Legal Information
Acceptable Use Policy for the gro.now Platform (b2b)
Version v.1.0 dated 23.10.2025
1. General Provisions
1.1.
This Acceptable Use Policy for the gro.now Platform (hereinafter – the Policy or AUP) establishes mandatory requirements for the use of the Platform, its modules, services, API, integrations, and other functions provided to Clients and the Client's Users.
1.2. - 1.7.
1.2. The purpose of the Policy is to ensure the lawful, secure, and fair use of the Platform, to prevent violations of third-party rights, abuse, and actions that could cause damage to gro.now, its users, partners, or data providers.
1.3. The Policy is an integral part of the User Agreement between the Client and the Platform Provider https://app.gro.now/legal/b2b-Terms; (hereinafter – the UA). In case of a conflict between the UA and this Policy, the following principles shall apply:
(i) if the conflict relates to restrictions or prohibitions on the use of the Platform, this document shall prevail;
(ii) for all other matters, the provisions of the UA shall prevail.
1.4. Related Documents. Other documents governing the use of the Platform are as follows:
1.5. In cases where the Client uses other gro.now documents (including the Data Processing Policy, Data Processing Agreement (DPA), Research Policy, Cookie Policy, SLA, Appendices to tariff plans), the Client is obliged to comply with the requirements of all said documents in their entirety.
1.6. The Policy applies to all of the Client's Users acting on its behalf or in its interests, including employees, contractors, and agents who have been granted access to the Platform under the Client's Account.
1.7. By using the Platform, the Client confirms that it has read this Policy, accepts it, and undertakes to ensure its compliance by all persons having access to the Platform through its Account.
1.3. The Policy is an integral part of the User Agreement between the Client and the Platform Provider https://app.gro.now/legal/b2b-Terms; (hereinafter – the UA). In case of a conflict between the UA and this Policy, the following principles shall apply:
(i) if the conflict relates to restrictions or prohibitions on the use of the Platform, this document shall prevail;
(ii) for all other matters, the provisions of the UA shall prevail.
1.4. Related Documents. Other documents governing the use of the Platform are as follows:
- Tariff Description https://gro.now/#pricing;
- Billing Policy https://app.gro.now/legal/billing
- Service Level Agreement (SLA) https://app.gro.now/legal/sla;
- Research Policy https://app.gro.now/legal/research-policy;
- General Personal Data Processing Policy https://app.gro.now/legal/gdp-policy;
- Data Processing Agreement (DPA) https://app.gro.now/legal/dpa;
- Cookie Policy https://app.gro.now/legal/cookie-policy.
1.5. In cases where the Client uses other gro.now documents (including the Data Processing Policy, Data Processing Agreement (DPA), Research Policy, Cookie Policy, SLA, Appendices to tariff plans), the Client is obliged to comply with the requirements of all said documents in their entirety.
1.6. The Policy applies to all of the Client's Users acting on its behalf or in its interests, including employees, contractors, and agents who have been granted access to the Platform under the Client's Account.
1.7. By using the Platform, the Client confirms that it has read this Policy, accepts it, and undertakes to ensure its compliance by all persons having access to the Platform through its Account.
2. Terms and Definitions
2.1 - 2.24.
- 2.1. Platform – the gro.now hardware and software complex, including web interfaces, mobile applications (app), backend services, AI-based analytics modules, data connectors, SDKs, and (if available) APIs, as well as related documentation.
- 2.2. Provider – Pwron LLP, BIN 241040012133, address: Republic of Kazakhstan, Almaty, Bostandyk district, Satpayev str., 90/54, apt. 5, postal code 050000; e-mail: hi@gro.now; website: https://gro.now/.
- 2.3. Client - a legal entity or natural person who has entered into a User Agreement (UA) with the Provider and has been granted access to the Platform.
- 2.4. User Agreement (UA) -
- 2.5. Services - the Provider's services for providing access to the Platform on a SaaS model, ensuring its functionality and infrastructure support within the SLA, as well as configuration works to set up the Platform's functionality (including Research Modules), if such works are provided for by the Tariff or agreed upon separately.
- 2.6. SaaS (Software as a Service) — is a cloud-based model for providing software, in which the Provider develops cloud software, provides its maintenance, automatic updates, and availability, and provides such software to customers via the Internet for a fee proportional to the volume of use. The Provider manages all hardware, standard software, including middleware, software applications, and security.
- 2.7. Client's User – any person to whom the Client has granted access to the Platform through its Account (including employees, contractors, agents, and other authorized persons).
- 2.8. Client's Account (Account) — a set of user accounts, settings, and data created by the Client on the Platform for using the Services.
- 2.9. Account Administrator – a Client's User vested with rights to manage access and Client settings on the Platform (creating/deleting users, assigning roles, selecting a tariff plan, etc.).
- 2.10. Research – a set of analytical activities carried out by the Client using the Platform's functionality and analytical tools based on data obtained from open sources, including, but not limited to, social media analysis, reviews, macroeconomic indicators, as well as conducting Electronic Surveying.
- 2.11. Research Modules – pre-configured software solutions within the Platform's functionality that allow for the automated collection and analysis of information from open sources for conducting Research. The Provider ensures their functionality and, if necessary, carries out their configuration/inclusion to the extent provided for by the Agreement.
- 2.12. Electronic Surveying – the collection and processing of data through online surveys and interviews conducted in an automated mode using the Platform.
- 2.13. Research Results – aggregated data and analytical indicators processed using the Platform's tools and/or artificial intelligence and displayed through the Platform's interface.
- 2.14. Client Data – any data, files, texts, images, metadata, and other information uploaded or otherwise transmitted by the Client to the Platform, as well as data processed on behalf of the Client.
- 2.15. Results – output data, analytical reports, visualizations, texts, models, and other materials generated by the Platform at the Client's request.
- 2.16. Trial Features – mean any free access to the Platform: a trial version, a pilot/proof of concept, a beta version, a demo environment, or other Services provided without payment, as specified by the Provider in the interface, order/invitation, or otherwise communicated to the Client.
- 2.17. Subscription – a paid right of access to the Platform for a selected period (month/year or other) within the selected Tariff, with included limits/functionality and an active SLA.
- 2.18. Tariff (Plan) – a package of functionality, limits, and conditions for the provision of Services published at https://gro.now/#pricing, indicating the price, period, and restrictions.
- 2.19. Supplementary Agreement / Order – a document signed by the Parties that explicitly provides for the Provider's special obligations to perform tasks beyond the scope of the Services (e.g., development/configuration of an additional Research Module), including the scope, deadlines, and cost of such services.
- 2.20. Website – the public pages https://gro.now/ and https://app.gro.now/.
- 2.21. DPA – the Data Processing Agreement, located at https://app.gro.now/legal/dpa, which governs the roles of the Parties (Client – operator/controller, Provider – processor, if applicable), security measures, and the procedure for interaction.
- 2.22. SLA - the Service Level Agreement, located at https://app.gro.now/legal/sla, which establishes target indicators for availability/response and service credits.
