Trane Asia Pacific: Connected Services Terms of Service & Security Addendum
These Connected Services Terms of Service are incorporated into and form part of the Terms and Conditions – Service (“Service Terms”). They apply to the provision or performance of Connected Services by Company (as defined in the Service Terms) for Customer (as defined in the Service Terms).
1. Access Grant to Company. Customer hereby grants to Company the right to access, monitor, control and use Customer’s equipment, products, controls, systems, and system elements, including, but not limited to, building automation systems (“BAS”), HVAC equipment, meters, and loggers (each a “Connected System”) and Customer’s network, network infrastructure, telephone line, modem, and other communication equipment (“Communication Systems” and, together with Connected Systems, “Systems”) to perform any of the following services (collectively, the “Connected Services”): (i) view, collect, extract, transmit, process, and use data relating to the performance and condition of Connected Systems (“System Data”) and Customer’s account information (together, “Customer Data”); (ii) diagnose, operate, modify, repair, and service Connected Systems, as requested by Customer; (iii) deliver services to Customer, including, without limitation, services (pursuant to a subscription agreement) through a web-based application hosted by Company, such as, but not limited to, Trane intelligent services, Tracer™ Synchrony, Tracer™ Ensemble, Energy Assessment, Active Monitoring, Building Performance, and Energy Performance (each and collectively referred to as “Hosted Services”); (iv) perform statistical or other analyses for its own purposes or on behalf of Customer, including, without limitation, analyses, histories, and trends based on metrics relating to engineering, failure, warranty, energy, predictive, service, and product usage; (v) install patches, bug fixes, updates, and other modifications (“Updates”); (vi) back up and/or restore Customer Data; (vii) investigate Security Incidents (as defined in the “Security Breach Notice” section below); (viii) verify compliance with these terms and any other terms applicable to the Connected Services, and (ix) perform other functions reasonably required to provide the contracted services and comply with applicable laws and regulations. Company’s obligation to perform any Connected Services will depend upon products and services purchased from Company.
2. Systems. If Customer has purchased any Connected Services, Customer shall ensure that the Systems are made available, maintained, installed, and configured for the Connected Services and that Customer Data is available for collection. Company may provide Customer with recommended System elements, configurations, installations, and security measures. Customer acknowledges that the Connected Services do not include support of Customer’s computer hardware, internet browsers, or Communication Systems. Company shall have no liability for (i) losses or the inability to perform due to malfunctioning or unavailable Systems; (ii) Customer’s failure to comply with Company recommendations in writing; (iii) the failure to identify performance issues with the Systems or recommend corrective action to Customer; or (iv) any adverse impact to the Systems. Where Customer becomes aware in the ordinary course that Customer Data is not being collected, Customer is responsible for requesting support through the local Company office.
3. Users. Customer may be required to designate User(s) for purposes of accessing certain Connected Services. Customer shall use commercially reasonable efforts to ensure Users maintain the confidentiality of access credentials. Customer is solely responsible for User actions with regard to access to or use of the Connected Services, including from devices and workstations that interface with Connected Services. Customer shall designate a System Administrator to manage Users’ access, including adding and subtracting Users. The System Administrator shall ensure that multiple Users do not share access credentials. Company has the right to terminate or suspend access to the Connected Services at any time if Company believes in good faith that such termination or suspension is necessary to preserve the security, integrity, or accessibility of the Connected Services, Confidential Information, or Company’s network.
4. Availability. Customer acknowledges that the availability, use, and reliability of the Connected Services, in whole or in part, depends on Communication Systems and third-party product vendors and service providers, including, without limitation, Customer’s internet service and telecommunications provider(s) (“Third-Party Vendors”). Customer also acknowledges that Company has no control over the reliability of Third-Party Vendors. Customer acknowledges and agrees that Company shall not be held liable whatsoever for losses or Service, delivery, or performance failures attributable in whole or in part to Third-Party Vendors’ outages or system failures.
