Data Policy

1. Introduction and Scope

This Data Policy (the “Policy”) sets forth the practices of Eco System, Inc., a Michigan corporation (together with its affiliates, successors and assigns, the “Company,” “we,” “us” or “our”), with respect to the collection, storage, security, processing, use, analysis and disclosure of data in connection with the Company’s subscription platform, software, hosting and related professional services (collectively, the “Subscription Service”).

This Policy constitutes the “Data Policy” referenced in Section 10.4 (Confidential Information) of the Company’s Service Agreement and in any related order form, addendum, project estimate or scope of professional services (collectively, the “Agreement”). It is incorporated into, and forms part of, the Agreement. Capitalized terms used but not defined in this Policy have the meanings given to them in the Agreement.

By accessing or using the Subscription Service, or by permitting any user, employee or customer to do so, the Client acknowledges that it has read and understood this Policy.

The practices described in this Policy, including the Company’s industry research, artificial intelligence and data licensing programs described in Sections 6 through 9 (the “Data Programs”), apply to all clients and to all Client Data, Customer Information and Platform Data processed through the Subscription Service.

In the event of a conflict between this Policy and any applicable law, the law shall control to the extent of the conflict, and this Policy shall be construed to give effect to the Company’s rights to the fullest extent permitted by that law.

2. Definitions

For purposes of this Policy, the following terms have the meanings set forth below:

  • “Client Data” means all data, records, files, images, documents and other content submitted, uploaded, entered, generated or stored by or on behalf of a Client through the Subscription Service, including Customer Information.
  • “Customer Information” has the meaning given in Section 10.4 of the Agreement and includes information generated by or relating to the users, customers, sellers, suppliers, vendors and counterparties of a Client.
  • “Platform Data” means data generated by or about the operation and use of the Subscription Service, including log files, system metadata, configuration data, performance metrics, feature-usage data, workflow and transaction-flow data, device and browser information, and records of user interactions with the Subscription Service, but excluding the substantive content of Client Data and Customer Information (such as the names, identification details, images and transaction contents relating to a Client’s customers).
  • “Aggregated Data” means data that has been compiled, combined or summarized from the Client Data or Platform Data of one or more clients, users or sources, such that it is not presented in a form intended to identify a particular Client.
  • “De-Identified Data” means data from which the Company, or a person acting on its behalf, has removed, masked, generalized, tokenized, hashed, replaced or otherwise transformed direct identifiers, by anonymization, pseudonymization or comparable techniques, as further described (and subject to the limitations set forth) in Section 9.
  • “Derived Data” means any data, statistics, metrics, analyses, insights, benchmarks, indices, models, model weights, embeddings, data sets, compilations or other information or materials created, derived or inferred by or for the Company from Client Data or Platform Data, including Aggregated Data and De-Identified Data.
  • “Data Recipient” means any third party to whom the Company provides, discloses, licenses, transfers or otherwise makes available Derived Data, including research partners, technology and analytics partners, artificial intelligence and machine learning developers, commercial data partners, data aggregators, data brokers and their respective licensees, sublicensees, successors and assigns.
  • “Applicable Law” means all laws, statutes, regulations and binding governmental requirements applicable to the relevant party and processing activity.
  • “Program Data” means all Client Data (including Customer Information), Platform Data and Derived Data.

3. Security and Storage of Customer Information

Consistent with Section 10.4 of the Agreement, the Company takes commercially reasonable administrative, technical and physical measures designed to protect Customer Information against unauthorized access, use or disclosure to any unauthorized or unlicensed third party. Such measures may include, as the Company deems appropriate from time to time, role-based access controls, authentication requirements, encryption of data in transit and, where practicable, at rest, network segmentation, logging and monitoring, backup and redundancy procedures, and the use of reputable hosting and infrastructure providers.

Client Data may be stored and processed on servers owned or operated by the Company or by its hosting, cloud infrastructure and other service providers, which may be located in the United States or in such other jurisdictions as the Company may select. The Company may replicate, back up, migrate, archive and restore Client Data across systems and locations as reasonably necessary for the operation, continuity and security of the Subscription Service.

No method of transmission or storage is completely secure. Consistent with Section 16 of the Agreement, the Company does not warrant that the Subscription Service, or any data stored within it, will be secure from or immune to unauthorized access, hacking, malware or similar threats, and the Company’s obligations under this Section are limited to the exercise of commercially reasonable care.