- 2.23. AUP – the Acceptable Use Policy, located at https://app.gro.now/legal/acceptable-use-policy, which defines prohibitions and restrictions when using the Platform.
- 2.24. Third-Party Services (Integrations) – external services and providers not controlled by the Provider (e.g., authentication/SSO providers, scheduling tools, payment organizations), interaction with which may be carried out at the Client's choice.
3. Scope of Application
3.1. - 3.5.
- 3.1. This Policy applies to any use of the gro.now Platform, including web interfaces, bots and plugins, mobile and desktop applications, SDKs, APIs, LLM functions, connectors, and third-party integrations, as well as to all related environments (production, testing, sandbox, beta/preview).
- 3.2. The Policy is mandatory for all of the Client's Users acting through the Client's Account, regardless of their status (employees, contractors, agents, other authorized persons) and method of access (personal login, SSO, API tokens/keys, service accounts).
- 3.3. The Policy applies to: (i) Client Data uploaded or otherwise transmitted to the Platform; (ii) data exchange between the Platform and integrations/sources connected by the Client; (iii) Results generated by the Platform's tools; (iv) technical traffic and operations performed via API/interfaces.
- 3.4. The use of Trial Features is governed by the Policy, taking into account the special restrictions and reservations established by the UA and the announcement materials for the respective features. In case of a prohibition on uploading sensitive data to Trial Features, the Client is obliged to comply with such prohibition.
- 3.5. Geographical Applicability. The Provider may restrict access to the Platform, individual functions, or integrations, taking into account the requirements of export control, sanctions, and other applicable legislation, as well as contractual restrictions from technology/content suppliers. The Client undertakes to consider such restrictions when providing access to its Users and when choosing processing regions.
3.6. - 3.11.
3.6. Integrations and External Services. Where the functionality of the Platform depends on third-party services (including, but not limited to, LLM providers, analytics tools, communication platforms), the use of such services falls under this Policy with respect to the Client's actions on the Platform and is simultaneously governed by the terms of the respective third parties. The Client is responsible for the lawfulness of data transfer to such services and the correctness of integration settings.
3.7. Exclusions. If a specialized gro.now document (e.g., Research Policy, DPA, Security Policies) explicitly establishes different regulations for a specific type of activity or data, the provisions of such a specialized document shall apply to the specified subject matter. In all other respects, this document shall apply.
3.8. Precedence over the Client's Internal Regulations. In case of a discrepancy between the Client's internal regulations/policies on the use of the Platform and this Policy, this Policy and the UA shall apply in relations with the Provider. The Client may introduce stricter internal requirements for its Users that do not contradict the Policy.
3.9. Application to Automation. The Policy applies equally to actions performed manually and through automation (scripts, bots, integration buses, RPA), including scheduled operations and bulk API calls.
3.10. Entry into Force for New and Existing Clients. The Policy shall enter into force on the date of its publication on the Website (hereinafter – the Publication Date).
3.10.1. For new Clients, the Policy is mandatory from the moment of first access to the Platform after the Publication Date.
3.10.2. For existing Clients, the Policy is mandatory:
a) from the Publication Date, if the UA already provided for the inclusion of the AUP by reference, or
b) upon the expiration of 5 calendar days from the sending of a notification, if the AUP is introduced for the first time and was not previously included in the UA. Continued use of the Platform after the specified periods constitutes acceptance of the Policy.
3.11. Retroactive Effect and Ongoing Processes. The Policy does not have retroactive effect with respect to actions fully completed before the Publication Date/entry into force. However, the Policy applies to the current and future use of the Platform, to ongoing processes and their consequences (including data storage and processing, the operation of integrations, access by the Client's Users). The Provider may set a reasonable period for bringing use into compliance; in the event of a significant risk of violation of the law/security, it may temporarily restrict access immediately.
3.7. Exclusions. If a specialized gro.now document (e.g., Research Policy, DPA, Security Policies) explicitly establishes different regulations for a specific type of activity or data, the provisions of such a specialized document shall apply to the specified subject matter. In all other respects, this document shall apply.
3.8. Precedence over the Client's Internal Regulations. In case of a discrepancy between the Client's internal regulations/policies on the use of the Platform and this Policy, this Policy and the UA shall apply in relations with the Provider. The Client may introduce stricter internal requirements for its Users that do not contradict the Policy.
3.9. Application to Automation. The Policy applies equally to actions performed manually and through automation (scripts, bots, integration buses, RPA), including scheduled operations and bulk API calls.
3.10. Entry into Force for New and Existing Clients. The Policy shall enter into force on the date of its publication on the Website (hereinafter – the Publication Date).
3.10.1. For new Clients, the Policy is mandatory from the moment of first access to the Platform after the Publication Date.
3.10.2. For existing Clients, the Policy is mandatory:
a) from the Publication Date, if the UA already provided for the inclusion of the AUP by reference, or
b) upon the expiration of 5 calendar days from the sending of a notification, if the AUP is introduced for the first time and was not previously included in the UA. Continued use of the Platform after the specified periods constitutes acceptance of the Policy.
3.11. Retroactive Effect and Ongoing Processes. The Policy does not have retroactive effect with respect to actions fully completed before the Publication Date/entry into force. However, the Policy applies to the current and future use of the Platform, to ongoing processes and their consequences (including data storage and processing, the operation of integrations, access by the Client's Users). The Provider may set a reasonable period for bringing use into compliance; in the event of a significant risk of violation of the law/security, it may temporarily restrict access immediately.
4. Administration and Security
4.1. Client's Responsibility. The Client is responsible for the administration of its Account, the creation and deletion of the Client's Users, the assignment of roles and rights, the issuance/revocation of keys and tokens, as well as for compliance with this Policy by all persons acting through the Client's Account.
4.2. Accounts and Access.
4.2.1. Personal Access: each Client's User must have a separate account; shared accounts are prohibited.
4.2.2. Principle of Least Privilege: rights are granted to the extent necessary for the Client's User's tasks.
4.2.3. MFA: multi-factor authentication is mandatory for Account Administrators and integration owners; for other roles, it is based on the Client's policy, but is recommended.
4.2.4. SSO/IdP: when using SSO, the Client ensures the correct configuration of the identity provider and the timely deactivation of access.
4.3. Keys, Tokens, Webhooks.
4.3.1. Issuance/Storage: API keys and tokens are generated and stored securely by the Client, without being transferred to third parties outside the purposes of integration.
4.3.2. Rotation/Revocation: the Client is obliged to immediately revoke compromised keys/tokens and to carry out their planned rotation according to its own policy.
4.3.3. Restrictions: it is prohibited to bypass limits, substitute the source of requests, or use proxies/emulators to mask traffic.
4.3.4. Webhooks: the Client is obliged to verify the authenticity of notifications (signatures/secrets) and to protect webhook endpoints.
4.4. Devices and Environment.
4.4.1. Access to the Platform is permitted only from managed or properly secured devices (up-to-date OS/software updates, antivirus, disk encryption if confidential data is present).