5. Customer Data. All Customer Data shall be owned by Customer. Customer hereby grants to Company an irrevocable, perpetual, nonexclusive, worldwide, royalty-free, sublicenseable, and transferable right to process, reproduce, modify, display, distribute internally or externally, prepare derivative works, and otherwise collect and use Customer Data to perform the Connected Services and for marketing purposes, subject to the limitations applicable to Confidential Information. Customer warrants to Company that its provision of Customer Data will not infringe upon the intellectual property rights or other legal rights of any person and will not breach any applicable law or regulation. Company shall not publicly disclose such data in any way that identifies Customer as the source of the Customer Data without Customer’s prior written consent. Upon Customer’s written request, Company will endeavor to provide Customer with a copy of Customer Data to the extent then available. Customer acknowledges and accepts that Company does not guarantee the availability of Customer Data.
6. Disaster Recovery. In the event Company experiences a problem with the Connected Services that results in or is expected to result in a loss of service in excess of five working days, Company may transfer the Connected Services to an alternative hosting environment. In such event, Customer acknowledges the following: (i) data imported after the most recent database backup may be lost; (ii) Company may use a different IP address to provide the Connected Services; (iii) Customer may be required to access the Connected Services via a different IP address and/or domain name; and (iv) data collection may not be available.
7. Privacy. In providing the Connected Services, Company will comply with the Trane Technologies Data Protection and Privacy Policy (“Privacy Policy”), which is incorporated herein by reference. For data subjects located in mainland China, the Privacy Policy is available at: https://www.tranetechnologies.cn/zh_cn/index/privacy-policy/Chinaprivacypolicy.html. For data subjects located in Asia Pacific countries/regions (excluding mainland China), the Privacy Policy is available at: https://www.tranetechnologies.com/en/index/privacy-policy.html. The Privacy Policy is subject to change at Company’s discretion, provided that such changes will not result in a material reduction in the level of protection for Customer Data during the period for which Connected Services fees have been paid.
8. Confidential Information. The Parties agree to take, at a minimum, commercially reasonable security precautions to protect Confidential Information at all times, both during the term hereof and for a period of at least 3 years after the Confidential Information was furnished; provided, however, that any proprietary and trade secret information shall be held in confidence in perpetuity. Customer shall not permit any third party to access the Connected Services or physical hardware deployed at Customer’s facilities to enable operation of the Connected Services except as expressly permitted in a written agreement between the parties. Customer acknowledges that, due to the nature of communication via the internet, Company cannot guarantee the security of Confidential Information or electronic communications passing over the internet. Customer therefore acknowledges that by using the Connected Services, Customer accepts all risks associated with access to and storage of Customer Data.
9. Security. Company has implemented various security measures for the purpose of protecting User’s data against accidental or unlawful access, unauthorized disclosure, loss, destruction, and alteration. Customer and Users are responsible for maintaining the confidentiality of User name(s) and password(s). Customer and Users are responsible for all uses of password(s), whether or not authorized by Customer or Users. Customer must inform Company immediately of any unauthorized use of User name(s) or password(s). Transmission of data over the Internet by its nature entails the use of systems under the control of third parties, and as a result Company cannot ensure total control of the security of such systems. Company will take commercially reasonable efforts to ensure that data and other configuration parameters are not visible or accessed by other customers. Customer and Users acknowledge that the very nature of communication via the Internet restricts Company from offering any guarantee of the privacy or confidentiality of information relating passing over the Internet. In gaining access via the Internet, Customer and Users also acknowledge and accept that electronic communication may not be free from interference by unauthorized persons and may not remain confidential and accept that access and storage of data is at Customer’s and Users’ own risk. Customer shall immediately notify Company in writing of any actual or suspected unauthorized use of any Customer account or disclosure of Confidential Information (“Security Incident”). Customer shall cooperate with reasonable Company requests to investigate Security Incidents, regain possession of Confidential Information, and prevent further Security Incidents.
10. Maintenance Services. Depending on the type of Connected Service, Company may, but is not obligated to, automatically install Updates without providing additional notice or obtaining additional consent from Customer. Company may also provide Updates to Customer to install on its Connected Systems. Customer acknowledges that Updates may result in the Connected Services being unavailable from time to time. Company shall have no liability for any losses resulting from Customer’s failure to install or to permit Company to install an Update or from the periodic unavailability of the Connected Services due to Updates.
