Orion Terms of Service

Last update:

July 31, 2026

SERVICES
1. Purpose. This Agreement shall govern the access to and use of the TRM Labs-provided platform “Orion” by Customer’s Authorized Users (as defined below) in order to conduct searches on available data.
2. The Services: Subject to the terms and conditions of this Agreement and any relevant Order Forms, during the Term, Company hereby grants Customer and Authorized Users a non-exclusive, non-sublicensable, non-transferable, worldwide right to access and use Orion as stipulated in each applicable Order Form, solely for legitimate business purposes, which may include conducting investigations which involve the creation or provision of data, analysis, findings, reports or other written materials generated in connection with Customer’s use of Orion (such reports, the “Orion Reports”). The Company’s provision of such access to Orion under this Agreement as stipulated in each applicable Order Form, and any related websites, applications, tools, and services, are referred to as the “Services”.
3. Third Party Dataset Terms. Company may make available datasets provided by third-party data providers (“Third-Party Datasets”). Access to and use of any Third-Party Datasets by Customer shall be conditioned on (i) Customer’s prior acceptance of, and ongoing compliance with, all additional terms and conditions, end user license terms, and usage restrictions imposed by the applicable third-party data provider (collectively, “Third-Party Terms”), and (ii) Company’s continued right to make such Third-Party Datasets available. Customer shall not be entitled to access or use any Third-Party Datasets unless and until it has accepted the applicable Third-Party Terms, and Customer’s continued access is expressly conditioned on Customer’s ongoing compliance with such Third-Party Terms. Customer is solely responsible for reviewing, understanding, and complying with all applicable Third-Party Terms. In the event of a conflict between this Agreement and the applicable Third-Party Terms solely with respect to Customer’s permitted use of a Third-Party Dataset, the Third-Party Terms shall, solely to the extent of the conflict, prevail over this Agreement and govern Customer’s use of that Third-Party Dataset.
PLATFORM ACCESS AND AUTHORIZED USERS; RESTRICTIONS AND RESPONSIBILITIES
1. Administrative Users. During the configuration and set-up process for each access to Orion, Customer will identify an administrative user, with associated username and password for Customer’s Company account.
2. Authorized Users. Customer may allow the specified number of Customer’s employees and/or independent contractors as is indicated on an Order Form to use Orion on behalf of Customer as “Authorized Users,” solely in accordance with this Agreement and the applicable Acceptable Use Policy (as defined below). Customer shall provide the email addresses and association to Customer of any Authorized User to Company in a format acceptable to Company. Authorized User subscriptions are for designated Authorized Users and cannot be shared or used by more than one Authorized User, but may be reassigned to new Authorized Users replacing former Authorized Users who no longer require ongoing use of Orion. As a condition to access and use Orion each Authorized User shall at all times agree to abide by the terms of this Agreement and any acceptable use policy, end user license terms, or other similar materials provided by the Company from time to time (“Acceptable Use Policy”) at all times, and Customer shall be responsible for compliance with the terms of this Agreement by any individual who accesses Orion through credentials granted to the Customer, and for all activity that occurs under its Orion subscriptions, whether performed by Authorized Users or others who access Orion through Customer’s credentials or systems. Customer is responsible for keeping its Authorized Users’ login credentials confidential. Customer shall immediately notify Company of any actual or suspected violation of any terms of the Agreement by any Authorized User or any unauthorized access to Orion, and shall be liable for any breach of this Agreement as a result of such unauthorized access. Customer shall use commercially reasonable efforts to cause Authorized Users to be, at all times, educated and trained in the proper use and operation of Orion to ensure that Orion is used in accordance with applicable manuals, instructions, specifications and documentation provided by Company from time to time.
3. Use Restrictions. Customer shall not, and shall not permit any Authorized User or third party to:
  1. access or use Orion or the Services except as expressly permitted under this Agreement;
  2. reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code or underlying structure of Orion or any related software, algorithms, models, data, datasets or other technology or systems (collectively, “Software”);
  3. modify, translate, or create derivative works of the Orion technology or any related Software;
  4. extract, use, or disclose data from Orion except through its intended functionality and solely for Customer’s internal business purposes; provided that any sensitive data, including geolocation data, IP addresses, or personally identifiable information, may not be disclosed to any third party without TRM’s prior written review and approval;
  5. copy, modify, host or frame Orion except as expressly permitted in writing by TRM;
  6. permit any unauthorized third party, including any TRM competitor, to access or use Orion or the Services;
  7. use Orion or any related Software to build or assist in building a competing product or service, for benchmarking purposes, or to train, fine-tune or improve any machine-learning models, generative AI systems or similar tools;
  8. circumvent security measures or remove proprietary rights notices; or
  9. use the Services in violation of applicable economic sanctions laws of the United States, European Union, or United Kingdom.
4. Customer Compliance. Customer shall only use, and will ensure that all Authorized Users only use Orion in full compliance with this Agreement for legitimate business purposes and in accordance with all applicable laws and regulations. Customer represents and warrants that it and all Authorized Users will comply at all times with this Agreement, all applicable laws and regulations, and all applicable Third-Party Terms governing any Third-Party Datasets enabled or used by Customer. Although Company has no obligation to monitor Customer’s use of Orion, Company will have the right to review and monitor all use of the Services to ensure compliance with all of the terms of this Agreement.
5. Restrictions on Use
  1. ‍Customer shall not use Orion or the Services, or input, integrate, or otherwise combine any data, functionality, or external system with Orion or the Services, in a manner that would cause Orion or the Services - whether independently or in combination with such inputs - to: (a) constitute or perform a prohibited AI practice under any applicable AI Laws (e.g., a practice prohibited under Article 5 of the EU AI Act), or (b) qualify as, or become subject to the obligations applicable to, a high-risk or otherwise specifically regulated AI system under any AI Laws (e.g., a “high-risk AI system” under Chapter III of the EU AI Act, or a “high-impact AI system” as defined in the OMB Memorandum M-25-22). “AI Laws” means any legally binding statute, regulation, or administrative instrument enacted by a governmental or supranational authority that specifically governs the development, deployment, or use of artificial intelligence or automated decision-making systems, including their amendments and successor legislation (e.g., the EU AI Act ((EU) 2024/1689), or Colorado SB 189).
  2. Customer is solely responsible for assessing and ensuring that its use of the Services does not cause Orion or the Services, or any component thereof, to become subject to the obligations applicable to high-risk, high-impact or similar risk-triggered categories under any applicable AI Laws, and shall promptly notify Company in writing upon becoming aware that any such risk category may apply.
  3. Customer shall not use Orion or the Services, or any outputs thereof, as the sole basis or a non-de minimis factor for any automated or AI-assisted decision that produces legal or similarly significant effects on individuals, without appropriate human review and all assessments, disclosures, or safeguards required under applicable AI Laws or other applicable law. Customer shall maintain records sufficient to demonstrate compliance with this obligation upon request by Company or any competent authority.