4.4.2. Public/shared devices, as well as insecure networks, should not be used for administrative operations.
4.5. Client Data.
4.5.1. Minimization: upload and transfer only the data that is necessary for the purpose of processing.
4.5.2. Classification: the Client is obliged to consider the sensitivity of the data and not to place data on the Platform, the uploading of which is expressly prohibited by this Policy or gro.now documents.
4.5.3. Masking: when using integrations and LLM calls, the Client is obliged to mask/pseudonymize personal and confidential data where possible.
4.6. Security Incidents.
4.6.1. Notification to the Provider: upon suspicion of compromised accounts, keys, integrations, or unauthorized access, the Client is obliged to notify the Provider without undue delay through the specified support/security channels.
4.6.2. Initial Measures: immediate change of passwords/MFA, revocation of keys, blocking of sessions and accounts, recording of event logs on the Client's side.
4.6.3. Assistance: the Client provides reasonable information and assistance for the investigation and resolution of the incident.
4.7. Logs and Audit.
4.7.1. The Client ensures the maintenance and preservation of the action logs of the Client's Users and integrations available to it, sufficient for internal control and investigations.
4.7.2. The intentional deletion/distortion of logs is prohibited if it hinders the investigation of incidents.
4.8. Platform Security Settings.
4.8.1. The Client is obliged to use the available security features of the Platform (IP restrictions, roles, password policies, session control, etc.), as well as to keep them up-to-date.
4.8.2. It is prohibited to disable or bypass access control mechanisms, rate limits, bot checks, and other protective measures of the Platform.
4.9. Security Testing and Research.
4.9.1. Scanning, load testing, and penetration testing of the Platform without the prior written consent of the Provider are prohibited.
4.9.2. The Client undertakes to notify the Provider of any discovered vulnerabilities and to refrain from exploiting them.
4.10. Compliance with Limits. The Client is obliged to comply with technical limits/quotas and other fair use parameters. Automation (scripts/bots) must stay within these restrictions.
4.11. Revoking User Access. The Client is obliged to promptly revoke access for dismissed/suspended employees and contractors, as well as to review roles when an employee's functions change.
4.12. Responsibility for Contractors. If the Client engages contractors/agents, providing them with access to the Platform, the Client shall ensure the same security standards for them and shall be responsible for their actions as for its own.
4.2. Accounts and Access.
4.2.1. Personal Access: each Client's User must have a separate account; shared accounts are prohibited.
4.2.2. Principle of Least Privilege: rights are granted to the extent necessary for the Client's User's tasks.
4.2.3. MFA: multi-factor authentication is mandatory for Account Administrators and integration owners; for other roles, it is based on the Client's policy, but is recommended.
4.2.4. SSO/IdP: when using SSO, the Client ensures the correct configuration of the identity provider and the timely deactivation of access.
4.3. Keys, Tokens, Webhooks.
4.3.1. Issuance/Storage: API keys and tokens are generated and stored securely by the Client, without being transferred to third parties outside the purposes of integration.
4.3.2. Rotation/Revocation: the Client is obliged to immediately revoke compromised keys/tokens and to carry out their planned rotation according to its own policy.
4.3.3. Restrictions: it is prohibited to bypass limits, substitute the source of requests, or use proxies/emulators to mask traffic.
4.3.4. Webhooks: the Client is obliged to verify the authenticity of notifications (signatures/secrets) and to protect webhook endpoints.
4.4. Devices and Environment.
4.4.1. Access to the Platform is permitted only from managed or properly secured devices (up-to-date OS/software updates, antivirus, disk encryption if confidential data is present).
4.4.2. Public/shared devices, as well as insecure networks, should not be used for administrative operations.
4.5. Client Data.
4.5.1. Minimization: upload and transfer only the data that is necessary for the purpose of processing.
4.5.2. Classification: the Client is obliged to consider the sensitivity of the data and not to place data on the Platform, the uploading of which is expressly prohibited by this Policy or gro.now documents.
4.5.3. Masking: when using integrations and LLM calls, the Client is obliged to mask/pseudonymize personal and confidential data where possible.
4.6. Security Incidents.
4.6.1. Notification to the Provider: upon suspicion of compromised accounts, keys, integrations, or unauthorized access, the Client is obliged to notify the Provider without undue delay through the specified support/security channels.
4.6.2. Initial Measures: immediate change of passwords/MFA, revocation of keys, blocking of sessions and accounts, recording of event logs on the Client's side.
4.6.3. Assistance: the Client provides reasonable information and assistance for the investigation and resolution of the incident.
4.7. Logs and Audit.
4.7.1. The Client ensures the maintenance and preservation of the action logs of the Client's Users and integrations available to it, sufficient for internal control and investigations.
4.7.2. The intentional deletion/distortion of logs is prohibited if it hinders the investigation of incidents.
4.8. Platform Security Settings.
4.8.1. The Client is obliged to use the available security features of the Platform (IP restrictions, roles, password policies, session control, etc.), as well as to keep them up-to-date.
4.8.2. It is prohibited to disable or bypass access control mechanisms, rate limits, bot checks, and other protective measures of the Platform.
4.9. Security Testing and Research.
4.9.1. Scanning, load testing, and penetration testing of the Platform without the prior written consent of the Provider are prohibited.
4.9.2. The Client undertakes to notify the Provider of any discovered vulnerabilities and to refrain from exploiting them.
4.10. Compliance with Limits. The Client is obliged to comply with technical limits/quotas and other fair use parameters. Automation (scripts/bots) must stay within these restrictions.
4.11. Revoking User Access. The Client is obliged to promptly revoke access for dismissed/suspended employees and contractors, as well as to review roles when an employee's functions change.
4.12. Responsibility for Contractors. If the Client engages contractors/agents, providing them with access to the Platform, the Client shall ensure the same security standards for them and shall be responsible for their actions as for its own.
5. Basic Prohibitions and Unacceptable Actions
5.1. Illegal Activity and Content.
It is prohibited to use the Platform for violations of applicable law, including for: a) distributing materials that infringe copyright and related rights, trademarks, patents, trade secrets; b) infringing on honor, dignity, and private life; c) discrimination, threats, harassment, incitement to hatred, promotion of violence; d) fraud, misrepresentation, illegal financial transactions, circumvention of sanctions and export controls.
5.2. Violation of Security and Integrity of Services.
The following are prohibited: a) attempts to hack, escalate privileges, guess credentials; b) scanning, load tests, penetration tests without the written consent of the Provider; c) interference with the operation of the Platform (DDoS, exploitation of vulnerabilities, injections, bypassing limits/captchas, traffic spoofing, emulators/botnets).
5.3. - 5.15.
- 5.3. Circumvention of Technical and Commercial Restrictions. It is not permitted to: a) bypass limits/quotas, tariff restrictions, billing mechanisms, licensing, and access control; b) use multi-accounting/parallelization to bypass limits; c) substitute the source of requests or mask their origin.
- 5.4. Unfair Use of API and Integrations. It is prohibited to: a) automatically collect data from sources or integrations if this violates their rules/access (including robots.txt, captchas, technical prohibitions); b) make API calls to third parties through the Platform in violation of their terms; c) transfer more data than necessary to integrations (including personal and confidential data) without a legal basis.
