Product
Infrastructure modules · platform → engine → intelligence
T-Platform Complete Platform
Retail Media Platform
Launch, operate, and scale your retail media business
T-Engine Core Engine
Intelligent Ad Engine
Auctions, pacing, quality score, attribution, and optimization
T-Brain AI Intelligence Layer
Large Marketplace Model
Low-latency AI for personalization, ranking, relevance, and commerce decisioning
T-Zero Lightweight API
Ad Server API
Simple ad serving for sponsored listings and display ads
More modules
ML Optimization Layer
Toptimize·Improve yield, pacing, ROAS, and relevance
Retail Media Analytics
Data Genie·Reporting, benchmarking, and data warehouse
AI Ad Ops Agent
Tomi·Launch and manage campaigns conversationally
Retail Media DSP
Toppie DSP·Demand-side platform for retail media buying
Offsite Retail Media
Offsite Ads·Extend campaigns beyond owned inventory
In-Store Retail Media
In-Store Journey·Connect screens and shopper signals
Solutions
Use Cases
Launch Scale Optimize Expand
Ad Formats
Sponsored Listings Sponsored Brands Display & Banner Ads Native Placements Video Ads Offsite Advertising
Industries
Marketplaces Retailers Delivery Apps Travel Platforms Financial Platforms Classifieds & Networks
About
Developers
Developer Portal
API Status
Resources
en
English
Português
Spanish
Log in
See a Demo
en
English
Português
Spanish

Topsort Legal

Privacy Policy
Fair Use Policy
Saas Master Service Agreement
Data Management Policy

Privacy Policy

Policy OwnerFrancisco Larrain
Effective DateNovember 1st, 2021
Last UpdatedMay 18th, 2026

Purpose

To ensure that personal information is collected, protected, used, disclosed and retained in accordance with applicable privacy laws and regulations, and to provide transparency to individuals about how Topsort handles their personal information in connection with our advertising technology services for marketplaces.

Scope

This Privacy Policy applies to all personal information processed by Topsort Inc. (doing business as Topsort) (“Topsort”, “we”, “us”) in connection with our advertising technology platform for marketplaces, websites, applications, and business operations.

Important Note for Marketplace Customers: As our services are provided to marketplaces who act as data controllers for their end users, our marketplace customers are responsible for obtaining appropriate consents and providing privacy notices to their users. This Privacy Policy primarily covers our direct relationships and does not replace the privacy obligations of our marketplace customers toward their end users.

Policy

Overview

At Topsort, we take the protection of personal information seriously. Personal information means information that identifies you as an individual or from which you can be reasonably identified.

This Privacy Policy applies to Topsort Inc. and provides information about the personal information we collect and handle about our customers, platform users, website visitors, employees, and business partners.

Topsort has a longstanding commitment to privacy and data security in our advertising technology services. We use pseudonymised information to serve interest-based advertisements while protecting individual privacy and complying with applicable privacy laws.

Topsort may update this privacy policy from time to time, with the most up-to-date policy always available at our website.

Why do we collect and handle your personal information?

We collect, hold, use and disclose your personal information so that we can provide our advertising technology services, improve and personalize our platform and communications, and operate our business effectively. This includes, but is not limited to:

Service Provision:

  • Managing your account and providing access to our SaaS platform
  • Processing transactions and managing billing in accordance with our SaaS Master Service Agreement
  • Delivering advertising campaigns using pseudonymised information
  • Providing platform analytics and performance reporting
  • Offering customer support and technical assistance
  • Responding to inquiries and feedback

Business Operations:

  • Conducting risk assessments and security monitoring in accordance with our Information Security Management System
  • Preventing fraud and ensuring platform security
  • Complying with legal obligations under GDPR, ePrivacy Directive, Australian Privacy Act, Brazilian LGPD, and other applicable regulations
  • Managing relationships with vendors and business partners per our Third-Party Management Policy
  • Conducting internal audits and quality assurance

Communications and Marketing:

  • Communicating about our services and platform updates
  • Providing marketing materials and promotional information (with appropriate consent)
  • Conducting surveys and research to improve our services
  • Managing event participation and business development

Legal and Compliance:

  • Meeting regulatory requirements and responding to legal process
  • Protecting our rights and interests
  • Supporting business continuity and disaster recovery
  • Complying with export/import regulations applicable to our software

Where you provide us with personal information about someone else, you must have their consent to provide their personal information to us and advise them of this Privacy Policy.

Types of personal information collected

The types of personal information we collect are classified according to our Data Management Policy into Confidential, Restricted, and Public categories:

Confidential Data (Highest Sensitivity):

  • Customer Data and Personally Identifiable Information (PII)
  • Company financial and banking data
  • Salary, compensation and payroll information
  • Strategic plans and business information
  • Authentication credentials and access keys
  • Technical vulnerability reports and incident data
  • Source code and proprietary algorithms

Customer and Platform Data:

  • Identity and contact details: name, business name, email address, phone number, business address
  • Account information: login credentials, user preferences, platform settings
  • Financial information: billing details, payment processing data, transaction history
  • Platform usage data: interactions, feature usage, campaign performance metrics (using pseudonymised identifiers where possible)

Technical and Analytics Data:

  • Technical information: IP addresses, browser information, device identifiers (using opaque identifiers where possible)
  • Log data: access logs, error logs, security event logs
  • Location information: general geographic location for service delivery
  • Aggregated and anonymized data for service improvement and statistical analysis

Employee and Business Data:

  • HR information: employment records, performance evaluations, training records
  • Professional information: job titles, company information, industry sector
  • Access credentials: system permissions, security clearances
  • Background check information as required by our Human Resource Security Policy

Communications and Marketing Data:

  • Support interactions: customer service tickets, email communications, chat logs
  • Marketing preferences: communication preferences, engagement metrics
  • Survey responses and research participation data

How do we collect personal information

We collect your personal information when you interact or transact with us. This includes, but is not limited to, when you:

  • Register for and use our advertising technology platform
  • Create an account or subscribe to our SaaS services
  • Contact us for customer support or sales inquiries
  • Participate in surveys, research, or marketing activities
  • Visit our websites or use our applications
  • Attend events or engage with us on social media
  • Enter into contracts or business relationships with us
  • Apply for employment with Topsort

We may also collect personal information from third parties including:

Business and Public Sources:

  • Public sources and business directories
  • Professional networking platforms
  • Industry events and trade publications
  • Referral partners and business associates

Service Providers:

  • Cloud infrastructure providers (AWS and other platforms)
  • Customer support platforms and communication tools
  • Business intelligence and analytics platforms
  • Security monitoring and assessment service providers
  • Payment processing and financial service providers

Legal and Regulatory Sources:

  • Regulatory bodies and government agencies as required by law
  • Credit reporting agencies for financial services
  • Background check providers for employment screening

How do we protect the personal information we hold

We hold personal information electronically, at our facilities and with trusted service providers. We implement comprehensive administrative, technical, and organizational security measures in accordance with our Information Security Management System (ISO 27001), including:

Technical Safeguards:

  • Encryption of data in transit and at rest for all Confidential data
  • Multi-factor authentication and role-based access controls
  • Network firewalls and intrusion detection systems
  • Regular security assessments and vulnerability testing
  • Secure development practices and code review
  • Pseudonymization and anonymization techniques for advertising services

Administrative Safeguards:

  • Information security policies and procedures
  • Employee security training and background checks
  • Incident response and breach notification procedures
  • Regular security audits and compliance reviews
  • Data classification and handling requirements per our Data Management Policy

Organizational Safeguards:

  • Need-to-know access principles and documented approval processes
  • Vendor security assessments per our Third-Party Management Policy
  • Business continuity and disaster recovery planning
  • Mobile device security requirements including encryption and screen lock after 15 minutes
  • Prohibition of storing Confidential data on personal devices or removable media

Device and Data Security:

  • Mobile devices with Confidential data must be encrypted and password-protected
  • Backups are encrypted for all Confidential information
  • Secure disposal procedures including data wiping or physical destruction
  • Certificate retention for professional destruction services

Our security controls are continually reviewed and updated to protect your personal information appropriately.

