Executive Summary of Terms, Privacy & Subprocessor Commitments
This document establishes the binding terms governing both your use of the TeamGRC Marketing Website (https://teamgrc.ai) and your access to the TeamGRC Cloud SaaS Platform. It details how TeamGRC (KvK 42164844) processes personal data as a Data Controller for direct business inquiries and commercial administration, delineates our role as a Data Processor for customer tenant data under our Data Processing Addendum (DPA), and publishes our official Subprocessor Register in accordance with Article 28 of the GDPR.
Terms of Service & Platform Use
1. Acceptance of Terms & Scope of Agreement
These Terms of Service (“Terms”) constitute a legally binding agreement between you (“Visitor”, “Customer”, “Authorized User”, or “You”) and TeamGRC (KvK 42164844), established in Amstelveen, The Netherlands, along with its corporate affiliates (“TeamGRC”, “we”, “us”, or “our”).
These Terms govern your access to and use of:
-
The Marketing Website: The public web portals located at
https://teamgrc.ai, its subdomains, product directories, interactive compliance catalogs, ROI calculators, whitepapers, demo booking workflows, and contact channels (collectively, the “Marketing Site”); and - The SaaS Platform: The proprietary cloud-hosted Software-as-a-Service Governance, Risk, and Compliance application, tenant interfaces, automated control evaluation engines, API endpoints, and AI orchestration agents hosted on our secure European infrastructure (collectively, the “SaaS Platform” or “Service”).
By browsing the Marketing Site, requesting a product demonstration, creating an account, or logging into the SaaS Platform, you expressly acknowledge that you have read, understood, and agreed to be legally bound by these Terms and our incorporated Privacy Notice and Subprocessor Register.
If you do not agree to these Terms in their entirety, you must immediately cease accessing and using the Marketing Site and the SaaS Platform.
2. Marketing Site & Enterprise SaaS Platform Relationship
Our digital services operate across two distinct functional tiers:
- Public Marketing Site: Designed exclusively for informational, educational, and commercial evaluation purposes (e.g., framework crosswalk reviews, compliance overviews, whitepapers, and sales consultations). Browsing the Marketing Site or completing a contact form does not confer an enterprise license to access the production SaaS Platform.
- Production Cloud SaaS Platform: Organizational access to the multi-tenant SaaS Platform, tenant-isolated databases, AI agents, and enterprise integrations is governed by a separate, negotiated commercial contract executed between TeamGRC and the subscribing customer organization (“Customer”).
Where you access the SaaS Platform as an Authorized User on behalf of a subscribing Customer, your access is authorized under that Customer's agreement. These Terms establish individual end-user acceptable use requirements, while the governing Customer Agreement controls enterprise licensing, availability commitments, and commercial liabilities.
3. No Formal Legal, Regulatory, or Audit Advice Disclaimer
Crucial Compliance & Regulatory Disclaimer
All content provided through the Marketing Site and the SaaS Platform—including framework mappings (ISO 27001, SOC 2, NIST CSF, NIS2, DORA), automated control crosswalks, risk scoring recommendations, and AI simulation outputs—is provided for operational GRC workflow enablement and informational guidance only, and does not constitute formal legal counsel, statutory audit sign-off, or licensed certification advice.
While TeamGRC integrates authoritative standards and best practices:
- Neither the Marketing Site nor the SaaS Platform replaces certified public accountants, accredited third-party assessment organizations (3PAOs), licensed certification bodies, or qualified legal counsel.
- You and your organization retain sole responsibility for verifying compliance posture, assessing residual risks, and implementing internal controls suitable for your statutory obligations.
- TeamGRC makes no warranty that utilization of the platform guarantees passing regulatory audits or confers immunity from administrative fines under European or international law.
4. AI Demonstrations, Amazon Bedrock Inference & Model Governance
TeamGRC incorporates advanced artificial intelligence to automate compliance cross-referencing, policy gap analysis, and risk scoring:
4.1 Public Marketing AI Demonstrations
Interactive simulations, sample chat interfaces, and automated crosswalk previews on the Marketing Site are illustrative demonstrations. They utilize probabilistic language synthesis to demonstrate platform capabilities and should not be used as the basis for production risk management decisions.