6. Suspension. Company may suspend or terminate Customer’s, and/or any Authorized User’s, access to Orion or any other Services, in whole or in part, if Company reasonably believes or determines (a) Customer is in breach of this Agreement (including any breach of this Section 2), the applicable Acceptable Use Policy or applicable law; (b) suspension is necessary to protect Orion, other customers, Company’s licensors (including providers of Third-Party Datasets), or the public; or (c) suspension is required by law, court order, or governmental authority.
CONFIDENTIALITY
1. Confidential Information. For purposes of this Agreement, “Confidential Information” means any information disclosed by either party (the “Disclosing Party”) to the other party (the “Receiving Party”) pursuant to this Agreement that is (a) in written, graphic, machine readable or other tangible form and is marked “Confidential,” “Proprietary” or in some other manner to indicate its confidential nature, (b) in the case of oral or visual disclosure, is identified as confidential at the time of disclosure and reduced to tangible form, marked as confidential, and provided to the Receiving Party within a reasonable time, or (c) under the circumstances should in good faith be considered to be confidential. Confidential Information includes, without limitation, information related to research, product plans, products, developments, inventions, processes, designs, markets, business plans, agreements with third parties, services, customers, marketing or finances of either party, the content or existence of any negotiations, and pricing. All technology or proprietary information underlying Orion, any related software or systems, or any of the Services, including nonpublic attribution data pertaining to an entity or blockchain wallet included in the Services, shall be deemed Confidential Information of Company without any need for designating the same as confidential or proprietary. For avoidance of doubt, Company’s Confidential Information also includes, without limitation, any information or data derived from Orion that Company shares with Customer (e.g., specific blockchain addresses, transaction hashes, attribution, graphs, or labels), in whatever form such information or data is shared (e.g., Slack communication, email, spreadsheet, orally, etc.). Notwithstanding the foregoing, Confidential Information shall not include any information to the extent that it is: (i) already in the possession of the Receiving Party prior to the first disclosure hereunder as shown by records or files; (ii) is already part of the public knowledge or becomes part of the public knowledge after the time of disclosure other than as a result of any improper action by the Receiving Party; (iii) is approved in writing by the Disclosing Party; (iv) required to be disclosed by applicable legal authority provided that, if practicable, adequate notice and assistance is given by the Receiving Party to the Disclosing Party for the purpose of enabling the Disclosing Party to prevent and/or limit the disclosure; or (v) independently developed by either party without use of the Confidential Information from the other party.‍
2. Non-Use and Non-Disclosure. Each party shall treat as confidential all Confidential Information of the other, shall not use such Confidential Information except as set forth in this Agreement, and will not disclose such Confidential Information to any third party (including, without limitation, any other party that Customer may retain for incident response purposes) except as expressly permitted herein without the Disclosing Party’s written consent. The Receiving Party shall use at least the same degree of care which it uses to prevent the disclosure of its own confidential information of like importance to prevent the disclosure of the Disclosing Party’s Confidential Information, but in no event less than reasonable care. The Receiving Party shall promptly notify the Disclosing Party of any actual or suspected misuse or unauthorized disclosure of any of the Confidential Information. In the event of any termination or expiration of this Agreement, each party will either return or, at the Disclosing Party’s request, destroy the Confidential Information of the other party; provided however, that Company may retain copies of the Customer Confidential Information for routine backup and archival purposes. For avoidance of doubt, the Company may use, reproduce and disclose Orion, Software, and Services-related information, data and material that is anonymized, de-identified, or otherwise rendered not reasonably associated with or linked to Customer or any other identifiable individual person for product improvement and other lawful purposes in accordance with Section 4(a) of this Agreement.
3. Remedies for Breach of Obligation of Confidentiality. The Receiving Party acknowledges that breach of its obligation of confidentiality may cause irreparable harm to the Disclosing Party for which the Disclosing Party may not be fully or adequately compensated by recovery of monetary damages. Accordingly, in the event of any violation, or threatened violation, by the Receiving Party of its obligations under this Section, the Disclosing Party shall be entitled to seek injunctive relief from a court of competent jurisdiction in addition to any other remedy that may be available at law or in equity, without the necessity of posting bond or proving actual damages.
OWNERSHIP AND PROPRIETARY RIGHTS
1. Customer License to Company. Subject to the terms and conditions of this Agreement, Customer grants Company and its affiliated entities a non-exclusive, royalty-free, worldwide license to use, reproduce, transmit, display, store, and otherwise process the information that Customer inputs into Orion (“Customer Data”) in order to provide the Services to Customer during the Term and to operate, maintain, improve and support Orion and any related software. For the avoidance of doubt, Company may use, reproduce and disclose Orion platform-level information, data and material that is anonymized, de-identified, or otherwise rendered not reasonably associated or linked to Customer or any other identifiable individual person or entity for product improvement and other lawful purposes, all of which information, data and material (and all rights therein) will be owned by Company.
2. Ownership Rights. As between Company and Customer, Company shall own and retain all right, title, and interest in and to (i) Orion, Software and the Services and all improvements, enhancements or modifications thereof, (ii) any software, algorithms, models, applications, inventions or other technology developed in connection with the Services, (iii) any feedback or recommendations provided by Customer regarding any of the foregoing, and (iv) all intellectual property and proprietary rights in and related to any of the foregoing (collectively, “Services IP”). Customer shall retain all right, title and interest in and to the Customer Data. Nothing will confer on either party any other rights or licenses except as set forth in this Agreement.
3. Ownership of Input and Output. Customer may provide inputs to Orion or other Services containing artificial intelligence-powered components (“Input”) and receive output generated by the Services based on such Input (“Output”). As between Customer and Company, and to the extent permitted by applicable law:
  1. Customer retains ownership rights in the Input, and
  2. Company hereby assigns to Customer all right, title, and interest, if any, in and to the Output.
Data Privacy
1. Roles of the Parties. The Parties understand that they qualify as (independent) controllers under all laws and regulations applicable to their processing of personal data, personal information, or personally identifiable information (collectively, “Personal Data”) in relation to the Customer’s use of Orion and the Services (these laws and regulations collectively, “Privacy Laws”). Further, the Parties understand that third-party data providers qualify as (independent) controllers with respect to their processing of Personal Data in connection with Orion and the Services.