Sharing of personal information

We may share personal information within the Topsort organization and with trusted third parties to provide our services and conduct business operations, subject to our data classification requirements:

Technology and Infrastructure:

  • Cloud hosting and data processing providers
  • Application development and technical support services
  • Security monitoring and threat detection services
  • Backup and disaster recovery service providers

Business Operations:

  • Customer support and communication platforms
  • Payment processing and financial services
  • Marketing and business development platforms
  • Professional services (legal, accounting, consulting)

Regulatory and Legal:

  • With your representatives and authorized parties
  • With regulatory authorities and law enforcement as required by law
  • In connection with business transfers or corporate transactions
  • To protect our rights, property, or safety, or that of others

Data Sharing Restrictions:

  • Transfer of Confidential data requires explicit written permission from management or data owner
  • All sharing must comply with legal contracts or arrangements
  • Third-party vendors must meet our security requirements for data disposal and processing
  • Restricted data sharing requires management approval and need-to-know basis

We use systems and service providers located in various countries, and we ensure appropriate safeguards are in place for international data transfers.

International Data Transfers

Cross-Border Processing: We may transfer personal information internationally for processing by our service providers, cloud infrastructure, and business partners.

Transfer Safeguards: For transfers subject to GDPR, Australian Privacy Act, and Brazilian LGPD requirements:

  • We use Standard Contractual Clauses (SCCs) and adequacy decisions where applicable
  • We ensure overseas recipients provide substantially similar data protections
  • We implement additional safeguards including encryption, access controls, and contractual protections
  • Cross-border data transfer protections comply with applicable international requirements

Brazilian LGPD Requirements:

  • For transfers involving Brazilian personal data, we ensure compliance with LGPD international transfer provisions
  • We implement adequate safeguards through contractual clauses or adequacy decisions recognized by ANPD (Brazilian Data Protection Authority)
  • Cross-border processing of Brazilian data is limited to countries or organizations providing adequate protection levels

Data Retention

Retention Principles: We retain personal information only as long as necessary for the purposes for which it was collected, to meet legal and regulatory requirements, and for legitimate business needs.

Specific Retention Periods: As documented in our Data Management Policy and Data Retention Matrix:

  • Customer platform data: Customer accounts and data deleted within 30 business days of contract termination
  • Support communications: Retained for service improvement purposes
  • Employee records: As required by employment law and business needs
  • Security and audit logs: Varying periods based on type and regulatory requirements
  • Financial records: As required by applicable accounting standards and tax laws

Legal Hold Exceptions: Data subject to legal proceedings is retained as required by legal counsel and reviewed annually for continuing requirements and scope.

Secure Disposal: When retention periods expire, we securely delete or anonymize personal information. Data classified as Restricted or Confidential is securely deleted, and hard drives/devices are securely wiped or physically destroyed before disposal.

Your Privacy Rights

Rights Under GDPR (EU Residents):

  • Access: Request copies of your personal information
  • Rectification: Correct inaccurate or incomplete information
  • Erasure: Request deletion of your personal information (subject to legal retention requirements)
  • Restriction: Limit processing of your information
  • Portability: Receive your data in a portable format
  • Objection: Object to processing based on legitimate interests
  • Automated Decision-Making: Object to solely automated processing that significantly affects you

Rights Under Australian Privacy Act:

  • Access: Request access to your personal information we hold
  • Correction: Request correction of inaccurate information
  • Complaints: Lodge complaints with us or the Office of the Australian Information Commissioner (OAIC)

Rights Under Brazilian LGPD (Brazilian Residents):

  • Confirmation and Access: Confirm whether your personal data is being processed and access your data
  • Correction: Correct incomplete, inaccurate, or outdated personal information
  • Anonymization/Deletion: Request anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data
  • Portability: Request transfer of your personal data to another service provider
  • Information about Sharing: Receive information about how your data has been shared with third parties
  • Consent Withdrawal: Withdraw consent for processing where consent is the legal basis
  • Review of Automated Decisions: Request review of decisions made solely through automated processing

Rights Under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) (California Residents):

  • Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
  • Erasure: You may request that we delete personal information we have collected from you, subject to certain exceptions (e.g., where retention is required to complete a transaction, detect security incidents, or comply with legal obligations).
  • Correction: You may request that we correct inaccurate personal information we maintain about you.
  • Opt Out of Sale or Sharing: We do not sell your personal information for monetary consideration. To the extent we share personal information for cross-context behavioral advertising, you may opt out by contacting us.
  • Limit Use of Sensitive Personal Information: You may request that we limit our use and disclosure of sensitive personal information to purposes permitted by the CPRA.
  • Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Rights Under Other Jurisdictions: We comply with applicable privacy rights under other relevant privacy laws in jurisdictions where we operate.

Exercising Your Rights: To exercise your privacy rights:

  • Contact us using the contact information in the “Contact Information and Complaints” section
  • Provide sufficient information to verify your identity
  • Specify the right you wish to exercise and relevant details
  • We will respond within applicable timeframes (typically 30 days)

We may be unable to fulfill certain requests where they conflict with legal retention requirements or legitimate business interests.

Marketing Communications, Digital Technologies, and Cookie Consent

Marketing Practices: We may send marketing communications about our platform, services, industry insights, and business opportunities. You can opt out of marketing communications through:

  • Unsubscribe links in emails
  • Contacting us directly using the contact information in the “Contact Information and Complaints” section
  • Managing your account preferences in our platform

Digital Technologies and Cookie Consent: We use cookies and similar technologies across our website (www.topsort.com) and our application platform (app.topsort.com). On our public website, we use cookies for necessary functions (such as privacy preference management and form submissions), analytics to understand how visitors engage with the site, advertising to personalize content and measure ad performance, and functionality features to enhance your experience. For analytics, advertising, and functionality cookies, you may manage your preferences via the cookie consent banner on our public website.

On our application platform, cookies are used to manage authenticated user sessions, maintain your workspace settings, and collect product analytics. Necessary cookies are always active.

Automated Decision-Making and Pseudonymisation

Automated Processing: We may use automated systems for:

  • Fraud detection and security monitoring
  • Advertising optimization using pseudonymised information
  • Platform optimization and performance improvement
  • Customer support routing and prioritization
  • Business analytics on anonymized datasets

Pseudonymisation and Privacy Protection:

  • Our advertising services use pseudonymised information to serve interest-based advertisements
  • We employ data aggregation methods that protect individual privacy
  • Statistical analysis is performed on anonymized datasets
  • We do not keep data longer than required for legitimate business purposes

Transparency and Rights: When automated decision-making significantly affects you, we provide:

  • Information about the logic involved
  • The right to request human review
  • The ability to challenge decisions and request explanations
  • Appropriate safeguards and oversight measures

Children’s Privacy

Our advertising technology services are not directed to children under 16 years of age (or under 13 in Brazil). We do not knowingly collect personal information from children without appropriate parental consent.

Brazilian LGPD Requirements: For Brazilian children’s data, our customer must obtain “specific and highlighted consent” from parents or legal guardians before processing any personal information of individuals under 18 years of age.

Marketplace Customer Responsibilities: Our marketplace customers are responsible for ensuring they have appropriate consents and age verification measures for their end users, including compliance with children’s privacy requirements in their respective jurisdictions.

If you believe we have collected information about a child, please contact us immediately using the contact information in the “Contact Information and Complaints” section.

Third-Party Services and Links

Our platform may integrate with or link to third-party services. We are not responsible for the privacy practices of these external services. We encourage you to review their privacy policies.

When working with third-party service providers, we ensure they meet our security requirements for data processing and disposal in accordance with our Third-Party Management Policy.

