Terms of Service
These Terms govern the supply of Gravito’s services to your organisation. Please read them before using the Service.
1. Parties and agreement
These Terms are between Gravito Oy (in English, Gravito Ltd), Business ID 2891268-5, Lapinlahdenkatu 16, 00180 Helsinki, Finland (“Gravito”, “we”, “us”), and the organisation that orders or uses the Service (“you”, “Customer”).
These Terms, the offer you accept or other order documentation, and the applicable data processing agreement together form the agreement between us. Where your offer, an order form, a framework agreement or a statement of work signed by both of us conflicts with these Terms, that document takes precedence to the extent of the conflict.
The Service is provided to organisations. It is not offered to consumers, and consumer protection legislation does not apply. You confirm that you are acting for a business and are authorised to bind your organisation.
2. Definitions
- Service: the Gravito software, platform and related services described in your offer or order documentation
- Order documentation: the offer you accept, and any order form, framework agreement or statement of work agreed between us
- Customer Data: data that you, or anyone acting for you, provide to or generate through the Service, including personal data relating to visitors to your websites and applications
- End User: a visitor to a website or application on which you operate the Service
- Documentation: the technical documentation we make available for the Service
- Data processing agreement: the agreement governing our processing of personal data on your behalf, as described in section 8
3. The Service
Two ways to use the Service.
- A basic installation, such as the Gravito CMP plugin for WordPress. You create and publish your configuration in the Gravito Configurator and maintain it yourself. A basic installation loads one configuration for every visitor and does not include onboarding, our team’s consulting, or monitoring and optimisation.
- A plan built with our team. We set up the first configuration with you, including the regulatory configuration described in Schedule 1. Your plan includes onboarding and our team’s consulting after launch. After launch you choose whether you maintain the settings yourself, we maintain them, or we share the work.
What your plan includes is set out in your order documentation. Implementation is a one-time fee, scoped per engagement. Dedicated infrastructure, service levels, network, white-label, partner and reseller arrangements, and other custom arrangements apply only where they are agreed in your order documentation.
Availability and change. We may modify or discontinue parts of the Service. Where a change materially reduces functionality you rely on, we will give you thirty days’ written notice. Where a framework or the law requires a change sooner, we give as much notice as we reasonably can.
Updates. We follow the industry frameworks the Service implements at their source, and we make the framework-level updates to the Service ourselves. We tell you about major updates in advance. Minor fixes are released regularly; their version history is available on request or in our administration tools, depending on the product and service you use. Changes to how your decisioning layer is set up, and to text or anything else customised for you, are made only as agreed with you. This is the standard service: where we agree them with you, you get more proactive updates.
4. Fees and payment
Prices shown on our website are indicative. The price that applies to you is the one set in your offer. If something about your sites should affect the price, tell us and we will take it into account in the offer.
Fees are as set out in your order documentation. Unless stated otherwise, fees exclude value added tax and other applicable taxes, which are charged in addition.
Unless your order documentation states otherwise, fees are invoiced annually, twelve months in advance. Invoices are payable within the payment term stated in your order documentation or on the invoice. If an invoice is overdue we may, after giving you written notice and a reasonable opportunity to pay, suspend the Service until payment is received.
Where we agree to make the Service available to you on a trial basis, the trial ends on the date we confirm to you, and these Terms apply during it.
5. Your responsibilities
You are responsible for:
- The lawfulness of your own processing. You determine the purposes and means of processing End User personal data through the Service. You are the controller for it
- The regulatory decisions described in Schedule 1, including which territories you operate in, which frameworks apply, which legal bases you rely on, and how your consent experience is worded and presented
- The configuration you publish yourself. Where you set up or maintain a configuration yourself, including in a basic installation, its content and its effect on your sites are yours
- The accuracy of what you tell us, including domains, territory scope and configuration instructions
- Your own privacy notice and your relationship with your End Users. Your privacy notice, not ours, describes the processing carried out on your sites
- Account security, including credentials issued to your people, and telling us promptly of any suspected unauthorised use
- Your obligations under any industry framework you join, including IAB frameworks. Membership, registration and the assertions made under those frameworks are yours
You will not: access the Service by automated means without our permission; circumvent access controls; place an unreasonable load on our infrastructure; resell or make the Service available to third parties except as agreed; or use the Service unlawfully.
