Grasp Privacy Statement

Introduction

Grasp SAS ("Grasp", "we", "us") is a French company registered in Tours under number 897 694 196, with its registered office at 8 rue Balzac, 37000 Tours, France. Grasp provides a SaaS platform dedicated to operational excellence in digital media buying, with three products: Grasp QA, Taxo_ and Loop.

This Privacy Statement explains how we collect and use personal data when you visit our websites (grasp.gg, taxo.gg and getloop.gg), contact us, or use the Grasp platform, its browser extension and its Spreadsheet extension. It also describes your rights and how to exercise them.

Grasp is the data controller for the personal data it processes for its own purposes, such as website analytics, sales and marketing, account administration, billing and security. When our customers use the Grasp platform, Grasp processes the personal data contained in their campaign data on their behalf, as a data processor, under a Data Processing Agreement. In that case, the customer's own privacy policy applies.

We may update this Privacy Statement from time to time. The effective date above shows when it was last changed.

Data Protection Officer

Grasp has appointed an internal Data Protection Officer (DPO). You can contact our DPO with any question about this Privacy Statement or to exercise your rights:

Data Protection Officer, Grasp SAS, 8 rue Balzac, 37000 Tours, France
Email: dpo@grasp.gg

How we collect and use (process) your personal information

We only collect business-related personal data. Depending on your relationship with Grasp, this may include:

• Contact information: first and last name, business email address, job title, employer, country
• Account information: user ID, role and permissions, single sign-on identifiers
• Usage and technical data: IP address, browser type, operating system, log data, actions performed in the platform and the browser extension
• Communications: demo requests, support requests and other exchanges with our team

We collect this information directly from you, from your employer when it creates your user account, and automatically when you use our websites or the platform. We may also obtain professional information about you from public sources such as LinkedIn.

We do not collect special categories of personal data, and we do not sell personal information to anyone.

We use your personal data for the following purposes:

• Answering your requests and organising demos: steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries
• Providing the platform, managing customer accounts and support: performance of our contract with your employer, and our legitimate interest in managing our business relationships
• Securing our services and preventing misuse: our legitimate interest in keeping our services secure and reliable
• Measuring the audience of our websites and improving our products: your consent where required for cookies, otherwise our legitimate interest
• Sending information about our products, services and events: our legitimate interest in B2B prospecting. You can opt out at any time
• Invoicing and meeting our legal obligations: compliance with our legal obligations

Use of the Grasp websites

When you visit our websites, our servers automatically record technical information in log files: your IP address, approximate location, browser type, operating system and the pages you view. We use this information to operate and secure our websites, diagnose technical problems and understand how visitors use our websites so that we can improve them.

This processing is based on our legitimate interest in running and improving our websites, and on your consent where required for cookies. More information is available in the Cookies section below. Tools used on the websites: Google Analytics, HubSpot tracking and Clearbit.

If you fill in a form on our websites (for example to request a demo), we use the information you provide to answer your request and follow up with you.

Cookies and tracking technologies

Our websites use cookies and similar technologies to operate properly, to measure audience and to understand how visitors interact with our content. Some of these technologies are provided by third parties, such as Google (Analytics), HubSpot and Clearbit, which may collect information about your browsing on our websites.

You can control or delete cookies at any time through your browser settings. Blocking certain cookies may affect how our websites work.

We are currently updating how we manage cookie preferences on our websites. This section will be updated accordingly. For any question, contact dpo@grasp.gg.

Use of the Grasp services

The Grasp platform is used by employees of advertisers and media agencies. When our customers use the platform, they decide which data is processed and why. Grasp processes this data on their behalf and on their documented instructions, under a Data Processing Agreement. This includes the names or identifiers of the people who create or edit campaigns, as returned by the advertising platforms our customers connect.

Connections to advertising platforms such as Google, Meta or TikTok use OAuth 2.0 or an equivalent authorisation flow. No advertising platform password is ever sent to or stored by Grasp. Access tokens are stored within the European Economic Area, and customers can revoke them at any time from the relevant platform.

User authentication is managed through Amazon Cognito. Customers can also enable single sign-on (SAML 2.0, Google or Microsoft).

The Grasp browser extension reads the advertising platform page you are working on in order to run quality checks, for example on budgets, targeting and naming.

Some features, such as AI-assisted features in Loop, use third-party AI providers. These features run with EU data residency, and customer data is never used to train AI models. Providers used: OpenAI and Anthropic.