2. Use of Orion and the Services by Customer. Customer shall comply with all Privacy Laws applicable to its use of Orion and the Services and shall be solely responsible for determining whether the means and purposes of its use of Orion and the Services comply with applicable Privacy Laws. In particular, Customer shall have a legal basis under applicable Privacy Laws for any transferring or otherwise making available (collectively, “Transferring”) of Personal Data to Company. Customer shall only use Personal Data Transferred by Company as permitted under this Agreement, the Acceptable Use Policy and the Privacy Laws. Additionally, Customer shall provide Personal Data Transferred by Company the same level of privacy protection as required by applicable Privacy Laws. Company reserves the right to take reasonable and appropriate steps to help ensure that Customer uses Personal Data transferred in a manner consistent with Company’s obligations under applicable Privacy Laws. Customer shall notify Company if it makes a determination that it can no longer meet its obligations under this Agreement, the Acceptable Use Policy or applicable Privacy Laws. Company reserves the right to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data.‍
3. Regulatory Inquiries. Customer shall inform Company without undue delay in case of any regulatory inquiry relating to compliance with the Privacy Laws of Customer’s use of Orion and the Services and shall keep Company informed about the development of such regulatory inquiry to the extent legally permissible (e.g., by providing material updates, copies of regulatory correspondence and anticipated timelines). The Parties shall cooperate in good faith to solve any such regulatory inquiries.‍
4. Use of Personal Data by Company. Company shall use Personal Data received from Customer in the course of Customer’s use of Orion and the Services only for (i) providing Orion and the Services (including transferring the data to third-party data providers), which includes, inter alia, delivering functional capabilities, troubleshooting, aggregating or anonymising data for improvement purposes, keeping Orion and the Services up to date, secure and performant, and (ii) complying with legal process, such as warrants, subpoenas, court orders, and lawful regulatory or law enforcement requests, assisting law enforcement or others in detecting and preventing fraud and investigating potential fraud or other unlawful or wrongful conduct, defending against or pursue claims, disputes, or litigation, and complying with legal requirements regarding Orion and the Services. Customer acknowledges that Company may process Personal Data in countries outside the country in which Customer is established, including in countries where Company or third parties engaged by Company maintain facilities, employees, or infrastructure.‍
5. Data transfers. If Customer is subject to Privacy Laws which restrict the Transfer of Personal Data to Company because Company is established in the U.S. (“Restricted Transfer”), the Parties hereby agree that:
  1. Company is registered under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (collectively, the “DPF”). For the Company’s registration information, please visit the Data Privacy Framework website and search for TRM Labs, Inc. To the greatest extent possible, Restricted Transfers to Company shall be based on the DPF.
  2. To the extent that a Restricted Transfer to Company cannot be based on the DPF (such as, for instance, if the DPF later expires or is invalidated), the Parties agree that the Restricted Transfer shall be based on the EU Standard Contractual Clauses ((EU) 2021/914) and UK International Data Transfer Addendum (issued under s.119A UK Data Protection Act 2018), each as may be amended or replaced from time to time. For this purpose, by entering into and executing this Agreement, Customer and Company also execute and enter into:
    1. in respect of Restricted Transfers subject to the EU GDPR and Swiss data protection laws, the EU Standard Contractual Clauses, Module 1 (Controller to Controller), which are incorporated by reference into this Agreement, subject to the specifications for their content contained in Annex 1 to this Addendum (the “EU SCCs”); and
    2. in respect of Restricted Transfers from the United Kingdom, the UK International Data Transfer Addendum, which is incorporated by reference into this Agreement, subject to the specifications for its content contained in Annex 2 to this Agreement.
  3. The Parties further agree that the EU Standard Contractual Clauses or the UK International Data Transfer Agreement shall apply to, and serve as the basis for, Restricted Transfers of Customer Personal Data to Company from other countries which require and recognize the effectiveness of such clauses.
PAYMENTS AND TAXES‍
1. Customer Fees. The Customer agrees to pay, and shall pay, the fees set forth in any applicable Order Form (the “Fees”), including, for the avoidance of doubt, any Fees incurred through Customer’s use of Orion’s database marketplace pay-as-you-use model.
2. Third Party Fee Structure. Certain Third-Party Datasets may be subject to additional or usage-based fees, rates, minimums, or volume limitations, including limits on the number of API calls, queries, or requests that Customer may make during a given period (“Third-Party Fees”), which may vary by data provider and which may be presented to Customer in the applicable Order Form and/or within Orion at the time Customer enables or configures access to such Third-Party Datasets. Customer acknowledges and agrees that:
  1. enabling, toggling on, or otherwise configuring access to a Third-Party Dataset in Orion may result in additional Third-Party Fees;
  2. Customer is solely responsible for selecting, enabling, disabling, and managing configuration of Third-Party Datasets and for all associated Fees and Third-Party Fees incurred under Customer’s account, including any fees resulting from Customer’s usage exceeding any applicable usage limits, ceilings, or thresholds; and
  3. if Customer’s usage exceeds any applicable usage limits or ceilings, Customer will be responsible for all excess usage charges at the then-current Third-Party Fees applicable to the relevant volume, as determined by the applicable third-party data provider and passed through by Company; and
  4. Third-Party Fees may be adjusted by Company in its discretion to reflect changes imposed by the applicable third-party data provider, with such changes to be effective as communicated in Orion or in writing.‍
3. Invoices. Customer shall pay each invoice issued by Company under this Agreement within thirty (30) days of the invoice date via credit card, wire transfer, ACH debit to an account designated by Company, or such other payment method as approved by the Company on an Order Form. Unless otherwise agreed in an Order Form, all payments shall be made in U.S. dollars in immediately available funds and are non-refundable. Any amounts not paid when due shall bear interest at the rate of one and one-half percent (1.5%) per month or the maximum rate allowed by law, whichever is less. All amounts payable to Company hereunder shall be paid by Customer to Company in full without any setoff, recoupment, counterclaim, deduction, debit or withholding for any reason except as may be required by applicable law.
4. Payment Disputes. If Customer believes in good faith that Company has billed Customer incorrectly, Customer must contact Company no later than 30 days after the closing date on the first billing statement in which the error or problem appeared, in order to receive an adjustment or credit. Inquiries should be directed to Company’s customer support department or the Company’s applicable account manager.
5. Taxes. Customer shall pay any sales, use, and other taxes and similar charges based on or arising from the Company’s provision of the Services to Customer (other than taxes based on Company’s net income). If Customer is compelled to make a deduction or set-off for any such taxes, Customer will pay Company such additional amounts as necessary to ensure receipt by Company of the full amount Company would have received but for the deduction.‍
TERM, TERMINATION, AND SURVIVAL‍
1. Term. This Agreement shall remain in effect until its termination as provided below (the “Term”). The Term of each Order Form shall begin on the applicable “Services Start Date” and continue for the “Service Term,” in each case as specified in the relevant Order Form. Unless otherwise set forth on an Order Form, each Order Form shall automatically renew for additional (i) one (1) year periods if the Service Term is equal to or greater than one (1) year, or (ii) periods equal to the Service Term if the Service Term is less than one (1) year (each, a “Renewal Term”), unless written notice of non-renewal is received by either party at least thirty (30) days prior to the expiration of the then current term. Unless renewed, all Services and Products in the applicable Order Form expire at the end of the Service Term. In the event Company makes updates to the Agreement in a subsequent renewal term for the same Customer, the updated terms of the Agreement will govern the renewal Order Form.