11. Third-Party Products. The Connected Services may provide links to third-party websites and enable Customer to access content, products, and services of third parties (“Third-Party Products”). Customer acknowledges that Third-Party Products are not under Company’s control, and Company does not review, approve, monitor, endorse, warrant, or make any representations with respect to Third-Party Products. COMPANY HEREBY DISCLAIMS AND CUSTOMER HEREBY DISCHARGES, WAIVES AND RELEASES COMPANY AND ITS LICENSORS AND SUPPLIERS FROM ANY PAST, PRESENT, AND FUTURE CLAIMS, LIABILITIES, AND DAMAGES, KNOWN OR UNKNOWN, ARISING OUT OF OR RELATING TO CUSTOMER INTERACTIONS WITH THIRD-PARTY PRODUCTS.
12. Company Liability. Customer agrees that Company, its affiliates and their respective directors, officers, employees and agents, and its licensors and suppliers shall not be liable for any damages, liabilities, claims or demands (including costs and attorneys’ fees) made by any third party due to or arising out of Customer’s and each User’s (i) use of the Connected Services and any associated deliverables; (ii) violation of the terms applicable to Connected Services; (iii) Company’s possession or use of data, information or articles supplied by Customer to Company; and (iv) violation of any law or the rights of any third party, including, but not limited to, the infringement of intellectual property rights resulting from the use or possession by Company of Customer Data. Notwithstanding the foregoing, Customer shall not be liable for the negligent acts or omissions of Company. Company reserves the right to assume, at Customer’s expense, the exclusive defense and control of any matter for which Customer is required to indemnify Company, and Customer agrees to cooperate with Company’s defense of such claims. Customer agrees not to settle any such claim without Company’s prior written consent. Company will use reasonable efforts to notify Customer of any such claim, action or proceeding upon becoming aware of it.
13. NOTWITHSTANDING ANYTHING TO THE CONTRARY AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, COMPANY AND ITS LICENSORS AND SUPPLIERS PROVIDE THE CONNECTED SERVICES “AS IS” AND DISCLAIM ALL WARRANTIES AND CONDITIONS, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, ACCURACY, AND NON-INFRINGEMENT OF THIRD-PARTY RIGHTS. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED BY CUSTOMER FROM COMPANY OR THOUGH THE CONNECTED SERVICES SHALL CREATE ANY WARRANTY. COMPANY AND ITS LICENSORS AND SUPPLIERS DO NOT MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM THE CONNECTED SERVICES, OR AS TO THE TIMELINESS, EFFICACY, OPERABILITY, COMPLETENESS, ACCURACY, RELIABILITY OR CONTENT OF THE CONNECTED SERVICES, OR OF ANY DESIGN, FUNCTION, PROCESS, INFORMATION, SERVICE, OR MERCHANDISE PROVIDED THROUGH OR BY THE CONNECTED SERVICES.
14. Customer acknowledges that complex software applications are never entirely free from defects, errors, bugs, or vulnerabilities, and that the use of a remote connection is never entirely secure or free from interruption. NOTWITHSTANDING ANYTHING TO THE CONTRARY, COMPANY AND ITS LICENSORS AND SUPPLIERS DO NOT WARRANT THAT THE CONNECTED SERVICES WILL BE UNINTERRUPTED, SECURE OR ERROR FREE OR THAT COMPANY WILL CORRECT ALL ERRORS.
15. NOTWITHSTANDING ANYTHING TO THE CONTRARY AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, (A) IN NO EVENT WILL COMPANY BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, INDIRECT, CONSEQUENTIAL, EXEMPLARY, SPECIAL, PUNITIVE OR INCIDENTAL DAMAGES, INCLUDING ANY DAMAGES FOR LOST DATA OR LOST PROFITS) ARISING FROM OR RELATING TO THE CONNECTED SERVICES, EVEN IF COMPANY KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES, AND (B) COMPANY’S TOTAL CUMULATIVE LIABILITY ARISING FROM OR RELATED TO THE CONNECTED SERVICES, WHETHER IN CONTRACT OR TORT OR OTHERWISE, SHALL BE SUBJECT TO THE TOTAL LIMITATION OF LIABILITY SPECIFIED IN CLAUSE 13 OF THE SERVICE TERMS. THIS LIMITATION IS CUMULATIVE AND WILL NOT BE INCREASED BY THE EXISTENCE OF MORE THAN ONE INCIDENT OR CLAIM.