- 5.5. Reverse Engineering and Unfair Competition. It is not permitted to: a) decompile, disassemble, or attempt to obtain the source code, algorithms, or models of the Platform; b) use the Platform solely to create a functionally competing service; c) publish benchmark results of the Platform without the prior consent of the Provider.
- 5.6. Prohibited Categories of Data. Without the express written consent of the Provider, it is prohibited to upload/process: a) primary payment data (full card numbers, CVV, PIN, etc.); b) state, attorney-client, banking, and other secrets of third parties protected by law without proper authorization; c) biometric and other special categories of personal data (if the legal basis and processing regime have not been agreed upon); d) malicious code, exploits, materials aimed at causing harm.
- 5.7. Abuse in Communications. The following are prohibited: sending spam, mass unsolicited messages, farming/phishing, manipulating metrics, rating and voting systems, including generating fake reviews or boosting.
- 5.8. Impersonation and Unauthorized Access. It is not permitted to: a) impersonate another person/organization without authorization; b) access the accounts/data of third parties without permission; c) use others' tokens/keys, share one's own access, or organize a shared account.
- 5.9. Violation of Data Subjects' Rights and Confidentiality. It is prohibited to: a) upload/process personal data without a proper legal basis and notification to the subjects (if required by law); b) publish Results containing personal data/secrets of third parties if this violates the law or the terms of the sources.
- 5.10. Manipulation of Results and Sources. It is not permitted to: a) present aggregated/synthesized Results as a primary source when the terms of the data owner do not allow it; b) remove/hide mandatory notices, watermarks, metadata, or source attributions; c) knowingly distort content to cause harm to third parties.
- 5.11. Use of Trial Features. In test, trial, and beta environments, it is prohibited to upload sensitive data (including special categories of PD and secrets) and to use such environments for production operations, unless otherwise expressly agreed with the Provider.
- 5.12. Technical Protection Measures of the Platform. It is prohibited to disable, modify, or bypass protection mechanisms (anti-bot, rate-limit, session control, webhook verification, integration policies), as well as to interfere with logs/journals to conceal actions.
- 5.13. Prohibited Content in Generated Materials. When using LLM functions, it is prohibited to request/generate materials that clearly violate the law, third-party rights, security, or other prohibitions of this section (including instructions for creating malicious tools, promoting violence, inciting hatred, exploiting minors).
- 5.14. Exceptions for Good Faith Security Research. Security testing of the Platform is permitted only on the basis of the prior written consent of the Provider and within the issued scenarios/testing windows. Discovered vulnerabilities should be reported to the Provider immediately, and their exploitation should be refrained from.
- 5.15. Consequences of Violations. Violations of this section may result in the measures provided for in Section 9 (warning, temporary restrictions, blocking, termination), as well as refusal of support and transfer of information to competent authorities if required by law or necessary to prevent damage.
6. Restrictions on the Use of Data and Results
6.1. Legality and Grounds.
The Client warrants that it has legal grounds (contract, consent, law, other) for uploading, transferring, storing, and processing Client Data on the Platform, as well as for transferring such data to integrations/third parties at its discretion.
6.2. Minimization and Proportionality.
The Client shall upload and process on the Platform only such data and to such an extent as is necessary for the stated purpose, and shall cease processing/delete the data upon achievement of the purpose or expiration of the grounds.
6.3. - 6.11.
6.3. Restrictions of Source Owners. If the Results are generated based on the data/content of third parties (sources), the Client is obliged to comply with the terms of the respective sources, including licenses, attributions, prohibitions on reuse, commercialization, public distribution, and other restrictions.
6.4. External Distribution of Results.
a) The Results are intended primarily for the Client's internal use.
b) When distributing the Results externally, the Client shall independently conduct a legal assessment (source licenses, PD, confidentiality, know-how, export control) and ensure compliance with the requirements of applicable law and contracts.
c) It is prohibited to present the Results as a 'primary source' if this contradicts the terms of the data owners or is misleading.
6.5. Confidentiality of Third Parties and Secrets. It is prohibited to place on the Platform information constituting state, banking, commercial, attorney-client, and other secrets of third parties protected by law without proper authorization. When working with the Client's secrets, the Client is obliged to apply a regime comparable to the confidentiality regime established by it.
6.6. Personal Data and Sensitive Categories.
a) The Client shall ensure the existence of a legal basis and the provision of information to data subjects (if required by law) when processing personal data on the Platform and when transferring it to integrations.
b) The processing of special categories of personal data, biometrics, medical data, and children's data is permitted only if there are grounds and in compliance with additional requirements of the law and this Policy.
c) It is recommended to apply masking/pseudonymization/anonymization where possible.
6.7. Attribution and Notice Requirements. The Client shall not remove or hide mandatory notices of copyright, licenses, data sources, trademarks, and other legal notices if they are provided for by the sources or the Results.
6.8. Restrictions on Building Services. It is prohibited to use the Platform and the Results to create publicly available datasets/models/indexes intended for commercial distribution as a standalone product, unless otherwise expressly agreed with the Provider.
6.9. Export Control and Sanctions. The Client shall not use the Platform and the Results in activities that violate export controls, sanctions regimes, and other restrictive measures. Upon the Provider's request, the Client shall provide confirmation of compliance with the relevant requirements.
6.10. Retention and Deletion. The Client shall manage the retention periods of Client Data on the Platform (where technically available) and shall initiate deletion/anonymization upon completion of the processing purpose, unless otherwise required by law or the contract with the Provider.
6.11. Client's Responsibility. The Client is responsible for any use of Client Data and the Results carried out by it and the Client's Users, as well as for compliance with the contractual restrictions of the sources and this Policy. The Provider is not obliged to verify the legality of the external distribution of the Results by the Client.
6.4. External Distribution of Results.
a) The Results are intended primarily for the Client's internal use.
b) When distributing the Results externally, the Client shall independently conduct a legal assessment (source licenses, PD, confidentiality, know-how, export control) and ensure compliance with the requirements of applicable law and contracts.
c) It is prohibited to present the Results as a 'primary source' if this contradicts the terms of the data owners or is misleading.
6.5. Confidentiality of Third Parties and Secrets. It is prohibited to place on the Platform information constituting state, banking, commercial, attorney-client, and other secrets of third parties protected by law without proper authorization. When working with the Client's secrets, the Client is obliged to apply a regime comparable to the confidentiality regime established by it.
6.6. Personal Data and Sensitive Categories.
a) The Client shall ensure the existence of a legal basis and the provision of information to data subjects (if required by law) when processing personal data on the Platform and when transferring it to integrations.
b) The processing of special categories of personal data, biometrics, medical data, and children's data is permitted only if there are grounds and in compliance with additional requirements of the law and this Policy.
c) It is recommended to apply masking/pseudonymization/anonymization where possible.
6.7. Attribution and Notice Requirements. The Client shall not remove or hide mandatory notices of copyright, licenses, data sources, trademarks, and other legal notices if they are provided for by the sources or the Results.