2. Termination. Company may terminate this Agreement upon written notice to Customer if no Order Form is in effect. In addition to other remedies available to it, Company may in its discretion terminate this Agreement and/or suspend the Customer’s and the Authorized Users’ access to the Services upon thirty (30) days written notice to the Customer in the event that the Customer does not pay any amount owing under this Agreement when due. Company may terminate this Agreement immediately on written notice if: (a) all or substantially all of the assets of Customer are transferred to an assignee for the benefit of creditors, to a receiver or trustee in bankruptcy; (b) a proceeding is commenced by or against Customer for relief under bankruptcy or similar laws and such proceeding is not dismissed within thirty (30) days; or (c) Customer is adjudged bankrupt or insolvent. Either party may terminate this Agreement on thirty (30) days’ prior written notice if the other party materially breaches any of the terms of this Agreement and such breach remains uncured thirty (30) days following such party’s receipt of the terminating party’s notice.
3. Effect of Termination. Upon termination of the Agreement, each outstanding Order Form, if any, shall terminate and Customer shall immediately cease all use of, and all access to, Orion and the Services and Company shall immediately cease providing the Services. If Company terminates this Agreement in connection with Customer’s breach of this Agreement or for non-payment of any Fees due, all Fees that would have become payable had each outstanding Order Form remained in effect until expiration of its current term will become immediately due and payable.
4. Survival. Upon termination or expiration of this Agreement, all rights to access and use and all licenses granted hereunder shall immediately terminate. The following Sections, along with any other provisions which by their nature are intended to survive termination or expiration of this Agreement, shall survive any termination or expiration of this Agreement: 2(c), 3-5 (inclusive), 6(b), 6(c), 6(d), and 7-16 (inclusive).
Warranties and Disclaimers.
1. General.
  1. Each Party represents and warrants that: (i) such Party is an entity duly organized, validly existing, and in good standing under the laws of the state of its incorporation or registration, and has the full power and authority to enter into and perform its obligations under this Agreement; (ii) the execution of this Agreement by such Party, and the performance by such Party of its obligations and duties hereunder do not and will not violate any other agreement to which such party is a party or by which it is otherwise bound; (iii) when executed and delivered by such Party, this Agreement will constitute the legal, valid, and binding obligation of such Party, enforceable against such Party in accordance with its terms; and (iv) such party acknowledges that the other Party makes no representations, warranties, or agreements related to the subject matter of this Agreement that are not expressly provided for in this Agreement.
  2. 2. Each Party represents and warrants that it, any of its affiliates, and any of Customer’s Authorized Users is not and will not be: (i) an entity or person that is “controlled by a foreign adversary” as defined under the Protecting Americans’ Data from Foreign Adversaries Act, 15 USC §9901 (“PADFAA”), or a “country of concern” or “covered person” as defined under the U.S. Department of Justice’s Bulk Sensitive Data Rule, 28 CFR §202, (the “DOJ Rule”) (collectively, “Restricted Entity”); (ii) it will not, directly or indirectly, do any of the following where such activity would constitute or facilitate a “prohibited data transaction” or otherwise violate PADFAA or the DOJ Rule: (a) provide, disclose, license, transfer, or otherwise make available the other party’s Confidential Information to any Restricted Entity, or (b) permit any access to such Confidential Information by any Restricted Entity, including through personnel, vendors, contractors, affiliates, or technical means; (iii) it will not permit access to the other Party’s Confidential Information by personnel located in, or subject to the jurisdiction or control of, a foreign adversary country or country of concern if such access would result in a violation of PADFAA or the DOJ Rule; (iv) it will promptly notify the other Party if it becomes a Restricted Entity, becomes owned or controlled by a Restricted Entity, or becomes aware of any actual or reasonably suspected unauthorized access or transfer of the other Party’s Confidential Information involving a Restricted Entity; and (v) upon such notice or reasonable request, it will immediately cease any use, disclosure, access, or other processing of the other Party’s Confidential Information and, at the other Party’s direction, return or destroy the affected Confidential Information and require the same of any third parties. A Party may immediately suspend or terminate the affected Services or data access upon a reasonable determination of a violation or material risk of violation of PADFAA or the DOJ Rule.
2. Customer Representations and Warranties.
  1. Customer represents and warrants that (i) any Customer Data, including any personal data, personally identifiable information, or other sensitive or regulated information included in Customer Data is collected, used, disclosed, and transferred in compliance with all applicable data protection, privacy, and security laws and regulations, and that (ii) Customer has obtained all necessary consents, notices, and authorizations required for Company to process such Customer Data for the purposes described in this Agreement, and (iii) the execution, delivery, and performance by Customer of this Agreement, including without limitation the provision of the Customer Data, does not and will not violate any applicable statute, regulation, or law, or infringe any intellectual property right or other legal right of any third party.
  2. Further, Customer represents and warrants that it shall not use Orion and any Services in any manner that violates, or causes the Company to violate, any applicable laws, including, but not limited to the AI Laws and Privacy Laws, as well as Customer’s obligations under the terms of this Agreement.
  3. Customer acknowledges and agrees that it is solely responsible for:
    1. all Input provided to the Services;
    2. ensuring that it has obtained all necessary rights, licenses, and permissions to provide such Input; and
    3. evaluating the Output for accuracy and appropriateness for its use case, including through appropriate human review.Customer represents and warrants that all Output will be used solely for internal purposes and relied on for informational purposes only. Customer provides express consent for any Customer Data to be used for improvement of the Services.
    4. ensuring compliance with all internal policies, guidelines, or restrictions governing the use of artificial intelligence that are imposed by Customer’s organization, employer, or any affiliated entity
3. Disclaimers. Company shall use reasonable efforts consistent with prevailing industry standards to maintain the Services in a manner which minimizes errors and interruptions in the Services. Services may be temporarily unavailable for scheduled maintenance or for unscheduled emergency maintenance, either by Company or by third-party providers, or because of other causes beyond Company’s reasonable control, but Company shall use reasonable efforts to provide advance notice in writing or by e-mail of any scheduled service disruption. Company shall have no liability arising out of or related to Customer’s breach of any Third-Party Terms or Customer’s misuse of any Third-Party Datasets.
4. Third-Party Data and Aggregated Data Disclaimer. Customer acknowledges and agrees that Orion aggregates and provides access to data from multiple third-party sources over which Company has no control. COMPANY MAKES NO REPRESENTATIONS OR WARRANTIES REGARDING THE ACCURACY, COMPLETENESS, TIMELINESS, RELIABILITY, OR QUALITY OF ANY THIRD-PARTY DATASETS OR ANY DATA ACCESSED THROUGH ORION. Company does not independently verify third-party data and expressly disclaims all liability for any errors, omissions, inaccuracies, or defects in such data. Customer accesses and uses all Third-Party Datasets and extracted data entirely at Customer's own risk.
  
