Raw Data Addendum.

1. A raw license is the owner's own export, as the owner hands it over. Nothing is removed except what the owner leaves out of the export. It can include names, contact details and other personal data, and it will usually show which business it comes from.
2. Raw data does not go through the Clean Room, and no Clean Room fee applies. data.cool does not review it and makes no statement about what is or isn't in it. The de-identification statements in the Buyer Terms do not apply to it.

1. Direct: the owner sends the export to the destination Buyer names. data.cool does not receive or keep a copy; it records when the owner says it was sent and when Buyer confirms it arrived.
2. Through the vault, where offered: data.cool receives the export, records what it holds, encrypts it to Buyer's delivery key and delivers it, acting as the owner's processor under the Data Processing Addendum, and deletes it on the schedule in the Privacy Policy.

1. From the moment it receives raw data, Buyer is responsible for the personal data in it as an independent business under the privacy laws that apply to Buyer, including having its own lawful basis for its use.
2. Before using the data for the licensed purpose or passing any of it on, Buyer cleans it: it removes secrets and credentials, payment data and health and other sensitive categories, and removes or pseudonymizes the personal data in it.
3. Buyer keeps the raw copy only as long as it needs to clean it, and deletes it within 90 days of receipt. Buyer confirms the deletion in writing on request.
4. Buyer will not use the data to contact, market to, profile or make decisions about any person in it, will not sell or disclose the personal data in it, and will not use it to approach the owner's customers, suppliers or staff.
5. Buyer keeps the raw copy under access control and encryption, limits it to staff and contractors who need it and are bound to confidentiality, and keeps a record of who has had access.
6. On a request from data.cool (for an owner, or for a person exercising their rights), Buyer deletes or corrects the records named within 30 days and confirms in writing.
7. Buyer notifies privacy@data.cool within 72 hours of becoming aware of a personal data breach involving raw data, and cooperates in the response.

Buyer passes the raw copy to no one. Data Buyer has cleaned under this addendum may go to the downstream recipients Buyer lists on its Data Desk, under terms at least as protective as the Buyer Terms.

Buyer indemnifies data.cool and the owner against claims arising from Buyer's handling of raw data, including any breach of this addendum by Buyer or anyone Buyer gives access to. The owner's own promises about its data are those in the Seller Terms.

On reasonable notice, and no more than once a year unless there is a breach, Buyer answers data.cool's written questions about its handling of raw data and makes its access and deletion records available.