6. Our responsibilities
We will:
- Provide the Service with reasonable skill and care, in accordance with the Documentation and your order documentation
- Process personal data on your behalf only on your documented instructions, as set out in the data processing agreement
- Where your plan includes set-up by our team, configure the Service to the regulatory decisions you make, as described in Schedule 1
- Maintain appropriate technical and organisational security measures
- Tell you without undue delay if we become aware of a personal data breach affecting Customer Data, in accordance with the data processing agreement
What we do not do. Our consulting covers how the Service is configured and how it behaves in your stack. It is not legal advice. We do not decide whether your processing is lawful, which framework you must operate, or which legal basis you may rely on. Where we describe how the Service behaves, that is a technical description and not a representation that a given configuration makes you compliant with any law.
7. Customer Data
You, your affiliates and your customers retain all rights in Customer Data. Customer Data is your confidential information.
Our limited right to use anonymised data. We may anonymise Customer Data and use the resulting anonymised data to compile statistics about your use of the Service, and to monitor, support and improve the Service. Anonymised data does not identify you, your End Users or your organisation.
We do not analyse the Customer Data itself across customers. We do not match or link one customer’s Customer Data with another customer’s. Any figure that spans customers, such as an average volume or rate, is compiled only from the statistics already compiled for each customer, and identifies neither a customer nor any person. We publish figures about an individual customer only as agreed with that customer.
8. Data protection
We process personal data in two distinct roles.
As controller. When your people hold accounts in our tools, contact us, or otherwise deal with us, we decide the purposes and means. That processing is described in our Privacy Notice at gravito.net/privacy-notice/.
As processor. When the Service processes personal data about your End Users, you are the controller and we act on your documented instructions. That processing is governed by a data processing agreement, which forms part of this agreement:
- Gravito CMP as we run it as a service, on our backend and served from our content delivery network, including a basic installation: our standard data processing agreement, provided with your offer and available on request
- Customised setups and Gravito Data Platform: the data processing agreement made with you during the contract and onboarding process
9. Confidentiality
Each party will keep the other’s confidential information confidential, use it only for the agreement, and protect it with at least reasonable care. This does not apply to information that is public through no breach, independently developed, or required to be disclosed by law, in which case the disclosing party will notify the other where lawful.
10. Intellectual property
We and our licensors own all rights in the Service. You receive a non-exclusive, non-transferable right to use the Service for your internal business purposes during the term, subject to these Terms.
“Gravito” and the Gravito logo are our trademarks and may not be used without our written permission.
Where you give us feedback or suggestions, we may use them without restriction or compensation. This does not give us any right in Customer Data or your confidential information.
11. Warranties and disclaimers
We warrant that we will provide the Service with reasonable skill and care.
Except as expressly stated, and to the extent permitted by law, the Service is provided as is, and we disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the Service will be uninterrupted or error free. Service levels apply only where they are agreed in your order documentation.
We give no warranty that your use of the Service makes you compliant with any law or industry framework. Compliance depends on decisions you make, described in section 5 and Schedule 1.
12. Liability
Neither party excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, wilful misconduct, or anything else that cannot lawfully be excluded.
Neither party is liable for indirect, incidental, special or consequential loss, or for loss of profit, goodwill or anticipated savings.
Each party’s total aggregate liability under this agreement is limited to the fees paid or payable by you for the twelve months preceding the event giving rise to the claim. This limit does not apply to your obligation to pay the fees.
13. Term, termination and what happens to your data
The term is as set out in your order documentation.
Either party may terminate for material breach that is not remedied within thirty days of written notice, or immediately if the other becomes insolvent.