4.2 SaaS Platform AI Inference & Zero-Training Guarantee
Within the production SaaS Platform:
- European Cloud Execution: AI inference is executed strictly via Amazon Bedrock hosted in Frankfurt, Germany (`eu-central-1`). All inference computations remain within the European Union.
- Strict Multi-Tenant Isolation: Logical data segregation ensures that customer prompts, compliance evidence, uploaded policies, and AI completions remain strictly isolated within the customer's tenant container.
- No Foundation Model Training: Neither public website inquiries nor customer tenant data (including prompts, inputs, attachments, and model responses) are ever used to train, retrain, or fine-tune public base models or foundation models operated by AWS or TeamGRC.
5. Intellectual Property Rights & Limited License
The Marketing Site and the SaaS Platform, including their software source code, database architectures, user interface designs, visual styling, brand emblems, logos, framework taxonomies, control correlation algorithms, and documentation, are the sole and exclusive intellectual property of TeamGRC and its licensors, protected under Dutch, European, United States, and international copyright, trade secret, trademark, and patent laws.
5.1 Limited Evaluation License (Marketing Site)
Subject to compliance with these Terms, TeamGRC grants Visitors a revocable, non-exclusive, non-transferable, non-sublicensable license to access and view the Marketing Site solely for internal business evaluation.
5.2 Platform Access License (SaaS Platform)
Authorized Users are granted a limited, non-exclusive, non-transferable right to access and operate the SaaS Platform during their organization's active subscription term, strictly in accordance with the executed Customer Agreement and these Terms.
5.3 Trademark Protection
“TeamGRC”, “TeamGRC.ai”, the TeamGRC emblem, and all related product names, graphics, and service marks are proprietary trademarks of TeamGRC. Unauthorized use, imitation, or registration of these marks is strictly prohibited.
6. Acceptable Use & Prohibited Conduct
You covenant and agree to use the Marketing Site and the SaaS Platform solely for lawful, authorized business purposes. You shall not:
- Scraping & Data Extraction: Utilize automated spiders, scrapers, crawlers, or harvesting tools to extract data, framework taxonomies, or code from the Marketing Site or SaaS Platform, or bypass
robots.txtprotocols. - AI Model Harvesting: Ingest, extract, or scrape platform content, taxonomies, or outputs to train, fine-tune, or benchmark third-party artificial intelligence or machine learning models without prior written consent.
- Unauthorized Security Testing: Probe, scan, penetration-test, or fuzz the Marketing Site, SaaS APIs, or underlying cloud infrastructure without an executed Responsible Disclosure Agreement with TeamGRC.
- Malicious Code & Payloads: Upload, inject, or transmit viruses, ransomware, logic bombs, trojans, or malicious payloads into the service or through file upload features.
- Tenant Boundary Violations: Attempt to circumvent logical tenant separation, access another customer's tenant environment, or compromise another user's authentication tokens.
- Credential Abuse: Share named user credentials, permit concurrent multi-party session access on single-user accounts, or fail to safeguard API access tokens.
- Reverse Engineering: Decompile, disassemble, reverse engineer, or attempt to derive the source code of any client-side or backend application scripts powering the Service.
- Denial of Service & Misrepresentation: Launch denial of service (DoS/DDoS) attacks, flood contact or API endpoints, or submit falsified corporate details.
7. Disclaimers of Warranties & Limitation of Liability
7.1 “As-Is” Provision for Marketing Site
THE MARKETING SITE AND ALL INFORMATIONAL CONTENT OBTAINED THROUGH IT ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. TEAMGRC EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.
7.2 SaaS Platform Warranties & Liabilities
WARRANTIES, SERVICE LEVEL COMMITMENTS (SLAS), INDEMNITIES, AND LIABILITY ALLOCATIONS FOR THE PRODUCTION SAAS PLATFORM ARE GOVERNED EXCLUSIVELY BY THE EXECUTED CUSTOMER AGREEMENT BETWEEN TEAMGRC AND THE SUBSCRIBING CUSTOMER ORGANIZATION.
7.3 Marketing Site Liability Cap
TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL TEAMGRC BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THE PUBLIC MARKETING SITE. TEAMGRC'S TOTAL AGGREGATE LIABILITY ARISING FROM THE PUBLIC MARKETING SITE SHALL NOT EXCEED ONE HUNDRED EUROS (€100.00 EUR).