6.8. Restrictions on Building Services. It is prohibited to use the Platform and the Results to create publicly available datasets/models/indexes intended for commercial distribution as a standalone product, unless otherwise expressly agreed with the Provider.
6.9. Export Control and Sanctions. The Client shall not use the Platform and the Results in activities that violate export controls, sanctions regimes, and other restrictive measures. Upon the Provider's request, the Client shall provide confirmation of compliance with the relevant requirements.
6.10. Retention and Deletion. The Client shall manage the retention periods of Client Data on the Platform (where technically available) and shall initiate deletion/anonymization upon completion of the processing purpose, unless otherwise required by law or the contract with the Provider.
6.11. Client's Responsibility. The Client is responsible for any use of Client Data and the Results carried out by it and the Client's Users, as well as for compliance with the contractual restrictions of the sources and this Policy. The Provider is not obliged to verify the legality of the external distribution of the Results by the Client.
7. Limits, Quotas, and Fair Use
7.1. - 7.10.
- 7.1. Plans and Tariffs. The use of the Platform is carried out within the parameters established by the selected Tariff (number of users, storage volumes, request limits, functions, integrations, projects, etc.).
- 7.2. Technical Limits. The Provider establishes technical quotas (including rate limits, maximum payload sizes, task/webhook frequencies, operation parallelism). The specific values may vary by plan and may be changed by the Provider according to the rules provided for in the UA.
- 7.3. Fair Use. The Client undertakes not to perform actions that a) create a disproportionate load on the infrastructure; b) hinder the normal operation of other clients; c) bypass or artificially extend limits (including multi-accounting, proxying through third-party services, artificial 'parallelization').
- 7.4. Automation. Robots, scripts, integration buses, RPA, and other automation tools must comply with the limits and periodicity specified in the documentation. Infinite retries without an exponential backoff, 'burst' traffic, and polling cycles with intervals below the recommended ones are prohibited.
- 7.5. Exceeding Limits. Upon reaching a limit, operations may be automatically suspended/rejected until the next quota window. The Provider may temporarily restrict functions/integrations until the load is reduced or a higher plan is adopted.
- 7.6. Changing Limits. The Provider may adjust the limits to ensure the stability and security of the service, notifying the Client within a reasonable time, unless immediate measures are required. For Trial Features, limits may be changed without prior notice.
- 7.7. Peak Loads and 'Spikes'. The Provider may apply throttling and queuing. The Client is obliged to design integrations taking into account idempotency, retries, and processing delays.
- 7.8. Billing for Overage. If the Tariff provides for payment for usage exceeding the limits (overage), such charges shall be made at the current rates and terms of the tariff. The absence or delay of notifications about reaching the limits does not release from payment for actual consumption.
- 7.9. Local Restrictions. For individual functions/integrations, special limits established by third-party service providers may apply; the Client bears the risk of such restrictions and undertakes to follow them.
- 7.10. Requests for Expansion. Upon the Client's request, the Provider may offer a temporary expansion of quotas, a separate limit for a project/integration, or a transition to another plan; such changes are effective only after confirmation by the Provider.
8. Research Activities (Special Rules)
- 8.1. Applicability. This section applies to all types of research conducted through the Platform (researcher dashboards, data collection and processing, surveys, audiences, scenarios, parsing through provided connectors, etc.).
- 8.2. Legality of Purpose and Methodology. The Client ensures the legality of the research purposes, the correctness of the methodology, compliance with the rights of respondents and source owners, as well as compliance with the requirements of the platforms where data is collected.
- 8.3. Transparency and Prevention of Deception. When interacting with respondents and audiences, deception, hidden manipulations, improper incentives/pressure, and data collection contrary to the rules of the platforms or without mandatory notifications are prohibited.
- 8.4. Data Collection from Open Sources. Permitted only to the extent allowed by the respective sources (terms of use, licenses, robots.txt, technical prohibitions, anti-bot mechanisms). Bypassing captchas, access controls, and paid APIs without authorization is prohibited.
- 8.5. Personal Data and Vulnerable Groups. a) The collection/processing of PD is permitted if there is a legal basis, in compliance with mandatory notifications, consents, and restrictions on territory/cross-border transfer. b) The processing of special categories of PD, children's data, medical/biometric data is permitted only if there are special grounds and additional protective measures. c) Masking/pseudonymization, minimization of fields, and retention periods are recommended.
- 8.6. Restrictions on Content and Research Artifacts. a) It is not permitted to create/distribute artifacts (reports, datasets, instructions) that clearly violate the law, third-party rights, or the prohibitions of this Policy. b) The external publication of artifacts requires verification of source licenses, platform terms, and the removal/anonymization of PD if there is no basis for disclosure.
- 8.7. Technical Integrity. Scripts/bots/connectors must operate within the established limits, intervals, and routes, without creating an excessive load on the sources and the Platform. The Client ensures idempotency, error handling, respect for rate limits, and fault tolerance.
- 8.8. Prohibition of 'Shadow' Parsing. The use of one's own or third-party tools for the hidden collection of data through the Platform in circumvention of source rules, masking of traffic/identity, and emulation of users without permission are prohibited.
- 8.9. Sensitive Environments. In test/beta research environments, it is prohibited to place sensitive data and to conduct active impacts on external sources (mass requests, load scenarios), unless otherwise expressly agreed with the Provider.
- 8.10. Rights of Source Owners. Upon receipt of claims from data/platform owners related to a specific research of the Client, the Provider may immediately restrict the relevant functions or integrations until the incident is resolved.
- 8.11. Documentation and Reproducibility. The Client shall maintain a log of key research parameters (purposes, sources, legal bases, versions of scripts/surveys, dates), sufficient for internal control and responses to requests from regulatory authorities and source owners.
- 8.12. Liability. The Client is responsible for compliance with this section and shall indemnify the Provider for losses if third-party claims are caused by the actions of the Client or its Client's Users during the conduct of the research.
9. Monitoring and Measures for Violations
9.1. Compliance Monitoring. The Provider may, with reasonable frequency and to the necessary extent, monitor the technical metrics of the Platform's use (request logs, performance telemetry, error rates, authorization/audit events) to identify violations of this Policy, security incidents, and abuse. The content of Client Data is not reviewed without a legal basis (incident, request from a competent authority, Client's consent).
9.2. Incident Verification. Upon detection of anomalies, the Provider may temporarily restrict certain functions/integrations for verification, request information from the Client (request IDs, integration configurations, contact of the responsible person), and set a deadline for a response.
9.3. Escalation of Response Measures. Depending on the nature and severity of the violation, the following measures are applied, in increasing order: (i) a warning and an order to rectify the violation within a specified period; (ii) temporary restriction of functionality/integrations/user roles; (iii) temporary suspension of access for individual Client's Users; (iv) suspension of the Client's Account; (v) termination of access/termination in the manner provided for in the UA; (vi) notification to source owners/third parties and/or transfer of information to competent authorities, if required by law.