  EXCEPT AS PROVIDED HEREIN OR IN AN ORDER FORM AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ORION, AND ALL RELATED SOFTWARE, INFORMATION, TECHNOLOGY, AND SERVICES PROVIDED BY OR ON BEHALF OF COMPANY ARE PROVIDED “AS IS,” “AS AVAILABLE,” AND WITHOUT ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AND COMPANY EXPRESSLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE (EVEN IF COMPANY IS ADVISED OF THE PURPOSE), ACCURACY, AND/OR NON-INFRINGEMENT. ANY ORION REPORT IS PROVIDED ON AN “AS IS,” “WHERE IS,” AND “AS AVAILABLE” BASIS. USE OF AN ORION REPORT IS AT CUSTOMER’S OWN RISK. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AND ALL ORION REPORTS ARE PROVIDED WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON INFRINGEMENT. ANY CONTENT DOWNLOADED OR OTHERWISE OBTAINED THROUGH THE USE OF THE SERVICES OR THE ORION PLATFORM IS DOWNLOADED AT CUSTOMER’S OWN RISK AND CUSTOMER WILL BE SOLELY RESPONSIBLE FOR ANY DAMAGE TO ITS COMPUTER SYSTEM OR LOSS OF OR DAMAGE TO DATA THAT RESULTS FROM SUCH DOWNLOAD OR CUSTOMER’S USE OF THE SERVICES OR THE ORION PLATFORM.
Limitation of Liability. To the maximum extent permitted by applicable law, the aggregate liability of Company and its licensors arising out of or relating to this Agreement, the Services or the Orion platforms, or any related professional services, under any theory of liability, shall not exceed the fees paid by Customer for access to and use of Orion during the twelve (12) months immediately preceding the first event giving rise to the claim (as a cumulative cap, not per incident). In no event shall Company or its licensors be liable for any indirect, incidental, special, or consequential damages, including loss of profits, revenue, data, or data use, even if advised of the possibility of such damages. Company assumes no liability for any errors, inaccuracies, or omissions in any Orion Report or data obtained from Orion. These limitations form an essential basis of this Agreement and shall survive any failure of essential purpose.