Privacy Notice & Data Protection
8. Who is Responsible: Data Controller & Processor Roles
TeamGRC is committed to protecting your privacy, safeguarding personal data, and maintaining strict compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR), the Dutch GDPR Implementation Act (Uitvoeringswet AVG), the UK GDPR, and applicable international privacy frameworks.
Depending on your interaction with TeamGRC, our statutory data protection role is defined as follows:
Cloud Infrastructure & AI Inference Region: European Union (Frankfurt, Germany - AWS
eu-central-1)Data Protection & Privacy Contact: privacy@teamgrc.ai
8.1 TeamGRC as Data Controller
TeamGRC (KvK 42164844), the Netherlands, is the Data Controller for the business relationship, customer administration, sales communications, marketing preferences, statutory accounting records, and public website telemetry described below. Inquiries concerning this data should be directed to privacy@teamgrc.ai.
8.2 TeamGRC as Data Processor (SaaS Platform)
For personal data processed on a customer's behalf within the production TeamGRC SaaS Platform—including tenant user accounts, compliance and risk records, uploaded audit evidence, policy documents, and operational tenant logs—the customer is the Data Controller and TeamGRC is its Data Processor. Requests concerning that tenant-controlled data should be directed to the customer organization.
9. Personal Data Categories & Processing Purposes
We receive information directly from you, your organisation and its authorised representatives, and automatically through website and service interactions:
| Personal Data Category | Purpose and Legal Basis |
|---|---|
| Name, business contact details, employer, role and correspondence | Answering enquiries, administering agreements and maintaining business relationships: legitimate interests in communicating with business contacts and operating our business (GDPR Art. 6(1)(f)). Contract performance or pre-contractual steps apply where you personally are the contracting party (GDPR Art. 6(1)(b)). |
| Support communications and identifiable design partner feedback | Resolving enquiries and improving the service: legitimate interests in providing support and developing the product (GDPR Art. 6(1)(f)). Customer-controlled content within the SaaS platform remains subject to the DPA. |
| IP address, browser and device information, timestamps and security events | Operating and protecting our website and SaaS systems: legitimate interests in service reliability, threat prevention, and preventing misuse (GDPR Art. 6(1)(f)). Tenant logs processed on the customer's behalf remain subject to the DPA. |
| Contract, accounting and tax records containing personal data | Meeting applicable Dutch statutory recordkeeping and tax obligations: legal obligation (GDPR Art. 6(1)(c)). Establishing, exercising, or defending legal claims: legitimate interests in protecting our legal rights (GDPR Art. 6(1)(f)). |
| Contact details and marketing preferences, where you subscribe | Sending optional marketing communications, newsletters, regulatory briefings, and platform release updates: consent (GDPR Art. 6(1)(a)). |
| Inquiry details shared with Authorized Partners (where consented) | Facilitating localized consulting, specialized GRC implementation services, or joint solution walkthroughs with authorized third-party partner companies: consent (GDPR Art. 6(1)(a)). |
Necessity of Provision: Contact and identification details are necessary to handle your enquiry or administer the agreement; without them we may be unable to do so. Information required for statutory accounting and tax records must be provided where applicable under Dutch law. Optional marketing consent and partner collaboration sharing are strictly voluntary.
Special Categories of Data: TeamGRC does not solicit, collect, or process any special category personal data (e.g., health, biometric, genetic, philosophical, political, or trade union membership data) through the Marketing Site or as part of platform administration.
10. Legal Bases for Processing (GDPR Article 6)
In accordance with Article 6 of the GDPR and the Dutch AVG, TeamGRC processes personal data strictly under recognized lawful bases:
- Contract Performance & Pre-Contractual Steps (Art. 6(1)(b) GDPR): Processing necessary to deliver contracted SaaS services to you as an individual contracting party, or to take requested steps prior to entering into an agreement (e.g., fulfilling demo requests or onboarding).
- Legitimate Business Interests (Art. 6(1)(f) GDPR): Processing necessary for our legitimate interests in communicating with B2B counterparties, administering customer relationships, safeguarding application security, preventing platform abuse, and improving our product, provided such interests are not overridden by your data protection rights.
- Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Processing necessary to satisfy mandatory Dutch and European statutory accounting, tax, corporate recordkeeping, and regulatory reporting mandates.
- Consent (Art. 6(1)(a) GDPR): Where you actively subscribe to marketing newsletters or authorize sharing of inquiry information with authorized implementation partners. Consent may be withdrawn at any time without affecting past processing.
11. Recipients, Cloud Infrastructure & International Transfers
11.1 Categories of Data Recipients
Personal data may be disclosed, strictly as necessary, to:
- Cloud infrastructure and communication service providers supporting the website and SaaS platform;
- External professional advisers (legal counsel, statutory auditors, tax consultants) bound by professional duties of confidentiality;
- Competent public authorities, courts, or regulatory bodies where disclosure is mandatory under applicable European or Dutch law;
- Authorized third-party commercial partners, strictly where you have provided explicit consent for referral or joint implementation.
11.2 Cloud Infrastructure & Hosting Locations
TeamGRC enforces rigorous European data residency:
- Cloud Provider: Our primary cloud hosting provider is Amazon Web Services EMEA SARL, established in Luxembourg.
- Hosting & Inference Location: Tenant database storage, application computing, and AI inference through Amazon Bedrock take place strictly in Frankfurt, Germany (`eu-central-1`).
- Corporate Administration: TeamGRC corporate governance and administrative operations take place in The Netherlands.
11.3 International Data Transfers
Where processing involves access from outside the European Economic Area (EEA), we implement the European Commission's Standard Contractual Clauses (SCCs) and any necessary supplementary technical and organizational safeguards. You can obtain a copy of applicable safeguards by emailing privacy@teamgrc.ai or support@teamgrc.ai.
Any transfer of customer-controlled tenant data must also satisfy the requirements of Section 8.3 of the Data Processing Addendum (DPA).
11.4 Partner Sharing & Revocation
Where you consent to partner collaboration, TeamGRC may pass your provided details (name, corporate email, phone number, company, and inquiry notes) to authorized regional channel partners, implementation consultancies, or technology integration partners solely to follow up on your specific evaluation. You may revoke partner sharing at any time by contacting privacy@teamgrc.ai.
12. Data Retention Schedules
We retain personal data only for as long as necessary to satisfy the commercial, contractual, and statutory purposes for which it was collected:
| Records Held by TeamGRC as Controller | Retention Period |
|---|---|
| Enquiries (website inquiries & sales leads) | Up to 12 months after the last interaction. |
| Support correspondence | Up to two (2) years after resolution. |
| Identifiable design partner feedback | Up to 12 months after the programme or agreement ends. |
| Operational and security logs | Up to 30 days (rolling automated purge). |
| Statutory accounting and tax records | Seven (7) years, subject to the applicable statutory calculation and exceptions under Dutch tax law (Algemene wet inzake rijksbelastingen). |
| Other agreement administration and legal-claims records | For the duration of the business relationship and afterwards only while needed for an applicable statutory limitation period or an active dispute. |
| Marketing contact details and preferences | Until consent is withdrawn; a minimal suppression record is retained indefinitely to ensure your unsubscribe preference is respected. |
Records may be kept longer where strictly required by law. Customer-controlled tenant data processed within the SaaS Platform follows the return and deletion periods set out in Section 6 of the Customer Agreement / Data Processing Addendum.
13. Your Data Protection Rights Under GDPR & EU Law
Subject to the conditions and exemptions provided under Chapter III of the GDPR, you may exercise the following rights regarding your personal data:
| GDPR Article | Statutory Right | Description of Entitlement |
|---|---|---|
| Article 15 | Right of Access | Obtain confirmation as to whether we process your data and receive a copy of such personal data. |
| Article 16 | Right to Rectification | Request the correction of inaccurate personal data or completion of incomplete records. |
| Article 17 | Right to Erasure | Request deletion of your personal data where retention is no longer legally justified (“Right to be forgotten”). |
| Article 18 | Right to Restriction | Request suspension of processing while accuracy or legitimate grounds are verified. |
| Article 20 | Right to Portability | Receive personal data provided to us in a structured, commonly used, machine-readable format. |
| Article 21 | Right to Object | Object to processing based on legitimate interests or direct commercial marketing. |
Statutory Right to Object (GDPR Article 21)
You may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time.