9.4. Urgent Measures. In the presence of signs of (i) a threat to the security of the Platform or third parties, (ii) a probable significant violation of the law/third-party rights, (iii) circumvention of technical restrictions with a risk to the stability of the service, the Provider may apply immediate blocking of functions/integrations/Account with subsequent notification to the Client.
9.5. Rectification of Violations. The Client is obliged, within a reasonable period set by the Provider, to: cease the violation, delete/correct the problematic data, roll back configurations, revoke compromised keys/access, configure limits, update the access policy for the Client's Users, and confirm the actions taken in writing.
9.6. Repeated/Gross Violations. In case of repeated, systematic, or gross violations (including intentional circumvention of restrictions, interference with protective measures, causing damage to third parties), the Provider may proceed to a stricter measure without observing the sequence specified in para. 9.3, including termination of access.
9.7. Suspension due to External Requirements. If the violation is related to claims from source/integration owners or mandatory requirements of authorities, the Provider may suspend the relevant functions until the issue is resolved; resumption of access is possible after confirmation of the rectification of the violations.
9.8. Restoration of Access. Access is restored after confirmation of the elimination of the causes of the violation, as well as, if necessary, agreement with source owners/third parties. The Provider may establish a trial period with additional limits.
9.9. Appeals. The Client has the right to appeal the measures applied in the manner provided for in Section 10 of the Policy. Filing an appeal does not suspend the effect of urgent measures under para. 9.4.
9.2. Incident Verification. Upon detection of anomalies, the Provider may temporarily restrict certain functions/integrations for verification, request information from the Client (request IDs, integration configurations, contact of the responsible person), and set a deadline for a response.
9.3. Escalation of Response Measures. Depending on the nature and severity of the violation, the following measures are applied, in increasing order: (i) a warning and an order to rectify the violation within a specified period; (ii) temporary restriction of functionality/integrations/user roles; (iii) temporary suspension of access for individual Client's Users; (iv) suspension of the Client's Account; (v) termination of access/termination in the manner provided for in the UA; (vi) notification to source owners/third parties and/or transfer of information to competent authorities, if required by law.
9.4. Urgent Measures. In the presence of signs of (i) a threat to the security of the Platform or third parties, (ii) a probable significant violation of the law/third-party rights, (iii) circumvention of technical restrictions with a risk to the stability of the service, the Provider may apply immediate blocking of functions/integrations/Account with subsequent notification to the Client.
9.5. Rectification of Violations. The Client is obliged, within a reasonable period set by the Provider, to: cease the violation, delete/correct the problematic data, roll back configurations, revoke compromised keys/access, configure limits, update the access policy for the Client's Users, and confirm the actions taken in writing.
9.6. Repeated/Gross Violations. In case of repeated, systematic, or gross violations (including intentional circumvention of restrictions, interference with protective measures, causing damage to third parties), the Provider may proceed to a stricter measure without observing the sequence specified in para. 9.3, including termination of access.
9.7. Suspension due to External Requirements. If the violation is related to claims from source/integration owners or mandatory requirements of authorities, the Provider may suspend the relevant functions until the issue is resolved; resumption of access is possible after confirmation of the rectification of the violations.
9.8. Restoration of Access. Access is restored after confirmation of the elimination of the causes of the violation, as well as, if necessary, agreement with source owners/third parties. The Provider may establish a trial period with additional limits.
9.9. Appeals. The Client has the right to appeal the measures applied in the manner provided for in Section 10 of the Policy. Filing an appeal does not suspend the effect of urgent measures under para. 9.4.
10. Reporting Violations and Appeals
- 10.1. Communication Channels. Reports of violations of the Policy, security incidents, and vulnerabilities shall be sent through: (i) the support form in the Platform's interface; (ii) the email address t@gro.now, indicated on the Website; (iii) other channels expressly specified by the Provider in the documentation.
- 10.2. Content of the Notification. The communication should preferably include: a) the Client's Account identifier; b) the date/time (with time zone) and example(s) of requests/events; c) a description of the facts and the alleged violation; d) the contact of the responsible person; e) technical artifacts (logs, screenshots, traces) without excessive personal data.
- 10.3. Confirmation and Initial Review. The Provider shall send a confirmation of receipt of the communication (if technically possible) and conduct an initial review for the sufficiency of the information. If necessary, the Provider may request additional information from the Client and set a deadline for its provision.
- 10.4. Confidentiality and 'Responsible Disclosure'. Notifications of vulnerabilities/incidents are treated confidentially. Publication of details before the problem is resolved is not permitted. Persons who have reported vulnerabilities in good faith are not considered violators if they have refrained from exploitation and have acted in accordance with the Provider's instructions.
- 10.5. Client's Appeals on Response Measures. a) The Client has the right to appeal the measures applied (warning, restrictions, blocking, termination) by sending a justification and supporting materials through the communication channels in para. 10.1. b) The minimum content of the appeal: a reference to the notification/incident, the date the measure was applied, arguments of disagreement (factual/legal), a description of the steps taken to eliminate the causes. c) Filing an appeal does not suspend the effect of urgent measures applied under para. 9.4.
- 10.6. Consideration of the Appeal and Timeframes. The Provider shall consider the appeal within a reasonable time, taking into account the complexity of the issue and the involvement of third parties (source owners, integration providers). If necessary, the Provider may establish interim measures (mitigation of restrictions, a trial period).
- 10.7. Results of the Consideration. Based on the results of the consideration of the appeal, the Provider shall: (i) cancel the measure; (ii) change its scope/term; (iii) leave the measure unchanged; (iv) propose a corrective action plan with control points (remediation plan). The decision and its motives shall be communicated to the Client through the chosen communication channel.
- 10.8. Abuse of Procedures. The intentional submission of knowingly false reports, mass 'noise' communications, as well as refusal to cooperate in an investigation may be considered a violation of this Policy and may result in measures in accordance with Section 10.
11. Interaction with Authorities and Source Owners
11.1. - 11.11.
11.1. Lawful Requests from Authorities. Upon reasoned and legally binding requests from competent authorities, the Provider shall disclose the requested information to the extent required by law. If not prohibited by law or the request, the Provider will notify the Client of the request received and the scope of the data disclosed.
11.2. Judicial and Pre-trial Demands. Upon receipt of subpoenas, orders, rulings, or equivalent acts relating to the Client's Account, the Provider shall act within the legal obligation and, where possible, provide the Client with a reasonable period to independently protect its rights (motions, objections, withdrawal of the demand).
11.3. Claims from Source/Integration Owners. If data, platform, or integration owners have sent a claim to the Provider related to the Client's actions (violation of terms, licenses, limits, IP rights, or confidentiality), the Provider may: a) request information and explanations from the Client; b) temporarily restrict the relevant functions/integrations; c) forward the demands to the Client's contact persons for settlement; d) if necessary, remove/block the disputed material until the claim is resolved.
11.4. 'Notice and Takedown' Procedure.
11.4.1. The Provider accepts for consideration notifications of rights infringement (including IP and confidentiality rights) through the channels indicated on the Website.
11.4.2. The notification must contain sufficient information to identify the material/action, the right, and the basis of the applicant.
11.4.3. After a preliminary review, the Provider shall notify the Client and may temporarily restrict access to the material/functions.
11.4.4. The Client has the right to send reasoned objections/a counter-notification with supporting documents; based on the results of the review, access may be restored or the restriction maintained.
11.5. Minimization of Disclosure. In any interaction with third parties and authorities, the Provider strives to limit disclosure to only the necessary information, observing confidentiality and security requirements.
11.6. Preservation of Evidence. Upon a lawful request or during an incident investigation, the Provider may ensure the preservation of relevant logs and artifacts (legal hold). The Client undertakes to similarly secure the relevant data on its side and ensure its immutability.
11.7. Client's Cooperation. The Client undertakes to promptly provide information, documents, and technical assistance necessary for the settlement of claims from source/integration owners and the fulfillment of lawful demands of authorities, as well as to refrain from actions that hinder the review.
11.8. Costs and Damages. If the interaction with authorities or source owners is caused by the Client's violations, the Client shall reimburse the Provider for documented expenses (including legal fees, expert services, technical work) and damages in the manner and to the extent provided for in the UA.
11.9. Emergency Cases. In the event of an immediate threat to life, health, or a significant risk of damage to third parties, the Provider may immediately restrict access, transfer the necessary information to competent authorities, and notify the Client as soon as possible, if notification is not prohibited by law.
11.10. Cross-Border Interaction. For requests from foreign jurisdictions, the Provider acts in accordance with applicable law and international legal assistance mechanisms. The Client understands that the execution of such requests may require time and special procedures.
11.11. Contacts. The current addresses and channels for legal requests, notifications of violations, and related communications are indicated on the Website. The Provider may update them without amending this document.
11.2. Judicial and Pre-trial Demands. Upon receipt of subpoenas, orders, rulings, or equivalent acts relating to the Client's Account, the Provider shall act within the legal obligation and, where possible, provide the Client with a reasonable period to independently protect its rights (motions, objections, withdrawal of the demand).
11.3. Claims from Source/Integration Owners. If data, platform, or integration owners have sent a claim to the Provider related to the Client's actions (violation of terms, licenses, limits, IP rights, or confidentiality), the Provider may: a) request information and explanations from the Client; b) temporarily restrict the relevant functions/integrations; c) forward the demands to the Client's contact persons for settlement; d) if necessary, remove/block the disputed material until the claim is resolved.
11.4. 'Notice and Takedown' Procedure.
11.4.1. The Provider accepts for consideration notifications of rights infringement (including IP and confidentiality rights) through the channels indicated on the Website.
11.4.2. The notification must contain sufficient information to identify the material/action, the right, and the basis of the applicant.
11.4.3. After a preliminary review, the Provider shall notify the Client and may temporarily restrict access to the material/functions.
11.4.4. The Client has the right to send reasoned objections/a counter-notification with supporting documents; based on the results of the review, access may be restored or the restriction maintained.
11.5. Minimization of Disclosure. In any interaction with third parties and authorities, the Provider strives to limit disclosure to only the necessary information, observing confidentiality and security requirements.
11.6. Preservation of Evidence. Upon a lawful request or during an incident investigation, the Provider may ensure the preservation of relevant logs and artifacts (legal hold). The Client undertakes to similarly secure the relevant data on its side and ensure its immutability.
11.7. Client's Cooperation. The Client undertakes to promptly provide information, documents, and technical assistance necessary for the settlement of claims from source/integration owners and the fulfillment of lawful demands of authorities, as well as to refrain from actions that hinder the review.
11.8. Costs and Damages. If the interaction with authorities or source owners is caused by the Client's violations, the Client shall reimburse the Provider for documented expenses (including legal fees, expert services, technical work) and damages in the manner and to the extent provided for in the UA.
11.9. Emergency Cases. In the event of an immediate threat to life, health, or a significant risk of damage to third parties, the Provider may immediately restrict access, transfer the necessary information to competent authorities, and notify the Client as soon as possible, if notification is not prohibited by law.
11.10. Cross-Border Interaction. For requests from foreign jurisdictions, the Provider acts in accordance with applicable law and international legal assistance mechanisms. The Client understands that the execution of such requests may require time and special procedures.
11.11. Contacts. The current addresses and channels for legal requests, notifications of violations, and related communications are indicated on the Website. The Provider may update them without amending this document.
12. Liability and Limitations
12.1. Client's Liability. The Client is liable for all actions performed on the Platform through its Account (including the actions of the Client's Users and contractors), as well as for the compliance of such actions with this Policy, the UA, and applicable law.
12.2. Third-Party Violations. If claims from source owners, integrations, rights holders, or other third parties against the Provider are caused by the Client's actions/inaction (including violation of their terms, intellectual property rights, confidentiality, data use rules), the Client is obliged to settle such claims and reimburse the Provider for documented damages in the manner and to the extent established by the UA.
12.3. Client's Warranties. The Client warrants that: a) it has the necessary rights and legal grounds to process Client Data and transfer it to integrations; b) when distributing the Results externally, it complies with the requirements of the sources and the law; c) it does not use the Platform for prohibited purposes.
12.4. Limitation of Provider's Liability. The scope and limits of the Provider's liability are determined by the UA. The Provider is not liable for: a) the unavailability or failures of third-party integrations and services; b) the consequences of the external distribution of the Results by the Client; c) damage arising from the Client's violation of this Policy, the UA, or the terms of third parties.
12.5. Force Majeure. In cases of force majeure, the application of liability is governed by the UA. During the period of force majeure, the obligations to provide the Services may be suspended.
12.6. Rectification of Violations and Reimbursement. At the Provider's request, the Client is obliged to: a) cease the violation; b) delete/correct the disputed data or configurations; c) provide confirmation of the actions taken; d) reimburse the Provider for reasonable expenses related to the violation (legal, technical, communication) to the extent established by the UA.
12.7. Priority of Documents. With regard to the allocation of risks, limitations, and exemptions from liability, the provisions of the UA shall prevail. This section does not expand or reduce the liability of the parties beyond that established by the UA, but specifies it in relation to the Policy.
12.2. Third-Party Violations. If claims from source owners, integrations, rights holders, or other third parties against the Provider are caused by the Client's actions/inaction (including violation of their terms, intellectual property rights, confidentiality, data use rules), the Client is obliged to settle such claims and reimburse the Provider for documented damages in the manner and to the extent established by the UA.
12.3. Client's Warranties. The Client warrants that: a) it has the necessary rights and legal grounds to process Client Data and transfer it to integrations; b) when distributing the Results externally, it complies with the requirements of the sources and the law; c) it does not use the Platform for prohibited purposes.
12.4. Limitation of Provider's Liability. The scope and limits of the Provider's liability are determined by the UA. The Provider is not liable for: a) the unavailability or failures of third-party integrations and services; b) the consequences of the external distribution of the Results by the Client; c) damage arising from the Client's violation of this Policy, the UA, or the terms of third parties.
12.5. Force Majeure. In cases of force majeure, the application of liability is governed by the UA. During the period of force majeure, the obligations to provide the Services may be suspended.
