Grab Fair Play Rewards Programme

Transcription

1 Grab Fair Play Rewards Programme Programme Terms of Use Your participation in the Grab Fair Play Rewards Programme is voluntary. By submitting a fraud vulnerability to Grabtaxi Holdings Pte Ltd (Company no.: E) ( Grab ), you acknowledge and agree that you have read and agreed that your participation is subject at all times to the terms and conditions set forth on this page ( Programme Terms ). Any submission you make to Grab, whether via the Grab Fair Play Rewards Programme or otherwise will be considered as a Submission. Applicants are to research Grab s services at their own time, via their own means and resources before filing a Submission. You are not eligible to participate in the Grab Fair Play Rewards Programme if you are: (i) employed by Grab Inc or any of its affiliates or subsidiaries (ii) an immediate family member of a person employed by Grab Inc or any of its affiliates or subsidiaries; (iii) less than 18 years of age, or if you are at least 18 years old, but are considered a minor in your place of residence, you must get your parent s or legal guardian s permission prior to participating in the programme or (iv) be in violation of any national, state or local laws, or regulations and your testing must not violate any law or disrupt or comprising any data that is not your own. If (i) you fall under any of the descriptions above; (ii) you breach any of these Programme Terms or any other agreement you have with Grab or its affiliates or subsidiaries; or (iii) Grab determines that your participation in the Grab Fair Play Rewards Programme could adversely impact Grab its affiliates or any of their users, employees or agents, Grab, in its sole discretion, may remove you from the Grab Fair Play Rewards Programme and/or disqualify you from receiving any benefit of the Grab Fair Play Rewards Programme. Submission Guidelines By agreeing to the Programme Terms, you agree not to disturb the integrity or availability of Grab services, and the Grab App and not to cause inconveniences or damages to other users of the services or results in you, or any third party, accessing, storing, sharing or destroying Grab or customer data, or (may impact Grab s customers, such as but not limited to, denial of service, social engineering or spam. If during the course of your research, you notice performance degradation on the target systems, you must immediately cease all action causing the degradation, including suspending all use of automated tools. You further agree not to share the Submission of your research/findings with third parties, and not to make the findings of vulnerabilities public without the written consent of Grab. Failure to follow these guidelines will result in immediate disqualification from the Grab Fair Play Rewards Programme and ineligibility for receiving any Reward payments. You hereby grant to Grab and its affiliates a perpetual, irrevocable, worldwide, royalty-free, transferable, sub-licensable (through multiple tiers) and exclusive license to use, reproduce, adapt, modify, publish, distribute, publicly perform, reverse engineer, copy, create derivative works from, make, use, sell, offer for sale and import your Submissions, and any materials submitted by you in connection with your

2 Submissions, for any purpose. You should not send us any Submission that you do not wish to license to us. You hereby represent and warrant that all Submissions are original to you and you own right, title, and interest therein and thereto. Also, you hereby waive all other claims of any nature arising out from any disclosure of Submission to Grab. In no event shall Grab be precluded from discussing, reviewing, developing for itself, having developed, or developing for third parties, materials which are competitive with those set forth in your Submissions irrespective of their similarity to the information in the Submission. Reward Payments You may be eligible to receive a monetary reward, if: (i) you are the first person to submit a site or product vulnerability; (ii) the minimum severity threshold is met, with the vulnerability is verifiable, replicable, and determined to be a valid security issue by Grab s fraud prevention team; and (iii) you have complied with all Programme Terms ( Reward ). Grab has the sole discretion to determine whether to award any Rewards payment for Submissions made and such payments will be made on a complimentary basis. In the event Grab elects to pay you a Reward, Grab may make a partial payment when the vulnerability is first verified by Grab and then an additional payment once the vulnerability has been fixed. The format and timing of all Reward payments shall be determined in Grab s sole discretion. All Reward payments will be made in the local currency you have made a Submissions to, subject to Grab s final and sole discretion. You will be responsible for any tax implications related to Reward payments you receive, as determined by the laws of your jurisdiction of residence or citizenship. Grab will determine all Reward payout based on the risk and impact of the vulnerability. The maximum Reward per validated Submission is an equivalent amount of local currency amounting to USD$1000. Grab retains the right to determine if the fraud submitted to the Grab Fair Play Rewards Programme is eligible. All determinations as to the amount of a Reward made by the Grab are final and binding. Additional Terms Payout ranges are based on the classification and sensitivity of the data impacted, ease of exploit and overall risk to Grab customers, Grab brand and determined to be a valid fraudulent activity by fraud prevention team. Common sensitive data elements include customer social security number, credit card number, card verification code, bank account number, login credentials and passwords. Grab may pay beyond the range at times when fraud vulnerability are found to have significant risk.