Withdrawal of Consent: Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
Exercising Your Rights: Contact privacy@teamgrc.ai to exercise your rights. We will respond within thirty (30) calendar days without charge. Where your request relates to customer-controlled tenant records, we will promptly redirect your request to the relevant Customer.
Supervisory Authority Complaint: You have the right to complain to the Autoriteit Persoonsgegevens (AP) or another competent European supervisory authority:
Bezuidenhoutseweg 30, 2594 AV Den Haag, The Netherlands
Website: https://www.autoriteitpersoonsgegevens.nl/
14. United States State Privacy Disclosures (CCPA / CPRA)
This section applies to residents of California and other US states with comprehensive privacy legislation:
- No Sale or Sharing of Personal Data: TeamGRC does not sell, rent, or share personal information with third parties for cross-context behavioral advertising.
- Consumer Rights: Eligible US consumers possess rights to know, access, correct, and delete personal information collected by TeamGRC, and to receive non-discriminatory service.
To submit a US state privacy inquiry, email privacy@teamgrc.ai with the subject line “US State Privacy Request”.
16. Technical & Organizational Security Measures (TOMs)
In compliance with Article 32 of the GDPR, TeamGRC applies rigorous Technical and Organizational Measures across all hosting environments:
- Transport Layer Security: Enforced HTTPS with TLS 1.3 cryptography across all web and API communications.
- Encryption at Rest: AES-256 bit encryption applied across all backend databases, object stores, and secure backup archives.
- Strict Tenant Isolation: Logical multi-tenant boundaries separating customer databases, audit trails, and policy stores.
- Access Control & Least Privilege: Enforced multi-factor authentication (MFA), role-based access control (RBAC), and zero-trust administrative perimeters.
- Secure AI Isolation: Amazon Bedrock AI endpoints operating within private cloud VPCs, with zero data retention for foundational model training.
Subprocessors & Governance
17. Official Subprocessor Register
Pursuant to Article 28 of the GDPR and Sections 8–9 of the Design Partner Agreement / Master Services Agreement (DPA), this Subprocessor Register identifies the technical subprocessor engaged by TeamGRC to process customer personal data within the production SaaS Platform:
| Subprocessor | Function & Processing Scope | Corporate Seat & Processing Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, secure object storage, database execution, application compute, user authentication (AWS Cognito), transactional email, edge content delivery, and generative AI inference through Amazon Bedrock. |
Provider Establishment: Luxembourg. Tenant Hosting & AI Inference: Frankfurt, Germany (AWS Region eu-central-1).
|
Subprocessor Governance: Subprocessor authorisation, notifications of planned changes, and customer objection rights are governed by Section 8.3 of the Data Processing Addendum (DPA). Any additional downstream processor receiving personal data must be identified before processing under Section 9 of the Agreement.
18. Governing Law, Dispute Resolution & Jurisdiction
These Terms, the Privacy Notice, and any dispute, controversy, or claim arising out of or relating to your use of the Marketing Site or the SaaS Platform shall be governed by, construed, and enforced in accordance with the laws of The Netherlands, without regard to conflict of law principles.
Any legal dispute or proceeding arising out of or in connection with these Terms that cannot be resolved amicably shall be submitted to the exclusive jurisdiction of the competent district court in Amsterdam, The Netherlands, without prejudice to mandatory statutory consumer venue rights under applicable European Union regulations.
19. Amendments, Severability & Contact Channels
19.1 Modifications to Terms
TeamGRC reserves the right to revise and update these Terms, the Privacy Notice, and the Subprocessor Register periodically to reflect evolving legal mandates, regulatory guidance, or platform enhancements. When amendments are enacted, we will update the “Effective Date” at the top of this document. Continued use of the Marketing Site or SaaS Platform following the posting of revised terms constitutes binding acceptance.
19.2 Severability
If any provision of these Terms is determined by a court of competent jurisdiction to be unlawful, invalid, or unenforceable, that provision shall be enforced to the maximum extent permissible, and the remaining provisions shall continue in full force and effect.
19.3 Corporate Contact Channels
For inquiries, feedback, or legal notices concerning these Terms or our data protection practices, please reach out via our dedicated channels: