Global B-Gate

Terms of Use

1. Acceptance of Terms

The GBG Collaborative Platform (GCP) services are subject to these Terms of Use (TOU). GBG may update the TOU without notice. The current version is available via the "Terms of Use" link at the bottom of GCP web pages.
By using the GCP, you agree to comply with all terms and conditions. Your right to use the GCP is personal and non-transferable. You are responsible for all account use and must keep your password confidential.
GBG can change or discontinue any aspect of the GCP, including content, availability, and required equipment, at any time.

2. Changed Terms

GBG may change the TOU or impose new conditions. Changes are effective immediately upon notice, which may be provided by posting on the GCP or via email. Continued use of the GCP after notice means you accept the changes.

3. Description of Platform

GBG provides access to resources, including download areas, communication forums, software applications, projects, and product information (the "Platform"). The platform and updates are subject to the TOU.

4. Equipment

You are responsible for obtaining and maintaining all equipment needed to access and use the GCP and all related charges.

5. User Conduct

Use the GCP for lawful purposes only. Do not post or transmit any material that violates others' rights or is unlawful, abusive, defamatory, invasive of privacy, or objectionable.
The GCP contains copyrighted material, trademarks, and proprietary information. Do not modify, publish, transmit, or exploit any content without permission. You may download copyrighted material for personal use only and must comply with copyright law.
Ensure any uploaded material is not protected by copyright unless you have obtained permission. By submitting material, you grant GBG the right to use, reproduce, and distribute it.
Section 5 benefits GBG, its subsidiaries, affiliates, and third-party content providers, who may enforce its provisions.

6. Use of the GCP

The GCP may include services like email, bulletin boards, chat areas, and forums ("GCP Services"). Use GCP Services only for lawful purposes and follow specific guidelines, including avoiding harassment, not uploading harmful files, and not engaging in unauthorised commercial activities.
GBG can review and remove materials posted to the GCP Services and terminate access to any or all GCP Services at any time.

7. Member Account, Password, and Security

If GCP Services require an account, provide accurate information and keep your password and account confidential. You are responsible for all activities under your account and must notify GBG of unauthorised use.

8. Notice Specific to Software Available on This GCP

Any software available for download through GCP is the copyrighted work of GBG and/or its suppliers. Use of the software is governed by the end-user license agreement. Unauthorised reproduction or redistribution of the software is prohibited.

9. Notice Specific to Documents Available on This GCP

Documents available on the GCP, such as white papers and FAQs, may only be used for informational, non-commercial purposes. GBG and its suppliers provide these documents "as is" without warranty.

10. Notices Regarding Software, Documents, and Services Available on This GCP

GBG and its suppliers are not liable for any damages arising from the use or inability to use the software, documents, services, or information from the GCP.

11. Materials Provided to GBG or Posted at Its GCP

GBG does not claim ownership of materials you provide or post. However, by posting materials, you grant GBG the rights to use, reproduce, and distribute them.

12. Disclaimer of Warranty; Limitation of Liability

The GCP is provided "as is" without warranties of any kind. GBG does not guarantee that the GCP will be uninterrupted or error-free.
GBG is not liable for any damages resulting from the use or inability to use the GCP, including direct, indirect, incidental, special, or consequential damages.

13. Links to Third-Party Sites

GBG is not responsible for the content of any linked sites and provides these links only for convenience. The inclusion of any link does not imply endorsement by GBG.

14. Indemnity

You agree to indemnify and hold harmless GBG, its affiliates, and their respective officers, directors, employees, and agents from any claims arising from your use of the GCP or violation of the TOU.

15. Termination

GBG may terminate your access to the GCP at any time, without notice, for conduct that violates these TOUs or is harmful to other users.

16. Governing Law

These TOUs are governed by the laws of the jurisdiction where GBG is headquartered, without regard to their conflict of law provisions.

17. Miscellaneous

These TOUs constitute the entire agreement between you and GBG and govern your use of the GCP, superseding any prior agreements. The failure of GBG to exercise or enforce any right or provision of the TOU does not constitute a waiver of such right or provision.

18. Contact Information

For any questions about these TOUs, contact GBG using the contact information on the GCP website.

19. Non-Competing

You agree not to engage in any activity that competes with GBG or any other GCP member during your relationship and for five years after termination. This includes forming or making plans to form a competing business entity.
You may seek or obtain employment with a competitor after termination of your relationship with GBG, provided the competitor existed before the termination and you were not involved in its organisation or formation.
You agree not to compete with GBG by serving in any capacity with a competing firm or entity during this period.
This agreement remains in effect for five years from the approval date and extends to all geographic areas where GBG operates.
Each party to this agreement has caused it to be executed in all operational countries by GBG and its subscribers globally.