3 Coordinated Disclosure Rules You will inform us as soon as possible upon discovery of a potential fraud case, Grab shall make every effort to quickly correct the issue. You agree to provide Grab a reasonable amount of time to act upon the issue before publishing it elsewhere. You agree to make a good faith effort not to leak, manipulate, or destroy any user data. You will only test against accounts you own yourself or with explicit permission of the account holder. You will refrain from automated/scripted account creation. Your activities are limited exclusively to: (1) Testing to detect a vulnerability or identify an indicator related to a vulnerability; or (2) Sharing with, or receiving from, Grab information about a vulnerability or an indicator related to a vulnerability. You do no harm and do not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability. You avoid intentionally accessing the content of any communications, data, or information transiting or stored on Grab information system(s) except to the extent that the information is directly related to a vulnerability and the access is necessary to prove that the vulnerability exists. You do not exhilarate any data under any circumstances. You do not intentionally compromise the privacy or safety of Grab personnel or any third parties related to Grab. You do not intentionally compromise the intellectual property or other commercial or financial interests of any Grab personnel or entities, or any third parties. You do not publicly disclose any details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability, except upon receiving explicit written authorization from Grab. You do not conduct denial of service testing. You do not conduct social engineering, including spear phishing, of Grab personnel or contractors. You do not submit a high-volume of low-quality reports. If at any point you are uncertain whether to continue testing, please engage with our team. Termination In the event (i) you breach any of these Programme Terms or (ii) Grab determines, in its sole discretion that your continued participation in the Grab Fair Play Rewards Programme could adversely impact Grab (including, but not limited to, presenting any threat to Grab s systems, security, finances and/or reputation) Grab may immediately terminate your participation in the Grab Fair Play Rewards Programme and disqualify you from receiving any Reward payments. Grab s decision is final and binding. Confidentiality Any information you receive or collect about Grab or any Grab user through the Grab Fair Play Rewards Programme ( Confidential Information ) must be kept confidential and only used in connection with the

4 Grab Fair Play Rewards Programme. You may not use, disclose or distribute any such Confidential Information, including, but not limited to, any information regarding your Submission and information you obtain when researching the Grab sites, without Grab s prior written consent. Indemnification You hereby agree to defend, indemnify and hold Grab, its subsidiaries, affiliates and the officers, directors, agents, joint ventures, employees and suppliers of Grab, its subsidiaries, or our affiliates, harmless from any claim or demand (including attorneys fees) made or incurred by any third party due to or arising out of your Submissions, your breach of these Programme Terms and/or your improper use of the Grab Fair Play Rewards Programme. Changes to Programme Terms The Grab Fair Play Rewards Programme, including its policies, is subject to change or cancellation by Grab at any time, without notice. As such, Grab may amend these Programme Terms and/or its policies at any time by posting a revised version on our website. By continuing to participate in the Grab Fair Play Rewards Programme after Grab posts any such changes, you accept the Programme Terms, as modified. General The Programme Terms shall be governed by Singapore law, without regard to the choice or conflicts of law provisions of any jurisdiction, and any disputes, actions, claims or causes of action arising out of or in connection with this Programme Terms shall be subject to the exclusive jurisdiction of the courts of Singapore to which you hereby agree to submit to. All unresolved disputes shall be referred to the Singapore International Arbitration Centre ( SIAC ), in accordance with the Rules of the SIAC as modified or amended from time to time (the Rules ) by a sole arbitrator appointed by the mutual agreement of the parties (the Arbitrator ). If parties are unable to agree on an arbitrator, the Arbitrator shall be appointed by the President of SIAC in accordance with the Rules. Grab may at any time change the governing law and venue and laws of arbitration, subject to sole discretion of Grab. The seat and venue of the arbitration shall be Singapore, in the English language and the fees of the Arbitrator shall be borne equally by the parties, provided that the Arbitrator may require that such fees be borne in such other manner as the Arbitrator determines is required in order for this arbitration clause to be enforceable under applicable law. No joint venture, partnership, employment, or agency relationship exists between you, Grab or any third party provider as a result of this Programme Terms.

5 If any provision of this Programme Terms held to be invalid or unenforceable, such provision shall be struck and the remaining provisions shall be enforced to the fullest extent under law. This shall, without limitation, also apply to the applicable law and jurisdiction as stipulated above. The failure of Grab to enforce any right or provision in this Programme Terms shall not constitute a waiver of such right or provision unless acknowledged and agreed to by Grab in writing. The Programme Terms comprises the entire agreement between you and Grab and supersedes all prior or contemporaneous negotiations or discussions, whether written or oral (if any) between the parties regarding the subject matter contained herein. You hereby agree that the Grab is entitled to terminate this Programme Terms immediately in the event that you are found to be in breach of any of the terms stipulated in this Programme Terms. For the avoidance of doubt, the termination of this Programme Terms shall not require the Grab to compensate, reimburse or cover any cost incurred by you in the course of your participation under this Programme Terms.