AES-256 encryption.
  • Cryptographic keys are managed by AWS KMS. 

Transmission control:

  • All data at rest and in transit is encrypted (HTTPS, SSL/TLS v1.2 and above).
  • Certificates are managed by AWS Certificate Manager. 

Confidentiality:

  • Strong password policies.
  • Multifactor authentication and/or SSO where possible.

Recoverability:

  • Backups are regularly checked for successful recovery.
  • All data is stored in a secure, redundant and highly available databases on AWS. 

Evaluation:

  • Annual review of technical and organizational measures on effectiveness and plausibility.

Disposal:

  • Since all of our data (personal and other) are stored in Cloud (Amazon Web Services – AWS) EU (Ireland) region, upon deletion AWS takes care of destroying data. AWS uses the techniques detailed in DoD 5220.22-M (“National Industrial Security Program Operating Manual “) or NIST800-88(“Guidelines for Media Sanitization”) to destroy data as part of the decommissioning process. 


Annex Four
Cognism Sub-Processors 

Infrastructure Sub-Processors

Sub-Processor 

Location

Purpose/Services

Website & Contact Details

Amazon Web Services (AWS)

Ireland

Cloud services

https://aws.amazon.com

One Burlington Plaza, Burlington Road, Dublin 4, Ireland

Annex Five
Standard Contractual Clauses (“SCCs”)

I.    Transfer Clauses Generally
With respect to transfers of Personal Data across national borders to other countries that have not been recognized under the Applicable Data Protection Laws as an Adequate Jurisdiction, the parties hereby agree to be bound by, where applicable:

  1. F
    For transfers of Personal Data from an EEA Data Exporter to a Non-Adequate Jurisdiction, the Controller to Controller EU SCCs are deemed incorporated into this Addendum in their entirety and without alteration, except as noted below. To the extent that the Data Importer is subject to the extra-territorial scope of Article 3(2) of the EU GDPR with respect to the specific processing, the obligations imposed on the Data Importer by the EU GDPR shall prevail over its obligations under the SCCs, where the latter are less strict. For reference, the official EU SCCs are available here;
  2. For transfers of Personal Data from a UK Data Exporter to a non-Adequate Jurisdiction, the SCCs (as referred to above in section (i)) and the UK SCC Addendum is applicable here;
  3. For transfers of Personal Data from any other applicable jurisdiction with SCCs, the relevant the Controller to Controller SCCs are deemed incorporated in their entirety and without alteration as required and relevant under such jurisdiction’s applicable law.

II.    EU SCCs

When both parties are acting as Controllers, and when the EEA Data Exporter transfers Personal Data to a non-Adequate Jurisdiction, Module 1 of the EU SCCs applies. With respect to Module 1 of the EU SCCs, the parties hereby further agree that:

  1. Clause 7 of the SCCs - Docking Clause applies;
  2. Clause 9 of the SCCs is intentionally omitted;
  3. the following provision under Clause 13(a) of Module 1 of the EU  SCCs applies:
    The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
  4. the following provision under Clause 17 of Module 1 of the EU SCCs applies:
    These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights.  The parties agree that this shall be the law of the Netherlands.
  5. the following provision under Clause 18(b) of Module 1 of EU the SCCs applies:
    The parties agree that those shall be the courts of the Netherlands.
  6. with respect to Annex I of the EU SCCs, the details of the data exporter and data importer are set forth in clause 6.2.1 of the DSA.
  7. with respect to Annex I of the EU SCCs the description of the transfer are set forth in Schedule 1 of the DSA. 
  8. with respect to Annex II of the EU SCCs the description of the technical and organisational security measures are set forth in Schedule 3 of the DSA.
  9. with respect to Annex III of the EU SCCs the details of the sub-processors are set forth in Schedule 4 of the DSA. 

 

III.    Adjustments to the EU SCCs for Personal Data Transfers from Switzerland 

A.  To the extent that the Data Exporter is established in Switzerland and transfers Personal Data related only to Swiss data subjects to a Non-Adequate Jurisdiction, the Swiss DPA applies to the transfers of Personal Data and, therefore, the following adjustments to the EU SCCs shall apply to ensure an adequate level of protection for the transfers of Personal Data outside Switzerland in accordance with the Swiss DPA: 

  1. Annex I.C under Clause 13 of the EU SCCs:  
    With regard to the Swiss entity as a data exporter, the competent supervisory authority is the Federal Data Protection and Information Commissioner (“FDPIC”);
  2. Clause 17 of the EU SCCs: 
    The law governing the Standard Contractual Clauses is Swiss law;
  3. The use of the term ‘EU Member State’ in the EU SCCs must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18 of the EU SCCs;
  4. References to the EU GDPR in the EU SCCs are to be understood as references to the Swiss DPA. 

 B. To the extent that the Data Exporter is established in Switzerland and transfers Personal Data related (also) to EEA data subjects to a non-Adequate Jurisdiction, or if the transfers of Personal Data are otherwise subject to the extraterritoriality provisions of the EU GDPR (Article 3), the Swiss DPA and the EU GDPR apply in parallel to the transfers of Personal Data. In this case, the parties agree that the EU GDPR standard will apply to the transfers of Personal Data because the EU GDPR provides adequate protection and data subjects are consequently not disadvantaged as a result of the transfers.  The following adjustments to the SCCs shall apply:

  1.  Annex I.C under Clause 13 of the EU SCCs:  
    With regard to the Swiss entity as a data exporter, the competent supervisory authorities are the FDPIC, insofar as the transfers of Personal Data are governed by the Swiss DPA, and the EEA competent supervisory authority as indicated in Annex I.C of the EU SCCs, insofar as the transfers of Personal Data are governed by the EU GDPR;
  2. the use of the term ‘EU Member State’ in the EU SCCs must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18 of the EU SCCs; 
  3. with respect to Annex I of the EU SCCs, the details of the data exporter and data importer are set forth in clause 6.2.1 of the DSA.
  4. with respect to Annex I of the EU SCCs the description of the transfer are set forth in Schedule 1 of the DSA. 
  5. with respect to Annex II of the EU SCCs the description of the technical and organisational security measures are set forth in Schedule 3 of the DSA.
  6. with respect to Annex III of the EU SCCs the details of the sub-processors are set forth in Schedule 4 of the DSA.

IV.    UK SCC Addendum
With respect to the UK SCC Addendum, the parties agree that:

  1. with respect to Table 1 of the UK SCC Addendum, the details of the data exporter and data importer are set forth in clause 6.2.1 of the DSA;
  2. with respect to Table 2 of the UK SCC Addendum, the version of the SCCs in force at the date of execution of this Addendum applies;
  3. with respect to Table 3 of the UK SCC Addendum, (a) the description of the parties is set forth in clause 6.2.1 of the DSA, (b) the details of the processing are set forth in Schedule 1, and (c) the description of the technical and organisational security measures are set forth in Schedule 3 of the DSA;
  4. with respect to Table 4 of the UK SCC Addendum, no parties may end the UK SCC Addendum as set out in Section 19 of the UK SCC Addendum.