12.6. Rectification of Violations and Reimbursement. At the Provider's request, the Client is obliged to: a) cease the violation; b) delete/correct the disputed data or configurations; c) provide confirmation of the actions taken; d) reimburse the Provider for reasonable expenses related to the violation (legal, technical, communication) to the extent established by the UA.
12.7. Priority of Documents. With regard to the allocation of risks, limitations, and exemptions from liability, the provisions of the UA shall prevail. This section does not expand or reduce the liability of the parties beyond that established by the UA, but specifies it in relation to the Policy.
13. Changes to the Policy and Entry into Force
13.1. Publication and Version. The current version of this Policy is published on the Platform's Website and contains a version identifier and publication date. The Provider maintains an archive of previous versions.
13.2. Procedure for Changes. The Provider may update the Policy to reflect changes in functionality, legal requirements, security, and integrations. The Client is notified of changes in one or more ways: by publication on the Website, a system notification in the interface, an e-mail to the Account contact, or another channel specified in the UA/documentation.
13.3. Entry into Force Timeframes. (i) For new Clients, the changes are effective from the moment of first access to the Platform after the publication of the updated version. (ii) For existing Clients, the changes enter into force after a reasonable period from the moment of notification (unless immediate measures for security/legislation are required). Continued use of the Platform after the effective date constitutes acceptance of the updated version.
13.4. Immediate Changes. If the updates are due to (i) requirements of the law/authorities, (ii) elimination of a critical security risk, (iii) termination/change of terms of third-party integrations, the relevant provisions may apply immediately with notification to the Client.
13.5. Conflicts of Documents. In case of conflicts between this Policy and other gro.now documents, the hierarchy established by the UA shall apply. Specialized documents (e.g., Research Policy, DPA, Security Policies) have priority in their subject area; for other matters, the current version of the Policy applies.
13.6. Ongoing Processes. Updates to the Policy apply to the current and future use of the Platform and ongoing processes (data storage/processing, operation of integrations). The Policy does not have retroactive effect with respect to fully completed actions before the effective date, except in cases expressly prescribed by law.
13.7. Versioning in Contracts. If a specific version of the Policy is specified in the UA/order/appendix, it is valid until the parties agree on the application of a new version in the manner provided for in the UA, or when the update is subject to mandatory application on the basis of paras. 13.3 – 13.4.
13.8. Feedback. The Client has the right to send comments on updates to the Policy through the communication channels indicated on the Website. Sending comments does not suspend the entry into force of the changes, unless otherwise expressly agreed with the Provider.
13.2. Procedure for Changes. The Provider may update the Policy to reflect changes in functionality, legal requirements, security, and integrations. The Client is notified of changes in one or more ways: by publication on the Website, a system notification in the interface, an e-mail to the Account contact, or another channel specified in the UA/documentation.
13.3. Entry into Force Timeframes. (i) For new Clients, the changes are effective from the moment of first access to the Platform after the publication of the updated version. (ii) For existing Clients, the changes enter into force after a reasonable period from the moment of notification (unless immediate measures for security/legislation are required). Continued use of the Platform after the effective date constitutes acceptance of the updated version.
13.4. Immediate Changes. If the updates are due to (i) requirements of the law/authorities, (ii) elimination of a critical security risk, (iii) termination/change of terms of third-party integrations, the relevant provisions may apply immediately with notification to the Client.
13.5. Conflicts of Documents. In case of conflicts between this Policy and other gro.now documents, the hierarchy established by the UA shall apply. Specialized documents (e.g., Research Policy, DPA, Security Policies) have priority in their subject area; for other matters, the current version of the Policy applies.
13.6. Ongoing Processes. Updates to the Policy apply to the current and future use of the Platform and ongoing processes (data storage/processing, operation of integrations). The Policy does not have retroactive effect with respect to fully completed actions before the effective date, except in cases expressly prescribed by law.
13.7. Versioning in Contracts. If a specific version of the Policy is specified in the UA/order/appendix, it is valid until the parties agree on the application of a new version in the manner provided for in the UA, or when the update is subject to mandatory application on the basis of paras. 13.3 – 13.4.
13.8. Feedback. The Client has the right to send comments on updates to the Policy through the communication channels indicated on the Website. Sending comments does not suspend the entry into force of the changes, unless otherwise expressly agreed with the Provider.
14. Miscellaneous Provisions
14.1. Applicable Law and Disputes. The law of the Republic of Kazakhstan applies to this Policy. The procedure for resolving disputes is determined by the UA; special procedures (e.g., regarding the content of sources/integrations) follow Sections 9 – 11 of the Policy.
14.2. Language Versions. This Policy may be provided in several languages. In case of discrepancy, the Russian version shall prevail, unless otherwise expressly provided for in the UA.
14.3. Communications and Notifications. Legally significant notifications between the Client and the Provider are carried out in the manner provided for in the UA (including publications on the Website, messages in the Platform's interface, and/or e-mail to the Account contact). Operational notifications on incidents and response measures are sent through the channels indicated in Sections 9 - 11 of the Policy.
14.4. No Waiver of Rights. The non-application or delay in the application of any measure shall not be considered a waiver by the Provider or the Client of the respective rights.
14.5. Severability. If any provision of this Policy is found to be invalid or unenforceable, this shall not affect the validity of the other provisions; the disputed provision shall be applied to the maximum extent permitted by law.
14.6. Subcontractors and Assignment of Rights. The Provider may engage subcontractors (including providers of cloud infrastructure and integrations) to implement the Policy and provide the Services, provided that the requirements of the UA and data protection agreements are met. The Client may not assign rights/obligations under the Policy to third parties without the Provider's consent, unless otherwise established by the UA.
14.7. Reference Materials. Guides, best practices, technical documentation, and other materials on the Website are for explanatory purposes and apply insofar as they do not contradict the UA and this Policy.
14.2. Language Versions. This Policy may be provided in several languages. In case of discrepancy, the Russian version shall prevail, unless otherwise expressly provided for in the UA.
14.3. Communications and Notifications. Legally significant notifications between the Client and the Provider are carried out in the manner provided for in the UA (including publications on the Website, messages in the Platform's interface, and/or e-mail to the Account contact). Operational notifications on incidents and response measures are sent through the channels indicated in Sections 9 - 11 of the Policy.
14.4. No Waiver of Rights. The non-application or delay in the application of any measure shall not be considered a waiver by the Provider or the Client of the respective rights.
14.5. Severability. If any provision of this Policy is found to be invalid or unenforceable, this shall not affect the validity of the other provisions; the disputed provision shall be applied to the maximum extent permitted by law.
14.6. Subcontractors and Assignment of Rights. The Provider may engage subcontractors (including providers of cloud infrastructure and integrations) to implement the Policy and provide the Services, provided that the requirements of the UA and data protection agreements are met. The Client may not assign rights/obligations under the Policy to third parties without the Provider's consent, unless otherwise established by the UA.
14.7. Reference Materials. Guides, best practices, technical documentation, and other materials on the Website are for explanatory purposes and apply insofar as they do not contradict the UA and this Policy.