Customer acknowledges that the Services do not constitute legal, tax, or investment advice. Company provides reporting and information services only and assumes no liability for transactions analyzed, Customer’s use of the Services, any actual or potential violations, or any content posted by Customer or other users. Notwithstanding Section 9(a) in the Agreement, TRM shall have no obligation to defend, indemnify, or hold harmless Customer from or against any claims, damages, losses, liabilities, or expenses (including attorneys’ fees) arising out of or related to: Customer’s use of, reliance on, or distribution of any outputs, content, or other materials generated by Customer through the use of the Services. The Output is provided as-is. TRM makes no representation or warranty regarding the legality, accuracy, originality, or fitness for a particular purpose of such AI-generated outputs. Customer assumes sole responsibility for evaluating and using any such Outputs, including ensuring compliance with applicable laws and third-party rights.
Indemnity‍
1. Indemnification by Company. Company will defend Customer against any claim, suit, demand, or action made or brought against Customer by a third party alleging that the Services, or Customer’s permitted use or access thereof in accordance with this Agreement, infringes any intellectual property rights of such third party, and will indemnify and hold harmless Customer from any damages, losses, liabilities, costs and fees (including reasonable attorney’s fees) (“Losses”) finally awarded against Customer in connection with or in settlement of any such claim, suit, demand, or action. The foregoing obligations do not apply (1) with respect to any portions or components of Orion that are (i) not supplied by Company, (ii) made in whole or in part in accordance with Customer specifications, (iii) modified after delivery, or granting of access, by Company, or (iv) combined with other products, processes or materials where the alleged infringement relates to such combination; (2) where Customer continues the allegedly infringing activity after being notified thereof or after being informed of modifications that would have avoided the alleged infringement; (3) where Customer’s use of the Orion Services is not strictly in accordance with this Agreement; (4) with respect to Customer's combination of Orion data with other data sources or systems; (5) with respect to Customer’s Inputs; (5) with respect to any outputs, reports, or derivative works created by Customer (such excluded claims described in clauses (1)-(5), collectively, “Excluded IP Claims”); or (6) with respect to any Third-Party Datasets or content provided by third-party data providers.
  