Data Controller vs. Processor Activities

When We Act as Data Controller:

  • Our own customer and business data
  • Employee information and HR data
  • Marketing and business development activities
  • Website visitor information
  • Internal business operations and analytics

When We Act as Data Processor:

  • Customer advertising campaign data processed according to customer instructions
  • Platform user behavior data processed on behalf of customers using pseudonymised information
  • Analytics and reporting data generated for customers
  • Technical support data processed under customer direction

Marketplace Customer Responsibilities as Data Controllers: When we act as a processor for marketplace customers, they are responsible for:

  • Providing clear and lawful processing instructions for their users’ data
  • Ensuring legal basis for processing exists under applicable privacy laws
  • Obtaining appropriate consents from their end users for advertising and analytics processing
  • Handling individual rights requests from their users (access, deletion, correction, etc.)
  • Maintaining appropriate data processing agreements with us
  • Providing privacy notices to their end users that adequately describe our processing activities
  • Ensuring compliance with children’s privacy requirements for their platforms
  • Managing cross-border data transfer requirements for their user base

Breach Notification

In the event of a personal data breach that poses a risk to individuals:

  • We will assess the risk and take immediate containment measures
  • We will notify supervisory authorities within 72 hours where required by law
  • We will inform affected individuals without undue delay if high risk exists
  • For customer data processed as a processor, we will notify customers promptly to assist with their breach response obligations

Brazilian LGPD Requirements:

  • We will notify the Brazilian Data Protection Authority (ANPD) within 3 working days of becoming aware of any breach affecting Brazilian personal data
  • We will inform affected Brazilian individuals in accordance with ANPD guidelines when the breach poses significant risks
  • We will document the breach and response measures taken

Fair Use and Service Terms

Use of our services is subject to our Fair Use Policy, which prohibits:

  • Legal violations and harmful content distribution
  • Unauthorized access attempts and security interference
  • Spam, malware, and network attacks
  • Unauthorized resale or automated abuse

Violations may result in immediate service suspension, termination, content removal, or legal action.

Contact Information and Complaints

Privacy Inquiries: For questions about this Privacy Policy or to exercise your privacy rights:

Email: dpo@topsort.com
Address: 2459 Greer Road, Palo Alto, California 94303
Phone: +1 (650) 530-0012

Complaint Process: If you have concerns about our handling of your personal information:

  • Contact us using the contact information in the “Contact Information and Complaints” section
  • We will acknowledge your complaint and investigate promptly
  • We will respond within 30 days with our findings and any corrective actions
  • If you are not satisfied, you may contact the relevant supervisory authority

Supervisory Authorities:

  • Australia: Office of the Australian Information Commissioner (OAIC) - www.oaic.gov.au, 1300 363 992
  • European Union: Your local data protection authority
  • United States: Federal Trade Commission or relevant state authorities
  • Brazil: Brazilian Data Protection Authority (ANPD) - www.gov.br/anpd

Data Protection Officer

In accordance with applicable privacy laws including GDPR and Brazilian LGPD, we have appointed a Data Protection Officer (DPO) who serves as:

  • Primary contact for privacy-related inquiries and rights requests
  • Monitor for compliance with data protection laws and regulations
  • Point of contact for supervisory authorities on data protection matters

DPO Contact Information:

  • Email: dpo@topsort.com
  • Address: 2459 Greer Road, Palo Alto, California 94303

Our DPO is available to assist with privacy questions, rights requests, and compliance matters for all jurisdictions where we operate.

Policy Updates

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or business operations. Material changes will be communicated through:

  • Email notification to registered users
  • Prominent notice on our website
  • Direct communication to affected customers
  • Updated effective date and last updated information

Continued use of our services after policy changes constitutes acceptance of the updated terms, unless stronger consent requirements apply under applicable law.

Policy Compliance

Topsort will measure and verify compliance with this policy through various methods, including but not limited to business tool reports, internal and external audits, and regular policy reviews in accordance with our Information Security Management System.

Exceptions

Requests for an exception to this policy must be submitted to the Chief Technology Officer or the Chief Executive Officer for approval.

Violations & Enforcement

Any known violations of this policy should be reported to legal@topsort.com or to the Chief Executive Officer. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.

Version History:

VersionDateDescriptionAuthorApproved by
1.0Nov 1st, 2021First versionEmber ThomasFrancisco Larrain
2.0Sep 30th, 2025First version integrating web policies and compliance requirementsFrancisco CabezasFrancisco Larrain
2.1May 18th, 2026Applied PDF authoritative version: contact details, dates, exceptions, glossaryFelipe FullerFrancisco Cabezas
2.2May 19th, 2026Add CCPA details.Feñlipe FullerFrancisco Cabezas

ISO 27001 Coverage: ISO 27001 4.1; A.18.1; A.13.2; A.18.1.4

Related Policies:

  • Data Management Policy
  • Information Security Management System (ISMS) Policy
  • Third-Party Management Policy
  • Human Resource Security Policy
  • Fair Use Policy
  • SaaS Master Service Agreement

Glossary

This glossary provides definitions for key terms used in this Privacy Policy to help users understand their rights and our data processing practices.

A

Adequacy Decision
A formal determination by a regulatory authority (such as the European Commission or ANPD) that a third country provides an adequate level of data protection, allowing personal data to be transferred without additional safeguards.

Aggregated Data
Data that has been combined from multiple sources and presented in summary form, typically preventing the identification of individual persons.

Anonymization
The process of removing or altering personal information so that individuals cannot be identified, either directly or indirectly.

ANPD (Autoridade Nacional de Proteção de Dados)
Brazil’s National Data Protection Authority responsible for enforcing the LGPD and handling privacy complaints from Brazilian residents.

Australian Privacy Principles (APPs)
Thirteen principles under the Australian Privacy Act 1988 that govern how personal information should be collected, used, disclosed, and managed.

Automated Decision-Making
Processing of personal data using automated means (without human intervention) that produces legal effects or similarly significant effects for individuals.

B

Breach Notification
The legal requirement to notify supervisory authorities and affected individuals when a personal data breach occurs that poses risks to individual rights and freedoms.

Business Transfer
Corporate transactions such as mergers, acquisitions, or asset sales that may involve the transfer of personal information.

C

CCPA (California Consumer Privacy Act)
A California state law that provides privacy rights and consumer protection for California residents.

Confidential Data
Topsort’s highest classification level for highly sensitive information requiring the strictest protection measures.

Consent
A freely given, specific, informed, and unambiguous agreement by an individual to the processing of their personal data.

Controller (Data Controller)
The entity that determines the purposes and means of processing personal data. Marketplace customers typically act as controllers for their end users.

Cross-Border Data Transfer
The transmission of personal data from one country to another, subject to specific legal safeguards and requirements.

D

Data Classification
Topsort’s system for categorizing information based on sensitivity: Confidential (highest), Restricted (internal), and Public (freely distributable).

Data Minimization
The principle that personal data collection should be adequate, relevant, and limited to what is necessary for the specified purposes.

Data Protection Impact Assessment (DPIA)
A systematic analysis of data processing activities to identify and mitigate privacy risks.

Data Retention Matrix
Topsort’s documented schedule specifying how long different types of data are kept and when they should be securely disposed of.

Data Processor
An entity that processes personal data on behalf of a data controller. Topsort typically acts as a processor for marketplace customers.

Data Protection Officer (DPO)
A designated person responsible for monitoring compliance with data protection laws and serving as a point of contact for privacy matters.

Data Subject
An individual whose personal data is being processed, including marketplace end users and Topsort’s direct customers.

E

Encryption
The process of encoding data so that only authorized parties can access and read it, protecting information during storage and transmission.

ePrivacy Directive
European Union legislation governing privacy in electronic communications, including requirements for cookies and marketing communications.

F

Fair Use Policy
Topsort’s policy defining acceptable use of services and prohibited activities to ensure platform security and compliance.

G

GDPR (General Data Protection Regulation)
European Union regulation that governs data protection and privacy for individuals within the EU and European Economic Area.

I

Information Security Management System (ISMS)
Topsort’s systematic approach to managing sensitive information based on ISO standards.

International Data Transfer
See Cross-Border Data Transfer.

ISO 27001
International standard for information security management systems that Topsort follows to protect personal and business information.

L

Legal Basis
The lawful justification for processing personal data under privacy laws (e.g., consent, contract performance, legitimate interests, legal obligation).

LGPD (Lei Geral de Proteção de Dados)
Brazil’s General Data Protection Law that governs the processing of personal data of individuals in Brazil, providing comprehensive privacy rights and obligations for organizations.

Legal Hold
The preservation of data beyond normal retention periods due to litigation, regulatory investigations, or other legal requirements.

Legitimate Interests
A legal basis for processing personal data where the processing is necessary for legitimate business purposes that don’t override individual privacy rights.

M

Marketplace Customer
A business that uses Topsort’s advertising technology platform and typically acts as a data controller for their end users’ personal data.

O

OAIC (Office of the Australian Information Commissioner)
Australia’s privacy regulator responsible for enforcing the Privacy Act and handling privacy complaints.

Opaque Identifiers
Technical identifiers that cannot be easily traced back to specific individuals, used to protect privacy in advertising technology.

P

Personal Data/Personal Information
Information that identifies or can reasonably be used to identify an individual person, including names, contact details, and online identifiers.