16. Definitions. The following definitions apply to these Connected Services Terms:
16.1 “Confidential Information” means information including, without limitation, Customer Data, computer programs, software, code, algorithms, know-how, formulas, processes, ideas, inventions (whether patentable or not), schematics and other technical, business, financial and product development plans, forecasts, strategies and information that Customer or Company know or should reasonably know based on the circumstances of disclosure is confidential to the disclosing party. Confidential Information excludes information that: (i) was or becomes publicly known through no fault of the receiving party; (ii) was rightfully known or becomes rightfully known to the receiving party without confidential or proprietary restriction from a source other than the disclosing party; (iii) is independently developed by the receiving party without the participation of individuals who have had access to the Confidential Information; (iv) is approved by the disclosing party for disclosure without restriction in a written document which is signed by a duly authorized officer of such disclosing party; or that (v) the receiving party is legally compelled to disclose; provided, however, that prior to any such compelled disclosure, the receiving party will (a) assert the privileged and confidential nature of the Confidential Information against the third party seeking disclosure and (b) cooperate fully with the disclosing party in protecting against any such disclosure and/or obtaining a protective order narrowing the scope of such disclosure and/or use of the Confidential Information. In the event that such protection against disclosure is not obtained, the receiving Party will be entitled to disclose the Confidential Information, but only as, and to the extent, necessary to legally comply with such compelled disclosure.
16.2 "User" means an individual who has been authorized by Customer to use, and who has been supplied user identification and a password to access, the Connected Services by Customer (or by Company at Customer's request). Users may include but are not limited to Customer's employees, consultants, contractors and agents; or third parties with which the Customer transacts business.
SECURITY ADDENDUM
This Addendum shall be applicable to the sale, installation and use of Trane equipment and the sale and provision of Trane services. “Trane” shall mean the Trane entity that provides Trane equipment to or perform Trane services for Customer.
1. Definitions. All terms used in this Addendum shall have the meaning specified in the Agreement unless otherwise defined herein. For the purposes of this Addendum, the following terms are defined as follows:
“Customer Data” means Customer account information as related to the Services only and does not include HVAC Machine Data or personal data. Trane does not require, nor shall Customer provide personal data to Trane under the Agreement. Such data is not required for Trane to provide its Equipment and/or Services to the Customer.
“Equipment” shall have the meaning set forth in the Agreement.
“HVAC Machine Data” means data generated and collected from the product or furnished service without manual entry. HVAC Machine Data is data relating to the physical measurements and operating conditions of a HVAC system, such as but not limited to, temperatures, humidity, pressure, HVAC equipment status. HVAC Machine Data does not include Personal Data and, for the purposes of this agreement, the names of users of Trane’s controls products or hosted applications shall not be Personal Data, if any such user chooses to use his/her name(s) in the created accounts within the controls product (e.g., firstname.lastname@address.com). HVAC Machine Data may be used by Trane: (a) to provide better support services and/or products to users of its products and services; (b) to assess compliance with Trane terms and conditions; (c) for statistical or other analysis of the collective characteristics and behaviors of product and services users; (d) to backup user and other data or information and/or provide remote support and/or restoration; (e) to provide or undertake: engineering analysis; failure analysis; warranty analysis; energy analysis; predictive analysis; service analysis; product usage analysis; and/or other desirable analysis, including, but not limited to, histories or trends of any of the foregoing; and (f) to otherwise understand and respond to the needs of users of the product or furnished service. “Personal Data” means data and/or information that is owned or controlled by Customer, and that names or identifies, or is about a natural person, such as: (i) data that is explicitly defined as a regulated category of data under any data privacy laws applicable to Customer; (ii) non-public personal information (“NPI”) or personal information (“PI”), such as national identification number, passport number, social security number, social insurance number, or driver’s license number; (iii) health or medical information, such as insurance information, medical prognosis, diagnosis information, or genetic information; (iv) financial information, such as a policy number, credit card number, and/or bank account number; (v) personally identifying technical information (whether transmitted or stored in cookies, devices, or otherwise), such as IP address, MAC address, device identifier, International Mobile Equipment Identifier (“IMEI”), or advertising identifier; (vi) biometric information; and/or (vii) sensitive personal data, such as, race, religion, marital status, disability, gender, sexual orientation, geolocation, or mother’s maiden name.