  If, due to a claim of infringement, the Orion Service is held by a court of competent jurisdiction to be or is believed by Company to be infringing, Company may, at its option and expense (a) replace or modify such Orion Service to be non-infringing provided that such modification or replacement contains substantially similar features and functionality, (b) obtain for Customer a right to continue using such Orion Service or (c) if neither of the foregoing is commercially practicable, terminate this Agreement and Customer’s rights hereunder and provide Customer a refund of any prepaid, unused fees for such Orion Service. This Section states Customer’s sole and exclusive remedies for claims of infringement.
2. Indemnification by Customer. To the extent permitted by applicable law, Customer shall indemnify, defend, and hold Company and its affiliates, and Company’s affiliates, officers, members, directors, employees, agents, successors and assigns harmless from and against all fines, third-party claims and Losses arising from: (i) Customer’s use of and access to the Orion Service, including any Orion Reports or other data (including Customer Data) or content uploaded, transmitted or received by Customer for any purpose, including for its internal use or in connection with the provision of Orion Reports (or any portion thereof or content therefrom) to any third-party; (ii) any other party’s access and use of the Orion Service with Customer’s unique username, password, or other appropriate security code; or (iii) any Excluded IP Claims; (iv) Customer's violation of any Third-Party Terms or misuse of any Third-Party Datasets, including any claims brought by third-party data providers; (v) any claims that Customer's use, combination, or redistribution of data obtained from Orion violates any third-party rights, including intellectual property, privacy, or data protection rights; (vi) any decisions, actions, or omissions by Customer or any third party based on data, reports, or analysis obtained from Orion; (vii) Customer’s violation of the AI Laws, Privacy Laws, and the terms of this Agreement relating to the AI Laws; and (vii) any claims by Customer's clients, partners, or other third parties related to services Customer provides using Orion data.‍
3. Process. The indemnified party shall promptly notify the indemnifying party in writing of any claim for which it seeks indemnification hereunder; provided that the failure to provide such notice shall not relieve the indemnifying party of its indemnification obligations hereunder except to the extent of any material prejudice directly resulting from such failure. The indemnifying party shall bear full responsibility for, and shall have the right to solely control, the defense (including any settlements) of any such claim; provided, however, that (i) the indemnifying party shall keep the indemnified party informed of, and consult with the indemnified party in connection with the progress of such litigation or settlement and (ii) the indemnifying party shall not have any right, without the indemnified party’s written consent, to settle any such claim in a manner that does not unconditionally release the indemnified party.‍
4. Third-Party Provider Claims. If a third-party data provider brings a claim that implicates both Company and Customer, the parties agree to coordinate their defense and share information reasonably necessary for such defense. Customer shall not settle any such claim in a manner that admits fault on behalf of Company or imposes obligations on Company without Company's prior written consent.‍
Notices. All notices and other communications required or permitted under this Agreement shall be in writing, addressed to the applicable party at its address set forth in this Agreement, and shall be deemed effectively delivered only: (i) via email delivery to the Company Contact or account manager set forth in an Order Form (if to Company) or the Customer Contact set forth in an Order Form (if to Customer); (ii) upon personal delivery, or (iii) upon delivery by a courier service as confirmed by written delivery confirmation. Either party may change its address for notice by giving notice to the other party in accordance with this Section.
Governing Law, Jurisdiction, Venue, and Dispute Resolution. This Agreement shall be construed in accordance with applicable U.S. federal law and the laws of the State of California without regard to conflict of laws principles. The U.N. Convention on the International Sale of Goods does not apply to this Agreement or to the rights or duties of the parties under this Agreement. In the event a dispute arises out of or in connection with this Agreement, the parties will attempt to resolve the dispute through friendly consultation. If the dispute is not resolved within a reasonable period, then any or all outstanding issues may be submitted to mediation in accordance with any statutory rules of mediation. If mediation is not successful in resolving the entire dispute or is unavailable, any outstanding issues shall be finally settled by binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association (“AAA”). Either party may send a notice to the other party of its intention to file a case with the AAA under this Section (“Arbitration Notice”). The arbitration will be conducted in San Francisco, California by a single arbitrator knowledgeable in government contracting matters and the commercial aspects of “software as a service” arrangements and intellectual property. The parties will mutually appoint an arbitrator within thirty (30) days of the Arbitration Notice. If the parties are unable to agree on an arbitrator, then the AAA will appoint an arbitrator who meets the foregoing knowledge requirements. The arbitration hearing will commence within sixty (60) days after the appointment of the arbitrator and the hearing will be completed and an award rendered in writing within sixty (60) days after the commencement of the hearing. Prior to the hearing, each party will have the right to take up to four (4) evidentiary depositions, and exchange two (2) sets of document production requests and two sets, each, of not more than ten (10) interrogatories. The arbitrator will provide detailed written explanations to the parties to support their award and regardless of outcome, each party shall pay its own costs and expenses (including attorneys’ fees) associated with the arbitration proceeding and fifty percent (50%) of the fees of the arbitrator and the AAA. The arbitration award will be final and binding and may be enforced in any court of competent jurisdiction. Notwithstanding the foregoing, each party shall have the right to institute an action in the state or federal courts of San Francisco County, California for preliminary injunctive relief pending a final decision by the arbitrator(s), provided that a permanent injunction and damages shall only be awarded by the arbitrator(s).
Force Majeure. Company is not and shall not be responsible nor liable for any delays or failures in performance from any cause beyond its control, including, but not limited to acts of God, changes to law or regulations, embargoes, war, terrorist acts, acts or omissions of third party technology providers, riots, fires, epidemics or pandemics, earthquakes, floods, power blackouts, strikes, weather conditions or acts of hackers, third party service providers or any other third party or acts or omissions of Customer or any Authorized User.
Relationship of the Parties. The relationship between the parties shall only be that of independent contractors. Neither party is an agent, representative, partner, employer, or employee of the other party, and neither party shall have any right or authority to assume or create any obligations or to make any representations or warranties on behalf of any other party, whether express or implied, or to bind the other party in any respect whatsoever.
Publicity. Except as set forth in this Agreement, neither party shall issue or release any announcement, statement, press release, or other publicity or marketing materials relating to this Agreement or otherwise use the other party’s trademarks, service marks, trade names, logos, domain names, or other indicia of source, affiliation, or sponsorship without obtaining the express prior written consent of the other party.
General. Neither party may assign this Agreement to any third party without the prior written consent of the other; provided that no consent is required in connection with an assignment by Company to an affiliate or in connection with any merger, reorganization, consolidation, sale of assets or similar transaction. Company may subcontract any or all of its obligations hereunder. For the avoidance of doubt, a third-party technology provider that provides features or functionality in connection with Orion or any other TRM platforms shall not be deemed a sublicensee under this Agreement. Subject to the foregoing, this Agreement shall be binding upon and inure to the benefit of the parties and their successors and assigns. This Agreement, together with its exhibit(s), is the entire agreement between the parties hereto pertaining to the subject matter hereof and supersedes all prior agreements, and all prior and contemporary proposals and discussions relating to the subject matter of this Agreement. In the event of a conflict between this Agreement and any Order Form, such Order Form shall prevail unless otherwise expressly indicated in this Agreement or such Order Form. Any waiver by either party of any default or breach hereunder shall not constitute a waiver of any provision of this Agreement or of any subsequent default or breach of the same or different kind. All notices, modifications and waivers under this Agreement must be in a writing executed by a duly authorized representative of each of the parties. If any provision of this Agreement is determined to be unenforceable, that provision will be replaced with the valid one that most closely achieves the parties’ intent and the remainder of this Agreement will remain enforceable. This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which taken together shall constitute one and the same instrument.