A disclosure of data made in accordance with this Policy, including any disclosure of Program Data to a Data Recipient as described in Sections 6 through 8, is an authorized disclosure and does not constitute an unauthorized disclosure for purposes of Section 10.4 of the Agreement.

4. Access for Operation, Testing and Maintenance

The Client acknowledges and agrees that the Company and its personnel, contractors and service providers may access, view, copy, process and otherwise handle Client Data, including Customer Information, as reasonably necessary or useful to:

  1. provision, host, operate, administer and support the Subscription Service;
  2. develop, test, stage, debug, troubleshoot, validate, upgrade and deploy software, features, integrations and infrastructure, including through the use of copies of production data in testing and staging environments;
  3. maintain, monitor, secure, back up, restore and migrate servers, databases and related systems;
  4. respond to support requests, investigate incidents, and detect, prevent or address fraud, abuse, security events or technical issues; and
  5. perform the Company’s obligations and exercise its rights under the Agreement and this Policy.

Access for these purposes is limited to personnel and providers who require it in the performance of their duties and who are bound by confidentiality obligations no less protective than those set forth in the Agreement.

5. Platform Analytics and Service Improvement

The Company may collect, generate, compile and analyze Platform Data and Client Data, and may run queries, reports and other analyses against its databases and systems, in order to assess and understand, without limitation:

  • the extent, frequency and manner in which the Subscription Service and its features are used;
  • the categories, volume and structure of data stored within the Subscription Service, and how and where such data is stored;
  • the flow, sequencing, timing and outcomes of transactions, workflows and processes conducted through the Subscription Service; and
  • system performance, capacity, reliability and security.

The Company uses the results of such analyses to operate, maintain, improve, enhance and expand the Subscription Service and to develop new services, features and functionality. Platform Data, and all reports and analyses described in this Section, are the property of the Company.

6. Aggregated, De-Identified and Derived Data; Industry Research

The Company may use, reproduce, aggregate, combine, de-identify, analyze, modify and create Derived Data from Program Data, and may use, reproduce, distribute, disclose, license, sell, transfer, commercialize and otherwise exploit Program Data and such Derived Data for any lawful purpose, during and after the term of the Agreement.

The Client grants the Company a worldwide, royalty-free, fully paid-up, transferable and sublicensable right and license to use Client Data and Customer Information for the purposes described in Sections 6 through 9 during the term of the Agreement, together with a perpetual and irrevocable right to continue to use, license and exploit Derived Data created, and data disclosed to Data Recipients, during that term.

Without limiting the foregoing, the Company may aggregate and analyze Program Data across its client base, together with data obtained from other sources, in order to identify, measure, model and report on trends, pricing, volumes, material flows, market conditions, regional activity, operational practices and other characteristics of the recycling, scrap metal, and related commodities and materials-recovery industries, and may publish, distribute or commercialize the resulting research, benchmarks, indices and insights.

As between the Company and the Client, the Company owns all right, title and interest in and to Derived Data created in accordance with this Policy. Such Derived Data is not Customer Information or Confidential Information of the Client, and the Company’s rights in Derived Data survive the expiration or termination of the Agreement and any return or deletion of Client Data.

7. Machine Learning and Artificial Intelligence

The Company may use Program Data and Derived Data created from it, and may license, provide or otherwise make such data available to Data Recipients, for the purpose of developing, training, fine-tuning, evaluating, testing, benchmarking and improving machine learning models, large language models, and other artificial intelligence systems of any kind or capability, whether now known or later developed (collectively, “AI Systems”), including AI Systems owned or operated by third parties.

The Client acknowledges that information used to train an AI System may become embedded in or reflected by that system’s parameters or outputs, and that such information generally cannot be extracted, isolated or deleted from a trained AI System once training has occurred. The Company has no obligation to retrain, modify, withdraw or destroy any AI System, or any output of an AI System, in connection with the termination of the Agreement or any request to return or delete Client Data. All AI Systems, model weights and outputs developed by or for the Company are the sole property of the Company or its licensors.

8. Data Licensing and Commercial Data Partners

The Company may compile Program Data and Derived Data created from it into data sets, data products, feeds and compilations, and may license, sell, transfer, disclose or otherwise make them available to Data Recipients, including commercial data partners, data aggregators and data brokers, for monetary or other consideration. Data Recipients may in turn use, combine, resell, sublicense or redistribute such data in accordance with their agreements with the Company and Applicable Law.