“Security Incident” shall refer to (i) a compromise of any network, system, application or data in which Customer Data has been accessed or acquired by an unauthorized third party; (ii) any situation where Trane reasonably suspects that such compromise may have occurred; or (iii) any actual or reasonably suspected unauthorized or illegal Processing, loss, use, disclosure or acquisition of or access to any Customer Data.
“Services” shall have the meaning set forth in the Agreement.
2. HVAC Machine Data; Access to Customer Extranet and Third Party Systems. If Customer grants Trane access to HVAC Machine Data via web portals or other non-public websites or extranet services on Customer’s or a third party’s website or system (each, an “Extranet”), Trane will comply with the following:
a. Accounts. Trane will ensure that Trane’s personnel use only the Extranet account(s) designated by Customer and will require Trane personnel to keep their access credentials confidential.
b. Systems. Trane will access the Extranet only through computing or processing systems or applications running operating systems managed by Trane that include: (i) system network firewalls; (ii) centralized patch management; (iii) operating system appropriate anti-malware software; and (iv) for portable devices, full disk encryption.
c. Restrictions. Unless otherwise approved by Customer in writing, Trane will not download, mirror or permanently store any HVAC Machine Data from any Extranet on any medium, including any machines, devices or servers.
d. Account Termination. Trane will terminate the account of each of Trane’s personnel in accordance with Trane’s standard practices after any specific Trane personnel who has been authorized to access any Extranet (1) no longer needs access to HVAC Machine Data or (2) no longer qualifies as Trane personnel (e.g., the individual leaves Trane’s employment).
e. Third Party Systems. Trane will provide Customer prior notice before it uses any third party system that stores or may otherwise have access to HVAC Machine Data, unless (1) the data is encrypted and (2) the third party system will not have access to the decryption key or unencrypted “plain text” versions of the HVAC Machine Data.
3. Customer Data; Confidentiality. Trane shall keep confidential, and shall not access or use any Customer Data and information that is marked confidential or by its nature is considered confidential (“Customer Confidential Information”) other than for the purpose of providing the Equipment and Services, and will disclose Customer Confidential Information only: (i) to Trane’s employees and agents who have a need to know to perform the Services, (ii) as expressly permitted or instructed by Customer, or (iii) to the minimum extent required to comply with applicable law, provided that Trane (1) provides Customer with prompt written notice prior to any such disclosure, and (2) reasonably cooperate with Customer to limit or prevent such disclosure.
4. Customer Data; Compliance with Laws. Trane agrees to comply with laws, regulations governmental requirements and industry standards and practices relating to the Trane’s processing of Customer Confidential Information (collectively, “Laws”).
5. Customer Data; Information Security Management. Trane agrees to establish and maintain an information security and privacy program, consistent with applicable HVAC equipment industry practices that complies with this Addendum and applicable Laws (“Information Security Program”). The Information Security Program shall include appropriate physical, technical and administrative safeguards, including any safeguards and controls agreed by the Parties in writing, sufficient to protect Customer systems, and Customer’s Confidential Information from unauthorized access, destruction, use, modification or disclosure. The Information Security Program shall include appropriate, ongoing training and awareness programs designed to ensure that Trane’s employees and agents, and others acting on Trane’s, behalf are aware of and comply with the Information Security Program’s policies, procedures, and protocols.
6. Monitoring. Trane shall monitor and, at regular intervals consistent with HVAC equipment industry practices, test and evaluate the effectiveness of its Information Security Program. Trane shall evaluate and promptly adjust its Information Security Program in light of the results of the testing and monitoring, any material changes to its operations or business arrangements, or any other facts or circumstances that Trane knows or reasonably should know may have a material impact on the security of Customer Confidential Information, Customer systems and Customer property.