Pseudonymization
The processing of personal data so that it can no longer be attributed to a specific person without additional information that is kept separately.

R

Rectification
The right of individuals to have inaccurate or incomplete personal data corrected or completed.

Retention Period
The length of time personal data is kept before being securely deleted or anonymized.

Right of Access
The right of individuals to obtain confirmation of whether their personal data is being processed and to receive information about that processing.

Right of Erasure
The right of individuals to request deletion of their personal data in certain circumstances (also known as the “right to be forgotten”).

Right of Portability
The right of individuals to receive their personal data in a structured, commonly used format and to transmit it to another organization.

Risk Assessment
The process of identifying, analyzing, and evaluating privacy and security risks associated with data processing activities.

Restricted Data
Topsort’s middle classification level for proprietary information requiring protection but allowing need-to-know access within the organization.

S

SaaS (Software as a Service)
Topsort’s cloud-based software delivery model where applications are provided over the internet on a subscription basis.

Standard Contractual Clauses (SCCs)
Legal mechanisms approved by regulatory authorities to provide appropriate safeguards for international data transfers.

Supervisory Authority
Government bodies responsible for monitoring and enforcing compliance with data protection laws (e.g., OAIC, ANPD, EU data protection authorities).

T

Third-Party Management Policy
Topsort’s policy governing relationships with external service providers, including security and privacy requirements.

Transparency
The principle that individuals should be clearly informed about how their personal data is collected, used, and shared.

U

User Data
Information about individuals who interact with Topsort’s platform, processed using privacy-preserving techniques like pseudonymization.

V

Vulnerability Assessment
Regular evaluation of security weaknesses in systems and processes that could affect the protection of personal data.

Legal Compliance Note: This Privacy Policy is designed to comply with GDPR, Australian Privacy Act 2024, Brazilian LGPD, CCPA, and other applicable privacy laws while incorporating Topsort’s existing data classification system, security requirements, and business operations for marketplace advertising technology. It should be reviewed by qualified legal counsel before implementation to ensure full compliance with specific business requirements and jurisdictional obligations.

Note: This glossary is designed to help users understand privacy-related terms. For legal advice or specific questions about data protection, please consult qualified legal counsel or contact our Data Protection Officer.

This Acceptable Use Policy (“Policy”) sets forth required actions, as well as prohibited activities and content, that apply to your use of products or services supplied by Topsort Inc. (“we”, “us”), including its affiliates and third-party suppliers, (collectively, “software and services”).

If you violate the Policy or authorize or help others to do so, we may immediately suspend or terminate your use of the software and services. We reserve the right to remove any content or restrict or terminate the use of the software and services without prior notice for activities or content that, in Our reasonable judgment, violate this policy or any agreement that grants you the right to use the services.

We may change this Policy from time to time by posting the updated policy on our website (https://www.topsort.com and all related sites operated by or for us) and informing our customers in email updates. You are deemed to accept a change to this Policy upon your continued use of the software and services following any such change. If you do not accept this Policy, you may not access or use the software and services.

You may not use the software and services or permit others to use the software and services to:

  • violate any applicable law or regulation, including, without limitation, laws governing antitrust, encryption, export/import control, intellectual property, obscenity, privacy, securities, gambling, and telecommunications;
  • post, send, receive, use, encourage, promote, facilitate or instruct others to use defamatory, harassing, libelous, obscene, abusive, deceptive, false, misleading, fraudulent, pornographic or threatening materials, or private information without the consent of the individual(s) involved;
  • post, send or receive any content, including, without limitation, text, graphics, images, computer programs, links and “meta tags,” that violates any copyright, patent, trademark, trade secret, or other intellectual property right of a third party;
  • obtain or attempt to obtain unauthorized access to any server, system, network or account;
  • interfere or attempt to interfere with the provision of software and services to any user, host, or network by use of any program, script or otherwise;
  • interfere or attempt to interfere with security-related features of the software and services, or features that limit or restrict (a) use of the software and services or (b) use or copying of any content accessible through use of the software and services;
  • avoid any use limitations placed on the software and services, such as access and storage restrictions;
  • monitor data or traffic on a system without permission;
  • send unsolicited bulk and/or commercial messages over the Internet (known as “spamming”)
  • send, receive, or use malware, spyware, adware, key loggers, viruses, worms, harmful code and/or Trojan horses, or Internet Relay Chat “bots”;
  • engage in “hacking”, “cracking”, mail bombing, port scanning, denial of service, or other malicious or destructive activities, whether lawful or unlawful, that Topsort determines to be harmful to its Subscribers, operations, reputation, goodwill, or customer relations;
  • resell the software and services, in whole or in part, to any third party without Our express prior written consent;
  • violate the terms of any applicable software license or service agreements or the Terms of Use posted on this Web site:
  • to use automation software to interact with our software and services without our express prior written permission.

When We become aware of harmful activities, We may take action to stop the harmful activity, which may include, but not limited to, removing information, shutting down services in whole or in part, blocking offending transmissions, denying access to the Internet.

These SaaS Terms of Service (“Agreement”) are a legal agreement between the entity subscribing to the Service (as defined below) (“Customer”) and Topsort Inc. (“Company”) and govern the use of the Services. Unless otherwise set out in the Order (as defined below), this Agreement commences as of the date that the Services are first subscribed to by Customer (the “Effective Date”). 

Customer’s use of the Services is also subject to the Company’s policies and procedures set out on https://www.topsort.com/legals or otherwise made available to Customer through the Services (the “Policies”).

By accessing, accepting or using the Services, Customer agrees to be legally bound by this Agreement and the Policies. If Customer does not agree to the terms of this Agreement and the Policies, then Customer may not access or use the Services.

If Customer is using the Services on behalf of a company or other entity then “Customer” includes Customer and that entity and Customer represents and warrants that (a) they are an authorized representative of the entity with the authority to bind the entity to this Agreement and (b) Customer agrees to this Agreement on the entity’s behalf.

1.  SAAS Services and Support
  1. Services. Subject to all the terms, conditions and restrictions of this Agreement, including full payment of all applicable fees, Company will use commercially reasonable efforts to provide Customer with the Company software-as-a-service platform and related services subscribed to by Customer (the “Services”) as set out on the order page (the “Order”) during the term of the Agreement. As part of the registration process, Customer will identify an administrative user name and password for Customer’s company account.  Company reserves the right to refuse registration of, or cancel passwords it deems inappropriate.
  2. Support. Subject to the terms hereof, as part of the Services, Company will use commercially reasonable efforts to provide Customer with technical support services in accordance with Company’s standard practice, as updated by Company from time to time.