The Company determines, in its sole discretion, the selection of Data Recipients, the content and format of any data set, the terms and pricing of any license or transfer, and the permitted uses granted to any Data Recipient. The Client is not entitled to any notice of, approval over, compensation for or share in any revenue arising from such arrangements.

The Company may also disclose or transfer Client Data, Platform Data and Derived Data (i) to its affiliates; (ii) to a successor or acquirer, or to prospective counterparties and their advisors, in connection with any merger, acquisition, financing, reorganization, sale of assets or similar transaction, consistent with Section 22 (Assignment) of the Agreement; and (iii) as required by Applicable Law, subpoena, court order or governmental request, subject to Section 10.4 of the Agreement.

9. De-Identification and Its Limitations

Before Derived Data is disclosed to a Data Recipient, the Company, or the Data Recipient on the Company’s behalf or upon receipt or collection, will make reasonable efforts to anonymize, pseudonymize or otherwise de-identify personal information and Client-identifying information contained in that data, using techniques the Company or such Data Recipient considers appropriate in the circumstances.

The Client acknowledges that de-identification is not guaranteed and may not be permanent. De-identified, pseudonymized and aggregated data may, through combination with other data sets, advances in technology or analytical methods, or the acts of third parties, be re-identified or linked to a particular Client, individual, location or transaction. The Company makes no representation or warranty that any data will remain anonymous or de-identified, and does not control the methods or data sources used by Data Recipients after disclosure.

10. Data Recipients; Disclaimers; Limitation of Liability

Data Recipients are independent third parties and are not agents, subcontractors or processors of the Company in respect of their own use of data. Each Data Recipient is solely responsible for its own collection, use, combination, re-identification, disclosure, resale and protection of data received from the Company, and for its own compliance with Applicable Law.

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, THE COMPANY SHALL HAVE NO RESPONSIBILITY OR LIABILITY, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, STATUTE OR OTHERWISE, FOR (A) ANY ACT OR OMISSION OF ANY DATA RECIPIENT OR ITS LICENSEES, SUBLICENSEES OR DOWNSTREAM RECIPIENTS; (B) ANY RE-IDENTIFICATION OF DE-IDENTIFIED OR AGGREGATED DATA BY ANY PERSON OTHER THAN THE COMPANY; (C) ANY OUTPUT, BEHAVIOR OR USE OF ANY AI SYSTEM DEVELOPED OR TRAINED IN WHOLE OR IN PART WITH DATA DESCRIBED IN THIS POLICY; OR (D) ANY OTHER CONSEQUENCE, DIRECT OR INDIRECT, OF ANY USE OR DISCLOSURE OF DATA MADE IN ACCORDANCE WITH THIS POLICY.

All uses and disclosures described in this Policy are subject to the warranty disclaimers and limitations of liability set forth in Sections 16 and 17 of the Agreement, which apply to this Policy as if fully set forth herein. Nothing in this Policy excludes or limits any liability that cannot be excluded or limited under Applicable Law.

11. Client Responsibilities and General Provisions

Client notices and consents. The Client is solely responsible for providing all notices to, and obtaining all consents and authorizations from, its users, customers, sellers, employees and other individuals as required by Applicable Law for the Company to collect, process, use and disclose Client Data as described in this Policy. The Client represents and warrants that it has done so, and shall indemnify and hold harmless the Company from any claim arising from its failure to do so, consistent with Sections 6 and 15 of the Agreement.

Sensitive information. Unless otherwise agreed in writing, the Company does not include in any data set licensed to a Data Recipient biometric identifiers (including fingerprints and thumbprints), government identification numbers, financial account numbers or other categories of information whose sale or disclosure is prohibited or restricted by Applicable Law, except to the extent such disclosure is permitted by that law.

Retention. The Company retains Client Data for the term of the Agreement and thereafter for such period as is reasonably necessary for backup, legal, accounting, dispute-resolution and operational purposes, after which it is deleted or de-identified in the ordinary course. Derived Data, and any data previously disclosed to Data Recipients, may be retained indefinitely and is not subject to return or deletion.

Changes to this Policy. The Company may update this Policy from time to time. The revised Policy will be posted on the Company’s website with a new effective date. Material changes that expand the Company’s rights in Client Data will be communicated to the Client by email or through the Subscription Service and will take effect thirty (30) days after such notice is given, unless a later date is stated in the notice.

Contact. Questions regarding this Policy may be directed to: Eco System, Inc., 3000 Town Center, Suite 1805, Southfield, MI 48075