‍

ANNEX 1: SPECIFICATIONS FOR EU STANDARD CONTRACTUAL CLAUSES

PART 1: Selected Content of the EU Standard Contractual Clauses, Module 1

For the purposes of Section 5, Customer and TRM agree that for Module 1 (Controller to Controller) of the EU SCCs executed between the Parties and incorporated by reference into the Agreement, the content of the EU SCCs shall be as follows:

PART 2: Content of Annex 1 to the EU SCCs

List of Parties
Data Exporter: Customer
Name: as set out in the Agreement and Order Form.
Address: as set out in the Agreement and Order Form.
Contact person’s name, position and contact details: as set out in the Agreement and Order Form.
Activities relevant to the data transferred under these Clauses: as set out in the Agreement and Order Form.
Role (controller/processor): Controller.

Data importer(s): Company
Name: as set out in the Agreement and Order Form.
Address: as set out in the Agreement and Order Form.
Contact person’s name, position and contact details: as set out in the Agreement and Order Form, unless the data importer notifies the data exporter otherwise.
Activities relevant to the data transferred under these Clauses: as set out in the Principal Agreement.
Role (controller/processor): Controller
Description of Transfer
Categories of data subjects whose personal data is transferred: Customer determines, via the Personal Data Customer Transfers to Orion and the Services, the categories of Data Subjects to whom Customer Personal Data may relate..

Categories of personal data transferred: Customer Personal Data to be Transferred includes identifiers that may be submitted by Customers to Orion and the Services, but only to the extent that such identifiers constitute Personal Data

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: No sensitive Personal Data is contemplated to be submitted by Customer to Orion and the Services for Processing by Company.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): continuous unless otherwise specified in the Agreement and Order Form.Nature of the processing: as set forth in the Agreement and Order Form..

Purpose(s) of the data transfer and further processing: as set forth in the Agreement and Order Form.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: One year, unless Customer requests a longer period.

For transfers to (sub-)processors, also specify the subject matter, nature and duration of the processing: N.a.
Competent Supervisory Authority
Identify the competent supervisory authorities in accordance with Clause 13:
1. In respect of Restricted Transfers from EEA member states, the competent Supervisory Authority is the Supervisory Authority of the Netherlands (Autoriteit Persoonsgegevens).
2. In respect of Restricted Transfers from Switzerland, the competent Supervisory Authority is the Federal Commissioner of Data Protection and Freedom of Information (Eidgenössischer Datenschutz- and Öffentlichkeitsbeauftragter).

Part 3: Content of Annex 2 of the EU SCCs

The applicable technical and organisational measures including technical and organisational measures to ensure the security of the data are set out in the TRM Trust Center.

ANNEX 3: CONTENT OF UK INTERNATIONAL DATA TRANSFER AGREEMENT

For the purposes of Section 9 of the DPA, Customer and TRM agree that for the UK International Data Transfer Agreement (UK IDTA) executed between the Parties and incorporated by reference into the DPA, the content of the UK IDTA shall be as follows:

PART 1: TABLES

Table 1: Parties and Signatures

‍

Table 2: Transfer Details

<table class="legal-table_component"><tbody class="legal-table_body"><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>UK country’s law that governs the IDTA:</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>England and Wales</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Primary place for legal claims to be made by the Parties</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>England and Wales</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>The status of the Exporter</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>In relation to the Processing of the Transferred Data: Exporter is a Controller</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>The status of the Importer</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>In relation to the Processing of the Transferred Data: Importer is a Controller</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Whether UK GDPR applies to the Importer</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>UK GDPR does not apply to the Importer’s Processing of the Transferred Data</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Linked Agreement</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>If the Importer is the Exporter’s Processor or Sub-Processor – the agreement(s) between the Parties which sets out the Processor’s or Sub-Processor’s instructions for Processing the Transferred Data: Not applicable.</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Term</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>The Importer may Process the Transferred Data for the following time period: See Agreement and Order Form.</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Ending the IDTA before the end of the Term</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>The Parties can end the IDTA before the end of the Term, in accordance with the Agreement and Order Form.</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Ending the IDTA when the Approved IDTA changes</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Which Parties may end the IDTA as set out in Section 29.2: As permitted in the Agreement and Order Form</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Can the Importer make further transfers of the Transferred Data?</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>The Importer MAY transfer on the Transferred Data to another organisation or person (who is a different legal entity) in accordance with Section 16.1 (Transferring on the Transferred Data).</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Specific restrictions when the Importer may transfer on the Transferred Data</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>The Importer MAY ONLY forward the Transferred Data in accordance with Section 16.1: there are no specific restrictions.</p></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Review Dates</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>The Parties must review the Security Requirements at least once each year; for this purpose Company makes the Security Measures available to Importer in the TRM Trust Center.</p></div></td></tr></tbody></table>

‍

Table 3: Transferred Data

‍

Table 4: Security Requirements

As set out in the TRM Trust Center.

PART 2: EXTRA PROTECTION CLAUSES

‍

PART 3: COMMERCIAL CLAUSES

Subscribe to our latest insights

You can unsubscribe at any time. Read our Privacy Policy.