On termination:
- Your right to use the Service ends
- You may request a copy of your Customer Data before termination takes effect, or within thirty days after it. We will provide it in a structured, commonly used, machine-readable format
- After that period we delete Customer Data in accordance with the data processing agreement, except where we are legally required to retain it
- Account and commercial records are retained as described in the Privacy Notice, for statutory accounting and tax purposes
14. Changes to these Terms
We may update these Terms. The current version is at gravito.net/terms-and-conditions/ and shows its effective date. Where a change materially affects your rights we will give you thirty days’ written notice before it takes effect. Where you have signed order documentation, changes take effect at renewal unless we agree otherwise.
15. Governing law and disputes
These Terms are governed by the laws of Finland, without regard to conflict of laws principles.
Any dispute arising out of or relating to these Terms will be finally settled by arbitration under the Arbitration Rules of the Finland Chamber of Commerce. The seat is Helsinki, the number of arbitrators is one, and the language is English.
16. General
Neither party may assign without the other’s written consent, except to an affiliate or in connection with a merger or sale of substantially all assets.
If a provision is invalid or unenforceable, it is severed and the rest remains in effect. A failure to enforce is not a waiver. Provisions that by their nature should survive termination will do so.
17. Contact
support@gravito.net, or by post to Gravito Oy, Lapinlahdenkatu 16, 00180 Helsinki, Finland.
Schedule 1: Regulatory frameworks and division of responsibility
This schedule answers the question a customer operating in more than one territory will ask: what does the Service do about differing privacy regimes, and who is responsible for what.
1. The division, stated plainly
| You decide | We do | |
|---|---|---|
| Which territories your traffic comes from and which matter | ✔ | |
| Whether a given law applies to your business | ✔ | |
| Which framework operates in which territory | ✔ | |
| Which legal basis you rely on, and for which purposes | ✔ | |
| The wording, layout and language of your consent experience | ✔ (in a plan, we draft and advise) | |
| Configuring the Service to those decisions | In a basic installation, you | In a plan, we set up the first configuration with you |
| Generating and publishing the resulting signals to your downstream systems | ✔ | |
| Storing the choices your End Users make, so they apply on later visits | ✔ |
The decisioning layer is part of the plans built with our team. We configure it with you during implementation; it is not set up by you alone. A basic installation loads the one configuration you select, for every visitor, wherever they are.
2. What the Service can operate
In a plan with the decisioning layer, the Service can operate a different framework per territory within a single deployment:
| Framework | Typical use | What the Service produces |
|---|---|---|
| IAB TCF | EEA and UK traffic, and other territories where you choose to run it | A TCF consent string, published through the standard framework API for your vendors and demand partners to read |
| IAB GPP, with US state sections | United States traffic | A GPP string, carrying a state-specific section where the Service generates one for the visitor’s state |
| Standard categories | Territories where you want a consent experience without an industry framework, and properties with no demand chain | Category-level consent state published to your own systems |
| No banner | Territories where you determine none is required | No consent experience shown |
Territory. The Service applies the configuration you have chosen for the region that your website supplies to it, typically from your content delivery network. The Service does not determine the visitor’s location itself, and the region supplied may not be correct for every visitor. Where you offer visitors the ability to correct their region, the consequences of that choice are a matter for your own configuration and disclosure.
3. What this schedule does not say
It is not a statement that any configuration makes you compliant. Frameworks are technical instruments for expressing and transmitting choices. Whether your processing is lawful depends on decisions you make and on advice you take.
It is not monitoring of the law on your behalf. We keep the Service up to date with the frameworks it implements, as described in section 3. We do not undertake to tell you when a law changes in a territory you operate in, unless we agree a wider service with you.
4. Industry framework membership
Where a framework requires registration, membership or the making of assertions by the party operating a website, those obligations are yours. Gravito’s own registrations cover Gravito’s own role and do not extend to you.
These Terms replace all previous versions, which are available on request from support@gravito.net.