Legal
Module D: Personal information
This is the full text of the current Module D: Personal information. It is published, not click-accepted: a purchase records the version in effect at the sale by its SHA-256, and the Order License of an order attaches it. You can request an earlier version from support@graunt.com.
sha256:9da2436208197889bf3c7a2b8a8083d42445d76c3c80b20af0ed70153078dee0
# Graunt — Marketplace License, Module D: Personal information **Version:** 1.0 | **Effective:** October 31, 2026 | **Status:** Operational terms. **Governs:** Content that contains personal information: people on camera or on a recording, business records with people's details, a company's workplace records, and listings whose personal details were removed or replaced with placeholders. Part of the Marketplace License (graunt.com/legal/marketplace-license) for content of this kind. --- ## 1. What this module covers This module applies to every listing whose content contains personal information, as the listing's recorded rights declare it, including content that shows or records people. It adds to §8 of the Marketplace License; where it is more specific, it governs for this content. Words have the meanings the Marketplace License gives them, and "personal information" has the meaning the privacy laws that apply to you give it. ## 2. Roles For the personal information in the content, the seller and you are each a separate controller, or business, under the laws that apply. The seller makes the information available to you for the purposes recorded with your entitlement; you decide how you use it within those purposes, and neither of you processes it on the other's behalf. Where the content came to the seller from the people it describes, the seller is responsible for the consent and notice the law required of it when it collected and recorded the content, and the Enterprise and Video License Addendum says what the seller warrants about that on the sales it covers. ## 3. The purposes, and no further sale The seller sells or discloses the personal information to you only for the limited and specified purposes recorded with your entitlement: the purposes §2 of the Marketplace License names that the listing allows. You use it only for those purposes. You do not sell the personal information, share it for cross-context behavioral advertising, or disclose it to anyone except your affiliates, staff and contractors under §5 of the Marketplace License, and your client under §6 where the listing allows one, each for the same purposes. **Decisions about people.** You do not use the content as a factor in deciding whether a person is eligible for credit, insurance, employment, housing or a government benefit. The content is not a consumer report, and neither the seller nor Graunt provides it for that purpose. ## 4. Your duties 1. You comply with the privacy and data-protection laws that apply to you, and you give the personal information at least the level of privacy protection those laws require of the seller. 2. You keep the personal information under reasonable technical and organizational security, limit access to the people and systems that need it, and tell the seller, through Graunt at support@graunt.com, without undue delay of a breach of that security affecting it. 3. You tell the seller, through Graunt, if you can no longer meet these obligations. 4. You let the seller, on notice through Graunt, take reasonable steps to make sure you use the information in line with these obligations, and to stop and remedy any use that is not. 5. Where a person asks the seller, or asks Graunt, to exercise a right the law gives them over information in the content, and the request reaches you through Graunt, you act on it within 30 days as the law requires of you, and you tell Graunt what you did. 6. Where the law requires you to tell the people described in the content that you hold it, or to have a lawful basis for processing it, you do so on your own account; the seller's disclosures do not stand in for yours. 7. Where you transfer the personal information outside the country it came from, you meet the conditions the law sets for that transfer. Where the law requires a transfer mechanism, such as the standard contractual clauses the European Commission or the United Kingdom has approved for transfers between controllers, you and the seller put it in place before the transfer, and Graunt passes the documents between you. 8. You keep the personal information only as long as your purposes for it need, you keep a record of your processing as the law requires of you, and you delete the personal information when the Marketplace License ends if that comes first, as §10 of the Marketplace License says. 9. A model that can output a person's personal information from the content holds that information, and your duties under this module apply to it. ## 5. No re-identification You do not try to identify a person whose details were removed from the content or replaced with placeholders, and you do not combine the content with other data to identify anyone in it. A listing marked as having its personal details removed is not anonymous: the seller removed the identifiers it found, placeholders stand for the people and companies it replaced, and you treat what remains as personal information. ## 6. What the content never contains The content does not contain biometric identifiers or templates, health information protected by law, genetic data, consumer reports, government identifiers, full payment or bank account numbers, account log-in credentials together with the password or code that opens the account, bulk identity records, records that set out a person's citizenship or immigration status, records that set out a person's racial or ethnic origin, religious or philosophical beliefs, political opinions, union membership, sex life or sexual orientation other than as §7 allows, or personal information about anyone under 16 other than people on camera listed as the video and people-on-camera module allows. What can be seen or heard of a person on camera or on a recording is governed by the video and audio modules, not by this list. If you find any of these in the content, you do not use them and you tell Graunt. **Precise location and private messages.** A listing declares when its content holds precise location, such as GPS data recorded with footage, or the contents of private messages, such as a company's workplace email. You treat that information as sensitive personal information under the laws that apply to you, you use it only for the purposes recorded with your entitlement, and you do not use it to find, follow or contact anyone. ## 7. Special categories A listing states, as its seller declares, whether its content reveals a person's health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, sex life or sexual orientation. Where it does and the GDPR or a law like it governs that information, the seller holds each person's explicit consent for the uses the Marketplace License grants, and you use that information only as the law allows you. ## 8. People on camera and on recordings The video and people-on-camera module and the audio and voice module say what you may and may not do with content that shows or records people, including the uses no listing permits, and §7 of the Marketplace License says what you do when a person withdraws consent. Nothing in a release lets you identify a person, build biometric identification, or reproduce a person's likeness or voice. --- ## Version History | Version | Date | Changes | |---------|------|---------| | 1.0 | October 31, 2026 | Initial version, published with Marketplace License 2.0: the roles of seller and buyer as separate controllers; the limited and specified purposes, no further sale or sharing, and no use in decisions about a person's eligibility for credit, insurance, employment, housing or a benefit; the buyer's duties, including the terms a sale of personal information requires under the laws of California and other states, security and breach notice, requests from the people described, the buyer's own lawful basis and notices, transfer mechanisms, keeping the information only as long as needed, and models that can output it; no re-identification; what the content never contains, with precise location and private messages declared and protected; special categories declared and consented; people on camera and on recordings. |