‍

2.  Restrictions and Responsibilities
  1. Customer will not, nor attempt to, nor permit any third party to: (a) reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, know-how or algorithms relevant to the Services or any software, documentation or data related to, or used to provide, the Services (“Software”); (b) modify, translate, or create derivative works based on the Services or Software (except to the extent expressly permitted by Company or authorized in writing within the Services); (c) use the Services or Software for time sharing or service bureau purposes or otherwise for the benefit of a third party; or (d) remove any proprietary notices or labels from the Services. Further, Customer may not remove or export from the United States or allow the export or re-export of the Services, Software or anything related thereto, or any direct product thereof in violation of any restrictions, laws or regulations of the United States Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, or any other United States or foreign agency or authority. Without limiting the foregoing, Customer represents and warrants it will comply with all applicable laws and regulations of the United States and other applicable jurisdictions in using the Services, including without limitation, import, re-import, sanctions, anti-boycott, export, re-export, data localization, and data privacy and security laws. Customer shall be solely responsible for complying with any home country restrictions on receipt, use or downloading of the Services.  As defined in FAR section 2.101, the Software and documentation are “commercial items” and according to DFAR section 252.2277014(a)(1) and (5) are deemed to be “commercial computer software” and “commercial computer software documentation.”  Consistent with DFAR section 227.7202 and FAR section 12.212, any use modification, reproduction, release, performance, display, or disclosure of such commercial software or commercial software documentation by the U.S. Government will be governed solely by the terms of this Agreement and will be prohibited except to the extent expressly permitted by the terms of this Agreement.
  2. Additional Restrictions. Customer will not, nor attempt to, nor permit any third party to: (a) use the Services or Software to deliver spyware, adware, spam, or other deceptive or fraudulent ads and/or malicious code; (b) violate any local, state, national or international law or regulation in connection with use of the Services or Software, or otherwise use the Services in any way that is in furtherance of criminal, fraudulent, or other unlawful activity; (c) interfere with or disrupt the Services or Software or servers or networks connected to the Services; (d) interfere with or attempt to interfere with any other person’s use of the Services or Software; (e) gain access to or attempt to gain access to any account, computers or networks related to the Services or Software without Company’s express written authorization; (f) forge headers or otherwise manipulate identifiers in order to disguise the origin of any content or communication transmitted through the Services or Software; or (g) use traffic sources generated by toolbars, plugins, piracy sites, and/or any similar sites or applications. Company reserves the right to delete an account or suspend Customer’s access to the Services if Customer violates Section 2.1 or this Section 2.2.
  3. Customer represents, covenants, and warrants to and with Company that Customer will use the Services only in compliance with Company’s Policies and all applicable laws and regulations. Customer will notify Company immediately upon becoming aware of any unauthorized use of the Services or Customer’s username or password or account or any other known or suspected breach of security. As between Customer and Company, Customer is fully responsible and liable for compliance with the provisions of this Agreement by its Affiliates and each of their respective employees, agents, subcontractors for any and all activities that occur under Customer’s account for the Services. Although Company has no obligation to monitor Customer’s use of the Services, Company may do so and may prohibit any use of the Services it believes may be (or alleged to be) in violation of the foregoing.
  4. Company will not be responsible or liable for any failure to provide the Services or other damages, losses or claims resulting from or attributable to (a) systems of the Customer or its Affiliates, (b) the Equipment (as defined below) and any other network, telecommunications or other service or equipment used to provide or access the Services, (c) Customer’s or a third party’s (except for a third party subcontractor engaged by Company to provide the Services) products, services, negligent acts or omissions, (d) Customer’s breach of this Agreement, (e) Customer’s failure to provide reasonably requested information, assistance and approvals; or (f) scheduled or emergency maintenance.
  5. Customer shall be responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access or otherwise use the Services, including, without limitation, modems, hardware, servers, software, operating systems, networking, web servers and the like (collectively, “Equipment”).  Customer shall also be responsible for maintaining the security of the Equipment, Customer account, passwords (including but not limited to administrative and user passwords) and files, and for all uses of the Customer account or the Equipment with or without Customer’s knowledge or consent.
  6. Company, in its sole discretion, may from time to time modify the Services or add, remove, update, upgrade, or otherwise change  features or functionality of the Services in its discretion. Company will use reasonable efforts to notify Customer of such changes to the Services by posting information about them on the Company website or within the Services. If the sunsetting of major features or functionality materially adversely affects Customer’s use of the Services, then Customer may terminate this Agreement at any time up until 30 days following the date that the feature or functionality has been sunset by providing written notice to Company (“Sunset Notice Period”). Customer’s continued use of the Services after the Sunset Notice Period constitutes Customer’s acceptance of these changes.
  7. The Services may be used and accessed only by Company employees, agents and contractors that Company has authorized to use the Services (“Authorized Users”) who have a need to access the Services. In no event may third parties other than Affiliated Entities use and access the Services. Neither Customer nor any Affiliated Entities or Authorized Users may use the Services or any of the Software to compete with the Company. Customer shall be fully responsible and liable for use of the Services by Authorized Users and their compliance with the terms of the Agreement.
  8. ‍Customer agrees that all user information provided to Company by Customer and/or the Authorized Users, whether for purposes of obtaining a username and password, other access credentials or otherwise, will be accurate and complete in all respects.
3.  Licenses to Customer
  1. Grant of License. Company hereby grants to Customer a revocable (in accordance with this Agreement), non-exclusive, non-sublicensable, non-transferable, limited license to use the Services during the Term, and in accordance with the restrictions set forth herein, in the Policies and the applicable Order, for Customer’s internal business purposes only. With respect to any Software that is distributed or provided to Customer for use on Customer premises or devices, Company hereby grants Customer a non-exclusive, non-transferable, non-sublicensable license to use such Software during the Term only in connection with Customer’s authorized use of the Services.
4.  Intellectual Property
  1. Company owns all right, title and interest (including intellectual property rights) in and to (a) the Services, the Software, the Company websites used to provide the Services (the “Site”), and any other documents, software, materials, content, or other intellectual property provided by or on behalf of Company in connection with the Services (other than Customer Data), including but not limited to the look and feel, structure, organization, design, algorithms, templates, data models, logic flow, text, graphics, logos, and screen displays associated therewith; and (b) all modifications, enhancements, updates and derivative works thereof and thereto.  If Customer acquires any right, title or interest in or to any of the foregoing other than the limited licenses expressly granted in this Agreement, Customer hereby assigns all such right, title and interest to Company. Except for the limited rights and licenses expressly granted hereunder, no other license is granted to Customer, no other use is permitted and Company shall retain all right, title and interest in and to the foregoing.
  2. Customer Data. Customer shall retain ownership of all content and data provided to Company by Customer or its Authorized Users in connection with Customer’s use of the Site, the Software and the Services (“Customer Data”). Customer hereby grants Company a non-exclusive, sublicensable, transferable license during the Term to copy, use, distribute and disclose the Customer Data solely as necessary to provide the Services.
  3. Data Use. Company may derive and compile from Customer’s usage of the Services certain aggregated and/or analytical information, so long as such aggregated or analytical information does not reveal any information about Customer or any individual. Such aggregated data and metadata may be used for Company’s own purposes without restriction, including, but not limited to, using such data in conjunction with data from other sources to improve Company’s products and services, create new products and marketing. 