20. Confidentiality

GBG may provide you with specific customer lists, pricing data, supply sources, techniques, and other confidential and proprietary information, including trade secrets, inventions, patents, and copyrighted materials ("Confidential Material").
This information has independent economic value and is not generally known to the public or others who could use it economically. Do not disclose this agreement, its terms, or any confidential material. Do not make any copies of confidential material.
Do not remove confidential material or any GBG property from GBG’s premises without permission.
Upon GBG's request, return all materials, including confidential material, to GBG.
Acknowledge that you have read and understand GBG's confidentiality policies and procedures.

21. Proprietary Information

Proprietary information includes all information about the business and practices introduced or developed by GBG during the agreement term.
All proprietary information remains the sole property of GBG. Promptly disclose any proprietary information you develop during your relationship to GBG and assign any rights to GBG. Upon termination, deliver all proprietary information materials to GBG.
Comply with GBG's policies to protect proprietary information and do not disclose it without GBG's prior written consent.
Appoint GBG officers as your agents to execute and file documents to maintain patents, copyrights, or other Proprietary Information rights.

22. Business Opportunities

Notify GBG of any related business opportunities you become aware of during your relationship.

23. No Ownership

This Agreement does not create any ownership, partnership, joint venture, or employer-employee relationship. Neither party has the authority to bind the other without a separate written agreement.

Lawful basis and transparency

Conduct an information audit to determine what information you process and who has access to it. expand_more

organisation that have at least 250 employees or conduct higher-risk data processing are required to keep an up-to-date and detailed list of their processing activities and be prepared to show that list to regulators upon request. The best way to demonstrate GDPR compliance is using a data protection impact assessment organisation with fewer than 250 employees should also conduct an assessment because it will make complying with the GDPR's other requirements easier. In your list, you should include: the purposes of the processing, what kind of data you process, who has access to it in your organisation, any third parties (and where they are located) that have access, what you're doing to protect the data (e.g. encryption), and when you plan to erase it (if possible).
Have a legal justification for your data processing activities. expand_more

Processing of data is illegal under the GDPR unless you can justify it according to one of the six conditions listed in Article 6. There are other provisions related to children and special categories of personal data in Articles 7-11. Review these provisions, choose a lawful basis for processing, and document your rationale. Note that if you choose "consent" as your lawful basis, there are extra obligations, including giving data subjects the ongoing opportunity to revoke consent. If "legitimate interests" is your lawful basis, you must be able to demonstrate you have conducted a privacy impact assessment.
Provide clear information about your data processing and legal justification in your privacy policy. expand_more

You need to tell people that you're collecting their data and why (Article 12). You should explain how the data is processed, who has access to it, and how you're keeping it safe. This information should be included in your privacy policy and provided to data subjects at the time you collect their data. It must be presented "in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child."

Data security

Take data protection into account at all times, from the moment you begin developing a product to each time you process data. expand_more

You must follow the principles of "data protection by design and by default," including implementing "appropriate technical and organisational measures" to protect data. In other words, data protection is something you now have to consider whenever you do anything with other people's personal data. You also need to make sure any processing of personal data adheres to the data protection principles outlined in Article 5. Technical measures include encryption, and organisational measures are things like limiting the amount of personal data you collect or deleting data you no longer need. The point is that it needs to be something you and your employees are always aware of.
Encrypt, pseudonymize, or anonymise personal data wherever possible. expand_more

Most of the productivity tools used by businesses are now available with end-to-end encryption built in, including email, messaging, notes, and cloud storage. The GDPR requires organisation to use encryption or pseudeonymization whenever feasible.
Create an internal security policy for your team members and build awareness about data protection. expand_more

Even if your technical security is strong, operational security can still be a weak link. Create a security policy that ensures your team members are knowledgeable about data security. It should include guidance about email security, passwords, two-factor authentication, device encryption, and VPNs. Employees who have access to personal data and non-technical employees should receive extra training in the requirements of the GDPR.
Know when to conduct a data protection impact assessment, and have a process in place to carry it out. expand_more

A data protection impact assessment (aka privacy impact assessment) is a way to help you understand how your product or service could jeopardise your customers' data, as well as how to minimize those risks. The UK Information Commissioner's Office (ICO) has a data protection impact assessment checklist on its website. The GDPR requires organisations to carry out this kind of analysis whenever they plan to use people's data in such a way that it's "likely to result in a high risk to [their] rights and freedoms." The ICO recommends just doing it anytime you're about to process personal data.
Have a process in place to notify the authorities and your data subjects in the event of a data breach. expand_more