When and how we share information with third parties

We do not sell personal information to anyone. We share it only with service providers that help us deliver our services, under written contracts that require them to protect it. Each provider only receives the data it needs for its task. Our main providers are:

• Amazon Web Services: hosting, databases, storage, authentication, transactional emails (Ireland)
• Axiom: application logs and traces (Germany)
• PostHog: product analytics, error monitoring, in-app surveys (Germany)
• OpenAI: AI-assisted features (European Economic Area)
• Anthropic: AI-assisted features (European Economic Area)
• HubSpot: CRM, marketing emails, customer support (United States)
• Google Analytics: website audience measurement (United States)

The up-to-date list of the sub-processors that process customer data on behalf of our customers is available at trust.grasp.gg/subprocessors.

We may also disclose personal information when you ask us to or authorise it, when required by law or by a competent authority, to enforce our agreements, or to protect the rights, property or safety of Grasp, our customers or others.

Our websites include links to our pages on social networks such as LinkedIn. These services have their own privacy policies, which we encourage you to read.

Transferring personal data outside the European Economic Area

Grasp hosts and stores the data of the Grasp platform within the European Economic Area, on Amazon Web Services in Ireland. Our platform providers also store this data within the European Economic Area. Content delivery and firewall services may route network traffic through global locations of our hosting provider, without storing data outside the European Economic Area.

Some of our providers belong to groups established outside the European Economic Area, for example in the United States. Any remote access by these group entities is covered by the Standard Contractual Clauses adopted by the European Commission, as set out in each provider's data processing agreement.

Business contact data managed in our CRM and marketing tool, HubSpot, and website audience data collected through Google Analytics are stored in the United States. Transfers to HubSpot are covered by the Standard Contractual Clauses included in HubSpot's data processing agreement. Transfers to Google rely on the transfer mechanisms described in Google's data processing terms.

Data subject rights

Under the GDPR, you have the following rights regarding your personal data:

• The right to be informed about how we use your personal data
• The right of access to your personal data
• The right to rectification of inaccurate data
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object to processing based on our legitimate interest, and to object at any time to direct marketing
• The right to withdraw your consent at any time, where processing is based on consent

To exercise your rights, email our DPO at dpo@grasp.gg. We may ask you for information to confirm your identity. Exercising your rights is free of charge. We answer within one month. This period may be extended by two months for complex requests, in which case we will tell you why.

You can unsubscribe from our marketing emails at any time using the link in each email.

If your request concerns data that Grasp processes on behalf of one of our customers, for example your employer, we will forward it to that customer and help them respond.

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of the EU country where you live or work.

Security of your information

We protect personal data with technical and organisational measures suited to the risk, including:

• Encryption of data in transit (HTTPS, TLS 1.2 or higher) and at rest (AES-256)
• Role-based access on a least-privilege basis, with multi-factor authentication for all Grasp staff accessing production systems, and access reviewed every quarter
• Hosting on Amazon Web Services across several availability zones, with continuous backups
• Separate development, staging and production environments, with no production personal data used for testing
• A web application firewall, regular patching and an annual penetration test by an independent third party
• Confidentiality commitments and security awareness training for all staff

Our security program is monitored continuously through Vanta, and we are working toward ISO/IEC 27001:2022 certification. More information is available at trust.grasp.gg.

Data storage and retention

We keep personal data only as long as needed for the purposes described in this Privacy Statement, or as required by law:

• Customer data on the Grasp platform: duration of the contract. Customers can export their data for 30 days after the end of the contract, and the data is deleted within 60 days.
• Database backups: 30 days, on a rolling basis
• Logs: up to 12 months
• Invoices and accounting records: as required by French law

Data of the Grasp platform is stored in the European Economic Area, mainly in Ireland. When the retention period ends, we delete or anonymise the data. You can also ask us to delete your data at any time by emailing dpo@grasp.gg, unless we are required by law to keep it.

Security of spreadsheet data (Spreadsheet extension)

The Grasp Spreadsheet extension lets users check and upload media plans from Google Sheets and Microsoft Excel. When you use it, we protect your spreadsheet data, including Google user data, as follows:

• Spreadsheet content is not stored on Grasp servers unless you explicitly upload a media plan through the extension.
• All communications between the extension, the spreadsheet application and the Grasp backend are encrypted with HTTPS (TLS).
• Access to this data is restricted to authorised personnel, with authentication and logging.
• Spreadsheet data, including Google user data, is protected with industry-standard security measures.

Children's data

Our websites and services are intended for professional use and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact dpo@grasp.gg and we will delete it.

Questions, concerns, or complaints

If you have any question or concern about this Privacy Statement or the way we handle your personal data, please contact our Data Protection Officer:

Data Protection Officer, Grasp SAS, 8 rue Balzac, 37000 Tours, France
Email: dpo@grasp.gg

You also have the right to lodge a complaint with the CNIL (www.cnil.fr).