    Company shall have the right collect and analyze data and other information relating to the provision, use and performance of various aspects of the Services and related systems and technologies (including, without limitation, information concerning Customer Data and data derived therefrom), and  Company will be free (during and after the term hereof) to (i) use such information and data to improve and enhance the Services and for other development, diagnostic and corrective purposes in connection with the Services and other Company offerings, and (ii) use, disclose and otherwise exploit such data solely in aggregate or other de-identified form for any lawful purpose. No rights or licenses are granted except as expressly set forth herein.
  1. License Grant. Customer hereby assigns to Company any suggestions, ideas, enhancement requests, feedback, or other information provided by Customer or any Authorized User relating to the Services, Site or Software, and Company may use and exploit the foregoing without restriction or renumeration to Customer.
5.  API Terms
  1. Use of API. Company provides an application programming interface (“API”) as part of the Services.
  2. API Limits. Company may from time to time set and update limits on Customer usage of the API, including without limitation limits on API requests and access to data (the “API Limits”). The API Limits will be described on the Site and/or in Company documentation provided through the Site or Services. Customer agrees to comply with all API Limits, and further agrees that Customer will not use the API in a manner that constitutes excessive or abusive usage, or otherwise is in breach of the terms of this Agreement, the Policies or the API Limits. Without limiting the foregoing, Customer agrees not to use the API in a manner that competes with any software or services provided by Company, or that provides API functionality to third parties. Customer will not circumvent or attempt to circumvent any API Limits.
  3. Usage Monitoring. Company reserves the right to monitor Customer API and Software and Services usage to verify compliance with the terms of the Agreement and to improve Company’s products and services. Customer agrees not to interfere with any such monitoring.
  4. Update of API. Company may update the API from time to time pursuant to Section 2.6..
  5. Maintenance Window. Company allocates time weekly on Sundays between 3:00 AM and 3:30 AM within the timezone of the given API server for maintenance. Interruptions during this time window are a possibility.
6.  Confidentiality
  1. Each party receiving Proprietary Information (the “Receiving Party”) understands that the party making available such Proprietary Information (the “Disclosing Party”) may disclose business, technical or financial information relating to the Disclosing Party’s business (hereinafter referred to as “Proprietary Information” of the Disclosing Party).  Proprietary Information of Company includes information regarding features, functionality and performance of the Services and Software.   The Receiving Party agrees: (i) to take reasonable precautions to protect such Proprietary Information, and (ii) not to use (except in performance or receipt of the Services or as otherwise permitted herein) or divulge to any third person any such Proprietary Information.  The Disclosing Party agrees that the foregoing shall not apply with respect to any information (other than trade secrets) after five (5) years following the disclosure thereof or to any information that (a) is or becomes generally available to the public, (b) was in the Receiving Party’s possession or known by it prior to receipt from the Disclosing Party, (c) was rightfully disclosed to the Receiving Party without restriction by a third party, or (d) was independently developed without use of any Proprietary Information of the Disclosing Party. The Receiving Party may also disclose Proprietary Information of the Disclosing Party if required by law or regulation or by a court of competent jurisdiction, provided that the Receiving Party will provide notice of such disclosure requirement to the Disclosing Party (unless prohibited by law from doing so) and will use reasonable efforts, at the Disclosing Party’s cost, to limit the scope of such disclosure. Each party acknowledges and agrees that any violation of this Section may cause the Disclosing Party irreparable injury for which the Disclosing Party would have no adequate remedy at law, and that the Disclosing Party shall be entitled to seek preliminary and other injunctive relief against the Receiving Party for any such violation. Such injunctive relief shall be in addition to, and not in limitation of, all other remedies or rights that the disclosing party shall have at law or in equity.
  2. Upon termination or expiration of the Agreement, the Receiving Party will return to the Disclosing Party or destroy all Proprietary Information delivered or disclosed to the Receiving Party, together with all copies in existence thereof at any time made by the Receiving Party.
  3. Customer shall own all right, title and interest in and to the Customer Data, as well as any data that is based on or derived from the Customer Data and provided to Customer as part of the Services. Company shall own and retain all right, title and interest in and to (a) the Services and Software, all improvements, enhancements or modifications thereto, (b) any software, applications, inventions or other technology developed in connection with Implementation Services or support, and (c) all intellectual property rights related to any of the foregoing.
  4. Notwithstanding anything to the contrary, Company shall have the right collect and analyze data and other information relating to the provision, use and performance of various aspects of the Services and related systems and technologies (including, without limitation, information concerning Customer Data and data derived therefrom), and  Company will be free (during and after the term hereof) to (i) use such information and data to improve and enhance the Services and for other development, diagnostic and corrective purposes in connection with the Services and other Company offerings, and (ii) disclose such data solely in aggregate or other de-identified form in connection with its internal business. No rights or licenses are granted except as expressly set forth herein.
6.5  Publicity
  1. Company may use Customer’s name and logo solely to identify Customer as the Company’s customer (a) on the Company’s website; (b) on the Company’s social media channels (i.e. Facebook, Instagram, Twitter and LinkedIn, etc.), and (c) in the Company’s printed marketing materials, in each case, within a list of Company’s clients.
  2. For the avoidance of doubt, in using the Customer’s name and logo, the Company may not: (a) single out or highlight Customer in any way; or (b) otherwise state that Customer recommends, promotes or endorses the Company or its services.
  3. If the Company wishes to publish Customer’s testimonials or a case study based on the services it provides to the Customer, it shall only do so upon agreeing the proposed content of such testimonial and/or a case study with the Customer in writing in advance.
  4. The authorization granted in this clause 3.4 is: (i) subject to the Company’s abiding to all Customer’s branding guidelines at all times, as those may be amended or supplemented by Customer; (ii) revocable and limited to the duration of the Agreement. Once the Agreement is terminated, the Company shall cease any use of Customer’s name and logo, unless specifically agreed otherwise in writing.
7.  Payment of Fees
  1. Customer agrees to pay Company all fees and applicable charges associated with the Services as set forth in the Order (the “Fees”). Unless otherwise set forth in the Order, the following payment terms shall apply: (i) Base fees for the first year are due upon the Effective Date and payable annually; (ii) Subsequent fees will be invoiced, in arrears, within five (5) days after the end of each 30 day period during the Term. If credit card payments are specified on the Order, Customer authorizes its credit card to be charged by Company for the invoiced amount at the time of invoice. If Customer is not paying by credit card, then Customer agrees to pay the invoiced amount within thirty (30) days of receipt. Company reserves the right to change the Fees and to institute new Fees at the end of the Initial Service Term or the current Renewal Term, upon thirty (30) days prior notice to Customer (which may be sent by email). If Customer believes that Company has billed Customer incorrectly, Customer must contact Company no later than the due date for the corresponding invoice in order to receive an adjustment or credit. Inquiries should be directed to Company’s account manager responsible for Customer. Except as expressly set out in this Agreement, all payments under this Agreement are non-refundable and, unless otherwise agreed by Company, shall be made in United States dollars. Past-due payments will be subject to late payment charges of the lesser of: (a) one percent (1 %) per month, or (b) the maximum rate allowed by law.
  2. If a payment of any Fees becomes five (5) days or more overdue, Company reserves the right to suspend Customer’s access to the Services, without liability to Customer, until payment is made in full. If any payment becomes ten (10) days or more overdue, Company may terminate the Agreement upon notice to Customer.
  3. If Customer has procured the Services through a Partner Transaction, then different terms regarding invoicing, payment and taxes may apply as specified between Customer and the Partner. Customer acknowledges that: (a) Company may share information with the Partner related to Customer’s use of Company’s Services; (b) the termination provisions contained herein will also apply if Customer’s Partner fails to pay applicable fees; and (c) Partner is not authorized to make any changes to this Agreement or otherwise authorized to make any warranties, representations, promises or commitments on behalf of Company or in any way concerning the Services.
  4. The fees do not include Taxes and similar assessments. For purposes of this Agreement, “Taxes” shall mean any sales, excise, value-added (and other similar) taxes, duties and charges of any kind imposed by a governmental authority on amounts payable under this Agreement, other than taxes imposed on Company’s income. Customer shall be responsible for all Taxes associated with Services. Customer shall also be responsible for all the costs involved in the payment of the Fees to Company, whether they are costs involved in a bank transfer of the fees, costs associated with a payment processing company that handles the transfer of the fees, costs associated with payment of the fees through credit cards, or others costs of transferring payment of the Fees. If Customer is required by applicable law or regulations to deduct or withhold from any amounts payable to Company under this Agreement any Taxes or other amounts, the amounts payable to Company shall be increased as necessary so that after making all required deductions (including deductions applicable to additional amounts payable under this Section) Company receives an amount equal to the sum it would have received had no such deductions been made.
8.  Term and Termination
  1. Subject to earlier termination as provided below, this Agreement commences on the Effective Date and continues for the initial service term as specified in the Order (the “Initial Service Term”), and shall be automatically renewed for the periods specified in the Order (each, a “Renewal Term”, and collectively, the “Term”), unless written notice of non-renewal is requested by either party at least thirty (30) days prior to the end of the Initial Service Term or then-current Renewal Term.
  2. In addition to any other remedies it may have, either party may also terminate this Agreement immediately upon written notice, (a) if the other party materially breaches any provision of this Agreement and fails to cure such breach within 30 days (or 5 days in the case of non-payment) after receiving written notice of such breach from the non-breaching party, or (b) if the other party makes any assignment for the benefit of creditors, or a receiver, trustee in bankruptcy or similar officer is appointed to take charge of any or all of the other party’s property, or the other party seeks protection under any bankruptcy, receivership, trust deed, creditors arrangement, composition or comparable proceeding or such a proceeding is instituted against the other party and is not dismissed within 90 days, or the other party becomes insolvent or, without a successor, dissolves, liquidates or otherwise fails to operate in the ordinary course. Company may suspend or terminate Customer’s use of the Services at any time without prior notice: (a) in order to prevent damages to, or degradation of, Company’s network integrity or infrastructure; (b) if needed to comply with any law, regulation, court order, or other governmental request or order; (c) in order to otherwise protect Company from potential legal liability; (d) if Customer does not provide a valid payment method; (e) if the Customer violates the usage restrictions contained herein or in the Policies; (f) if the Customer is found to use abusive or harassing language toward any of Company’s employees; or (g) as otherwise provided in this Agreement.
