Supplemental Product Terms

• Annual Training Course Swaps: Customer may swap a selected course for another course once per contract year. Access to the new course in any of NAVEX’s standard languages is included at no additional charge.
• Standard Training Course Translations: The subscription includes the optional setup of the selected course(s) into any of NAVEX’s standard languages. The standard languages applicable to each course depend on whether the course is a North American Course or a Global Course:  
  • North American Courses: English (US), French (Canadian), and Spanish (Latin American).
  • Global Courses: Chinese (Simplified), Dutch, English (US), English (UK), French (Canadian), French (European), German, Italian, Japanese, Korean, Portuguese (Brazilian), Russian, Spanish (European), and Spanish (Latin American).
• ONLY APPLICABLE TO CUSTOMERS PURCHASING AN ENHANCED LANGUAGE SUBSCRIPTION:  
• Additional Translations Available for Global Courses: In addition to access to NAVEX’s standard languages, the Enhanced Language subscription includes the optional setup of the selected Global course(s) in the following languages on demand: Arabic, Czech, Danish, Finnish, Hindi, Hungarian, Indonesian, Malay, Norwegian, Polish, Romanian, Swedish, Thai, Turkish, and Vietnamese. If a selected Course has not yet been translated into a requested language, NAVEX will obtain the translation. Translation timelines vary by course length but are generally completed within 8–16 weeks of request.

Organization Screening: All organization profiles are indexed in Latin-based characters. A secondary field in non-Latin-based characters (“Alias”) may be associated with the profile, however not all profiles contain Aliases in non-Latin-based characters. Names entered for organization screening are not transliterated and a search using non-Latin-based characters will only result in a match if a matching Alias is associated with the Latin-based profile. It is strongly recommended that Customer search using Latin-based characters when conducting organization screening.

Additional Provider Terms: By utilizing the services of Regulatory DataCorp, Inc. (“Moody’s”) in the RiskRate system, Customer accepts the terms and conditions detailed in the following hyperlink, which are incorporated by this reference as though fully set forth herein: https://support.navex.com/s/news/third-party-due-diligence-provider-additional-terms-MCVKCGT37BCBB2FEIZNFTVUBFQLI. Use of the Moody’s services will be construed as consent to these terms without reservation.

Telephony Connectivity: Communication connectivity is provided by a third-party provider. Additional information is available here: https://www.navex.com/en-us/telephony-availability-report/.

• Encryption Of Customer Data: Customer Data is encrypted in flight and at rest when stored in the Services. Customer Data is accessible to Customer by use of a “secondary password” which is set up by Customer upon launch of the Services and used by Customer to decrypt Customer Data within the Services. The secondary password is shared among case managers and it is Customer’s responsibility to share the secondary password with the case managers Customer wishes to authorise to access and manage reports.  If the secondary password is lost, Customer can restore and access Customer Data with the backup encryption file, which is provided to Customer upon launch of the Services. Customer is responsible for secure password management, including use and secure storage of Customer’s backup encryption file. WhistleB does not know Customer’s encryption keys necessary to decrypt Customer Data and cannot access Customer Data unless such access to decrypted Customer Data is authorized in writing by Customer. A lost secondary password, in combination with a lost backup encryption file, means that the Customer Data will no longer be accessible. WhistleB cannot be held liable for any loss of Customer Data related to Customer’s loss of the secondary password and backup encryption file. 

• ONLY APPLICABLE TO CUSTOMERS PURCHASING LIVE PHONE INTAKE:  

• WhistleB - Live Phone Intake - Per Employee Subscription: This service is only for use by employees. The quantity listed above is the maximum number of employees that Customer may provide with access to the reporting features of the hotline.

Code of Conduct Deliverables: Each party shall retain all rights in their respective IP acquired or developed prior to the execution of the Order Form for Code of Conduct services. Neither party will acquire any rights in the IP of the other party, with the exception that, to the extent that the Code of Conduct deliverables incorporate any existing NAVEX IP, NAVEX grants Customer a non-exclusive, perpetual, fully paid-up, royalty-free, license to use such NAVEX IP in the course of its business.

Integrity Diagnostics Annual: In order to make use of the additional functionality that allows for building custom visualizations, the additional service EthicsPoint GRC Insights – Custom must be purchased.

• Sub-Processors: Customer consents to use of the applicable sub-processors set forth here: https://www.navex.com/en-us/service-hosting-providers. The foregoing link contains a mechanism to subscribe to notifications of the addition of new sub-processors for each applicable Service, to which Customer may subscribe. Updates provided via this mechanism shall operate as notification of the addition of new sub-processors. 

• Usage Data: NAVEX may create, collect, store, use, and modify data generated in connection with Customer’s use of the Services in the following ways: (i) NAVEX may anonymize Customer Data and data derived from users’ interactions with the Services, provided that any such anonymized data will not identify or be used to re-identify Customer or individuals whose data are processed via the Services; (ii) NAVEX may employ features within the Services to better understand Admin User behavior by collecting information such as browser type, pages visited, features used, and operating system version, provided that such information shall not include Personal Data; and (iii) NAVEX may compile, de-identify, and aggregate Customer Data (excluding Personal Data)  for benchmarking, analytics, and reporting. As between the Parties, NAVEX shall own the foregoing data and may use it to deliver, improve, and develop its products and services and to compile analysis and reporting.