7. Audits. Customer acknowledges and agrees that the Trane SOC2 audit report will be used to satisfy any and all audit/inspection requests/requirements by or on behalf of Customer. Trane will make its SOC2 audit report available to Customer upon request and with a signed nondisclosure agreement.
8. Information Security Contact. Trane’s information security contact is Local Sales Office.
9. Security Incident Management. Trane shall notify Customer after the confirmation of a Security Incident that affects Customer Confidential Information, Customer systems and Customer property. The written notice shall summarize the nature and scope of the Security Incident and the corrective action already taken or planned.
10. Threat and Vulnerability Management. Trane regularly performs vulnerability scans and addresses detected vulnerabilities on a risk basis. Periodically, Trane engages third-parties to perform network vulnerability assessments and penetration testing. Vulnerabilities will be reported in accordance with Trane’s cybersecurity vulnerability reported process. Trane periodically provides security updates and software upgrades.
11. Security Training and Awareness. New employees are required to complete security training as part of the new hire process and receive annual and targeted training (as needed and appropriate to their role) thereafter to help maintain compliance with Security Policies, as well as other corporate policies, such as the Trane Code of Conduct. This includes requiring Trane employees to annually re-acknowledge the Code of Conduct and other Trane policies as appropriate. Trane conducts periodic security awareness campaigns to educate personnel about their responsibilities and provide guidance to create and maintain a secure workplace.
12. Secure Disposal Policies. Trane will maintain policies, processes, and procedures regarding the disposal of tangible and intangible property containing Customer Confidential Information so that wherever possible, Customer Confidential Information cannot be practicably read or reconstructed.
13. Logical Access Controls. Trane employs internal monitoring and logging technology to help detect and prevent unauthorized access attempts to Trane’s corporate networks and production systems. Trane’s monitoring includes a review of changes affecting systems’ handling authentication, authorization, and auditing, and privileged access to Trane production systems. Trane uses the principle of “least privilege” (meaning access denied unless specifically granted) for access to customer data.
14. Contingency Planning/Disaster Recovery. Trane will implement policies and procedures required to respond to an emergency or other occurrence (i.e. fire, vandalism, system failure, natural disaster) that could damage Customer Data or any system that contains Customer Data. Procedures include the following
a. Data backups; and
b. Formal disaster recovery plan. Such disaster recovery plan is tested at least annually.
15. Return of Customer Data. If Trane is responsible for storing or receiving Customer Data, Trane shall, at Customer’s sole discretion, deliver Customer Data to Customer in its preferred format within a commercially reasonable period of time following the expiration or earlier termination of the Agreement or, such earlier time as Customer requests, securely destroy or render unreadable or undecipherable each and every original and copy in every media of all Customer’s Data in Trane’s possession, custody or control no later than [90 days] after receipt of Customer’s written instructions directing Trane to delete the Customer Data.
16. Background Checks. Trane shall take reasonable steps to ensure the reliability of its employees or other personnel having access to the Customer Data, including the conducting of appropriate background and/or verification checks in accordance with Trane policies.
17. DISCLAIMER OF WARRANTIES. EXCEPT FOR ANY APPLICABLE WARRANTIES IN THE AGREEMENT, THE SERVICES ARE PROVIDED "AS IS", WITH ALL FAULTS, AND THE ENTIRE RISK AS TO SATISFACTORY QUALITY, PERFORMANCE, ACCURACY AND EFFORT AS TO SUCH SERVICES SHALL BE WITH CUSTOMER. TRANE DISCLAIMS ANY AND ALL OTHER EXPRESS OR IMPLIED REPRESENTATIONS AND WARRANTIES WITH RESPECT TO THE SERVICES AND THE SERVICES PROVIDED HEREUNDER, INCLUDING ANY EXPRESS OR IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR THAT THE SERVICES WILL OPERATE ERROR-FREE OR UNINTERRUPTED OR RETURN/RESPONSE TO INQUIRIES WITHIN ANY SPECIFIC PERIOD OF TIME.