  3. Upon termination or expiration of this Agreement: (a) Customer will pay the remaining Fees for the Services in full; and (b) Customer will, and will cause its Authorized Users to, immediately cease use of the Services and to uninstall and delete any local Software. Upon any expiration or termination of this Agreement, Company will make all Customer Data available to Customer for electronic retrieval for a period of thirty (30) days, but thereafter Company may, but is not obligated to, delete stored Customer Data.
  4. All sections of this Agreement which by their nature should survive expiration termination will survive expiration or termination, including, without limitation, accrued rights to payment, confidentiality obligations, warranty disclaimers, and limitations of liability.
  5. ‍
9.  Warranty and Disclaimer
  1. Customer and Company each represent and warrant to each other that they have full authority to enter into the Agreement and are not bound by any contractual or legal restrictions from fulfilling their obligations hereunder.
  2. Customer represents and warrants to Company as follows: (a) the Customer Data is owned by Customer or Customer has the full right to provide the Customer Data to Company for the purposes described herein; (b) the use of Customer Data by Company pursuant to this Agreement does not and will not infringe or misappropriate any copyright, trademark, trade secret or other intellectual property right; (c) the Customer Data does not violate any person’s right of privacy or publicity; (d) the Customer Data does not contain any unlawful, obscene, defamatory or libelous material; and (e) Company’s use and distribution of Customer Data in connection with the Services, and as otherwise permitted herein, will not breach any covenant or obligation of confidentiality that Customer has to any other person or entity. Customer is solely responsible for the content of the Customer Data, and acknowledges that Company has no responsibility or intent to review or monitor any Customer Data.
  3. Customer shall be solely responsible for its use of the Services, and Customer acknowledges and agrees that the Services are strictly a tool to be used in conjunction with good and reasonable business judgment by competent personnel.
  4. COMPANY DOES NOT WARRANT THAT THE SERVICES AND SOFTWARE WILL BE UNINTERRUPTED OR ERROR FREE; NOR DOES IT MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF THE SERVICES OR SOFTWARE.  EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, THE SERVICES AND SOFTWARE ARE PROVIDED “AS IS” AND COMPANY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
10.  Indemnity
  1. Customer Indemnification. Customer, at its own expense, shall indemnify, defend and hold Company harmless from and against all liability, damages, injuries, losses, costs and expenses (including attorneys’ fees) arising out of or relating to Customer’s use of the Services, including but not limited to liability, damages, injuries, losses, costs and expenses arising from any claims relating to: (a) Customer’s breach of any provisions of this Agreement, (b) Customer’s violation of applicable laws and regulations, (c) the Customer Data or its use by the Company as permitted hereunder; and (d) any activities that occur through Customer’s account for the Services. Company shall provide Customer with prompt written notice of any such claim.
  2. Company at its own expense, shall indemnify, defend and hold Customer harmless from and against all liability, damages, injuries, losses, costs and expenses (including attorneys’ fees) in each case to the extent any of the foregoing are incurred as a result of a claim, action or proceeding brought against Customer by a third party alleging that the Services (excluding, for the avoidance of doubt, the Customer Data), or Customer’s use of the Services in accordance with the Policies and this Agreement, infringe, misappropriate or otherwise violate the U.S. patent, copyright, trademark, trade secret or other intellectual property rights of such third party (each, an “Infringement Claim”). Customer must immediately notify Company of any Infringement Claim, allow Company to control the defense and settlement of the claim, and provide reasonable cooperation to Company (at Company’s expense) in the defense of the claim. Company will not enter into a settlement of any such claim in a manner that imposes any liability on Customer without Customer prior written consent (not to be unreasonably withheld). Company will not be responsible for any settlement it does not approve in writing.
  3. If Services are held by a court of competent jurisdiction to be, or are believed by Company to be, infringing, misappropriating or violating any intellectual property rights, Company may, at its option and expense (a) replace or modify the Services to be non-infringing provided that such modification or replacement contains substantially similar features and functionality, (b) obtain for Customer a license to continue using the Services as contemplated by this Agreement, or (c) if neither of the foregoing is commercially practicable, terminate this Agreement and require Customer and its Authorized Users to cease using the Services upon written notice and promptly refund to Customer, on a pro rata basis, the share of any Fees prepaid by Customer for the future portion of the Term that would have remained but for such termination.  Section 10.2 and this Section 10.3 states Company’s sole and exclusive obligation, and Customer’s sole and exclusive remedy, for any claim that the Services, or any use of the Services, infringe, misappropriate or violate any third party’s intellectual property rights.
  4. ‍The foregoing obligations in Sections 10.2 and 10.3 do not apply: (a) with respect to portions or components of the Services (i) not supplied by Company, (ii) made in whole or in part in accordance with Customer specifications, (iii) that are modified after delivery by Company, or (iv) that are combined with other products, processes or materials where the alleged infringement relates to such combination; (b) where Customer continues the allegedly infringing activity after being notified thereof or after being informed of modifications that would have avoided the alleged infringement; or (c) where the applicable claim arises from Customer’s use of the Services in violation of this Agreement or the Policies.
11.  Limitation of Liability
  1. Company’s maximum liability (whether in contract, tort, negligence, strict liability in tort, or by statute or otherwise) to Customer or to any third party concerning performance or non-performance by Company, or in any manner related to this Agreement or the Services, for any and all claims shall not exceed in the aggregate the Fees paid by Customer to Company hereunder (excluding any Fees or charges relating to approved expenses incurred by Company on behalf of Customer) during the three (3) months prior to the date that the first cause of action accrued.
  2. In no event shall either party be liable for special, consequential, incidental, indirect or punitive loss, damage or expenses whether arising in contract or tort (including but not limited to lost profits, loss of data, or the cost of recreating lost data), even if it has been advised of their possible existence, provided that the foregoing will not apply to limit: (a) Customer’s obligations or liability under Section 10.1, (b) Customer’s liability for breaches of Section 6, or (c) Customer’s infringement, misappropriation of violation of any intellectual property rights of Company or its licensors.
  3. The allocations of liability in this Section represent the agreed and bargained-for understanding of the parties and Fees payable hereunder reflect such allocation. These limitations of liability will apply notwithstanding any failure of essential purpose of any limited remedy.
12.  Miscellaneous
  1. Force Majeure. Neither party shall be liable for any failure or delay in the performance of its obligations (except for payment obligations hereunder) due to causes beyond the reasonable control of the party affected, including but not limited to war, sabotage, insurrection, riot or other act of civil disobedience, strikes or other labor shortages, act of any government affecting the terms hereof, acts of terrorism, accident, fire, explosion, flood, hurricane, pandemic, severe weather or other act of God, failure of telecommunication or internet service providers.
  2. Entire Agreement; Amendment. This Agreement (including the Policies and Order and any attachments thereto specifically agreed by the parties) constitutes the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement. Notwithstanding any language to the contrary therein, no terms or conditions stated in a Customer purchase order or in any other Customer order documentation shall be incorporated into or form any part of this Agreement, and all such terms or conditions are hereby rejected and shall be null and void. In the event of any conflict between this Agreement and the Order, then the Order will take priority to the extent of such conflict.  All waivers must be in a writing signed by both parties, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement and Customer does not have any authority of any kind to bind Company in any respect whatsoever.  In any action or proceeding to enforce rights under this Agreement, the prevailing party will be entitled to recover costs and attorneys’ fees. Company may modify this Agreement from time to time in which case it will update the “Last Revised” date at the top of the webpage on which this Agreement is contained.  If Company makes changes that are material, it will use reasonable efforts to attempt to notify Customer, such as by e-mail and/or by placing a prominent notice on its website. The updated Agreement will be effective as of the time of posting, or such later date as may be specified in the updated Agreement; provided, however, that if the Company makes any material changes to this Agreement, then the Customer may, within 10 days of receiving notice (or otherwise becoming aware) of such changes, terminate this Agreement upon written notice to the Company. Customer’s continued access or use of the Services after such 10-day period will be deemed Customer’s acceptance of such modifications. No amendment shall apply to a dispute for which an action has been initiated in a court of competent jurisdiction prior to the amendment in this Agreement.
  3. Assignment. This Agreement and the rights and obligations hereunder may not be assigned, transferable or sublicensable in whole or in part by Customer except with Company’s prior written consent.  Company may transfer, subcontract and assign this Agreement or any of its rights and obligations under this Agreement without consent.
  4. Severability. Every provision of the Agreement is intended to be severable. If any section of the Agreement is found to be invalid or unenforceable, then such section will be limited or removed from the Agreement to the minimum extent necessary  and the rest of the Agreement will remain in full force and effect and enforceable.
  5. Independent Contractors. The parties are and intend to be independent contractors with respect to the services contemplated hereunder and so represent themselves in all regards. Neither party is the agent of the other, and neither may make commitments on the other’s behalf. Company agrees that neither it, its employees nor its contractors shall be considered as having an employee status with Customer. No form of joint employer, joint venture, partnership, or similar relationship between the parties is intended or hereby created. Except for Section 10, there are no intended third-party beneficiaries under the Agreement.
  6. Notices. All notices under this Agreement will be in writing to (a) in the case of Customer, to the Customer address in the Order, and (b) in the case of Company, to the Company address in the Order (or such other address identified by Company from time to time). Notices will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or e-mail; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested.