If there's a data breach and personal data is exposed, you are required to notify the supervisory authority in your jurisdiction within 72 hours. A list of many of the EU member states supervisory authorities can be found here. The GDPR does not specify whom you should notify if you are not an EU-based organisation. For those in English-speaking non-EU countries, you may find it easiest to notify the Office of the Data Protection Commissioner in Ireland. You are also required to quickly communicate data breaches to your data subjects unless the breach is unlikely to put them at risk (for instance, if the stolen data is encrypted).

Accountability and governance

Designate someone responsible for ensuring GDPR compliance across your organisation. expand_more

Another part of "data protection by design and by default" is making sure someone in your organisation is accountable for GDPR compliance. This person should be empowered to evaluate data protection policies and the implementation of those policies.
Sign a data processing agreement between your organisation and any third parties that process personal data on your behalf. expand_more

This includes any third-party services that handle the personal data of your data subjects, including analytics software, email services, cloud servers, etc. The vast majority of services have a standard data processing agreement available on their websites for you to review. They spell out the rights and obligations of each party for GDPR compliance. You should only use third parties that are reliable and can make sufficient data protection guarantees.
If your organisation is outside the EU, appoint a representative within one of the EU member states. expand_more

If you process data relating to people in one particular member state, you need to appoint a representative in that country who can communicate on your behalf with data protection authorities. The GDPR and its official supporting documents do not give guidance for situations where processing affects EU individuals across multiple member states. Until this requirement is interpreted, it may be prudent to designate a representative in a member state that uses your language. Some organisations, like public bodies, are not required to appoint a representative in the EU .
Appoint a Data Protection Officer (if necessary) expand_more

There are three circumstances in which organisations are required to have a Data Protection Officer (DPO), but it's not a bad idea to have one even if the rule doesn't apply to you. The DPO should be an expert on data protection whose job is to monitor GDPR compliance, assess data protection risks, advise on data protection impact assessments, and cooperate with regulators.

Privacy rights

It's easy for your customers to request and receive all the information you have about them. expand_more

People have the right to see what personal data you have about them and how you're using it. They also have a right to know how long you plan to store their information and the reason for keeping it that length of time. You have to send them the first copy of this information for free but can charge a reasonable fee for subsequent copies. Make sure you can verify the identity of the person requesting the data. You should be able to comply with such requests within a month.
It's easy for your customers to correct or update inaccurate or incomplete information. expand_more

Do your best to keep data up to date by putting a data quality process in place, and make it easy for your customers to view (Article 15) and update their personal information for accuracy and completeness. Make sure you can verify the identity of the person requesting the data. You should be able to comply with requests under Article 16 within a month.
It's easy for your customers to request to have their personal data deleted. expand_more

People generally have the right to ask you to delete all the personal data you have about them, and you have to honour their request within about a month. There are five grounds on which you can deny the request, such as the exercise of freedom of speech or compliance with a legal obligation. You must also try to verify the identity of the person making the request.
It's easy for your customers to ask you to stop processing their data. expand_more

Your data subjects can request to restrict or stop processing of their data if certain grounds apply, mainly if there's some dispute about the lawfulness of the processing or the accuracy of the data. You are required to honour their request within about a month. While processing is restricted, you're still allowed to keep storing their data. You must notify the data subject before you begin processing their data again.
It's easy for your customers to receive a copy of their personal data in a format that can be easily transferred to another company. expand_more

This means that you should be able to send their personal data in a commonly readable format (e.g. a spreadsheet) either to them or to a third party they designate. This may seem unfair from a business standpoint in that you may have to turn over your customers' data to a competitor. But from a privacy standpoint, the idea is that people own their data, not you.
It's easy for your customers to object to you processing their data. expand_more

If you're processing their data for the purposes of direct marketing, you have to stop processing it immediately for that purpose. Otherwise, you may be able to challenge their objection if you can demonstrate "compelling legitimate grounds."
If you make decisions about people based on automated processes, you have a procedure to protect their rights. expand_more

Some types of organisations use automated processes to help them make decisions about people that have legal or "similarly significant" effects. If you think that applies to you, you'll need to set up a procedure to ensure you are protecting their rights, freedoms, and legitimate interests. You need to make it easy for people to request human intervention, to weigh in on decisions, and to challenge decisions you've already made.