Government law & press release. This Agreement shall be governed by the laws of the State of California without regard to its conflict of laws provisions. The state and federal courts located in the State of California shall have exclusive jurisdiction to adjudicate any dispute arising out of or relating to this Agreement. Each party hereby consents to the exclusive jurisdiction of such courts, provided that nothing in this Section prohibits either party from seeking or obtaining in any jurisdiction injunctive or similar relief in connection with the enforcement of this Agreement.  The parties shall work together in good faith to issue at least one mutually agreed upon press release within 90 days of the Effective Date, and Customer otherwise agrees to reasonably cooperate with Company to serve as a reference account upon request.

Purpose

To ensure that information is classified, protected, retained and securely disposed of in accordance with its importance to the organization.

Scope

All Topsort, Inc data, information and information systems.

Policy

Topsort, Inc classifies data and information systems in accordance with legal requirements, sensitivity, and business criticality in order to ensure that information is given the appropriate level of protection. Data owners are responsible for identifying any additional requirements for specific data or exceptions to standard handling requirements.
Information systems and applications shall be classified according to the highest classification of data that they store or process.

Data Classification

To help Topsort, Inc and its employees easily understand requirements associated with different kinds of information, the company has created three classes of data.

Confidential

Highly sensitive data requiring the highest levels of protection; access is restricted to specific employees or departments, and these records can only be passed to others with approval from the data owner, or a company executive. Example include:

  • Customer Data
  • Personally identifiable information (PII)
  • Company financial and banking data
  • Salary, compensation and payroll information
  • Strategic plans
  • Incident reports
  • Risk assessment reports
  • Technical vulnerability reports
  • Authentication credentials
  • Secrets and private keys
  • Source code
  • Litigation data
Restricted

Topsort, Inc proprietary information requiring thorough protection; access is restricted to employees with a "need-to-know" based on business requirements. This data can only be distributed outside the company with approval. This is default for all company information unless stated otherwise. Examples include:

  • Internal policies
  • Legal documents
  • Meeting minutes and internal presentations
  • ContractsInternal reports
  • Slack messages
  • Email
Public

Documents intended for public consumption which can be freely distributed outside Topsort, Inc. Examples include:

  • Marketing materials
  • Product descriptions
  • Release notes
  • External facing policies
Labeling

Confidential data should be labeled "confidential" whenever paper copies are produced for distribution.

Confidential Data Handling

Confidential data is subject to the following protection and handling requirements:

Access for non-preapproved-roles requires documented approval from the data owner Access is restricted to specific employees, roles and/or departments Confidential systems shall not allow unauthenticated or anonymous access Confidential Customer Data shall not be used or stored in non-production systems/environments Confidential data shall be encrypted in transit over public networks Mobile device hard drives containing confidential data, including laptops, shall be encrypted Mobile devices storing or accessing confidential data shall be protected by a log-on password or passcode and shall be configured to lock the screen after five 5 minutes of non-use Backups shall be encrypted Confidential data shall not be stored on personal phones or devices or removable media including USB drives, CD's, or DVD's Paper records shall be labeled "confidential" and securely stored and disposed Hard drives and mobile devices used to store confidential information must be securely wiped prior to disposal or physically destroyed Transfer of confidential data to people or entities outside the company shall only be done in accordance with a legal contract or arrangement, and the explicit written permission of management or the data owner

Restricted Data Handling

Restricted data is subject to the following protection and handling requirements:

Access is restricted to users with a need-to-know based on business requirements Restricted systems shall not allow unauthenticated or anonymous access Transfer of restricted data to people or entities outside the company or authorized users shall require management approval and shall only be done in accordance with a legal contract or arrangement, or the permission of the data owner Paper records shall be securely stored and disposed Hard drives and mobile devices used to store restricted information must be securely wiped prior to disposal or physically destroyed Removable devices are not permitted for data storage

Public Data Handling

No special protection or handling controls are required for public data. Public data may be freely distributed.

Data Retention

Topsort, Inc shall retain data as long as the company has a need for its use, or to meet regulatory or contractual requirements. Once data is no longer needed, it shall be securely disposed of or archived. Data owners, in consultation with legal counsel, may determine retention periods for their data. Retention periods shall be documented in the Data Retention Matrix in Appendix B to this policy.

Data & Device Disposal

Data classified as restricted or confidential shall be securely deleted when no longer needed. Topsort, Inc shall assess the data and disposal practices of third-party vendors in accordance with the Third-Party Management Policy. Only third-parties who meet Topsort, Inc requirements for secure data disposal shall be used for store and process restricted or confidential data. Topsort, Inc shall ensure that all restricted and confidential data is securely deleted from company devices prior to, or at the time of disposal.

Annual Data Review

Management shall review data retention requirements during the annual review of this policy. Data shall be disposed of in accordance with this policy

Legal Requirements

Under certain circumstances, Topsort, Inc may become subject to legal proceedings requiring retention of data associated with legal holds, lawsuits, or other matters as stipulated by Topsort, Inc legal counsel. Such records and information are exempt from any other requirements specified within this Data Management Policy and are to be retained in accordance with requirements identified by the Legal department. All such holds and special retention requirements are subject to annual review with Topsort, Inc's legal counsel to evaluate continuing requirements and scope.

Policy Compliance

Topsort, Inc will measure and verify compliance to this policy through various methods, including but not limited to, business tool reports, and both internal and external audits.

Exceptions

Requests for an exception to this policy must be submitted to the Chief Executive Officer for approval.

Violations & Enforcement

Any known violations of this policy should be reported to the Chief Executive Officer. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.

APPENDIX A  Internal Retention and Disposal Procedure

Topsort, Inc's Data Science team is responsible for setting and enforcing the data retention and

disposal procedures for Topsort, Inc managed accounts and devices.

‍

Customer Accounts:

‍

‍1. Customer accounts and data shall be deleted within ninety 90 days of contract termination through manual data deletion processes.

‍

Devices:

‍

‍1. Employee devices will be collected promptly upon an employee's termination. Remote employees will be sent a shipping label and the return of their device shall be monitored.

2.Collected devices will be cleared to be re-provisioned—or removed from stock, Topsort, Inc will securely erase the device.

3. Device images may be retained at the discretion of management for business purposes

‍

Destroying devices or electronic media‍

‍

In cases where a device is damaged in a way that Topsort, Inc cannot access the Recovery Partition to erase the drive, Topsort, Inc may optionally decide to use an E Waste service that includes data destruction with a certificate. Topsort, Inc will keep certificates of destructions on record for one year. Physical destruction can be optional if it is verified that the device is encrypted with Full Disk Encryption, which would negate the risk of data recovery. Management will review this procedure at least annually.

APPENDIX B  Data Retention Matrix

System or Application

Data Description

Retention Period

Topsort, Inc SaaS Products AWS

Customer Data

Up to 60 days after contract termination

Topsort, Inc Elasticsearch

Customer instance and metadata, debugging data

Up to 45 days after contract termination

Topsort, Inc Customer Support Tickets (Intercom)

Support Tickets and Cases

Indefinite

Topsort, Inc Customer Slack Channels

Support Phone Conve

Topsort, Inc Vulnerability Scan Data (Qualys)

Vulnerability scan results and detection data

6 months
host (asset) data is retained until removed and purged from Qualys

Topsort, Inc Customer Sales (Hubspot)

Opportunity and Sales Data

Indefinite

Products
Data GenieGenie CopilotPrivate ToppieT-BrainT-EngineT-PlatformT-ZeroTomiToppie DSPToptimize SSPToptimize
Solutions
ClassifiedsDelivery AppsDisplay BannerExpandFinancial PlatformsIn StoreLaunchMarketplacesNative PlacementsOffsite AdvertisingOptimizeRetailersScaleSponsored BrandsSponsored ListingsTravel PlatformsVideo Ads
About US
Who we areHow we startedPress and News RoomJoin us - Careers!
Developers
API StatusAPI Quick SheetTools & LibraryKnowledge BaseIntegrating with Topsort
Resources
ResourcesPress KitBranding Guidelines
Terms of use
•
Privacy policy
•
Security