Privacy Notice

Last updated: September 2026

About this Privacy Notice

This Privacy Notice is meant to give you information about what personal data we collect about you, how we use it, why we use it, and how you control the data processing.

1. The Basics

1.1. Who We Are

1.1.1. We, the Grapa Global LLC, are engaged in the breeding, licensing, and global commercialization of proprietary table grape varieties, including the ARRA varieties and Early Sweet, and we operate our websites and related online services at grapaglobal.com.

1.1.2. If you have questions about our company or your privacy, or want to exercise your rights, you can contact us at info@grapaglobal.com.

1.1.3. If you have specific requests under European law, you can also contact us, by way of our representative in the European Union (EU), at: Mrs. Vera Lyssiotis, contact details: 3A Orfeos Street, 1070 Nicosia, Cyprus, 357 22348042, vera@lyssiotislaw.com.

1.2. Our Role: Controller

Certain data protection laws, including the laws in the EU, differentiate between a party that determines why and how personal data is processed (called a "controller") and a party that processes personal data solely on the controller's behalf and according to the controller's instructions (called a "processor"). We are the controller in respect of the processing described in this Privacy Notice.

1.3. Definitions and Recommendations

1.3.1. When we refer to "services", we mean our websites ("site") and related online services, licensing and sublicensing operations (including CRM and contracting workflows), technical and agronomic support, events and surveys, and associated customer/partner communications, as applicable.

1.3.2. When we refer to "personal data", we mean information that is defined as personal data under law. This includes information that identifies you directly or indirectly, including unique identifiers like IP addresses or cookie IDs.

1.3.3. When we refer to "you", we mean site visitors; business contacts acting on behalf of licensees, agents, or other partners; job applicants; event participants and survey respondents; and visitors to our social media pages, as applicable.

1.3.4. This Privacy Notice is meant to be read together with any other contractual document you may have with us for the provision of applicable services. In general, we recommend that you routinely review this Privacy Notice and your preferences on our site.

1.4. A Note on Legal Bases

Certain jurisdictions only allow the processing of personal data where a legal basis has been established. Under the EU's General Data Protection Regulation ("GDPR"), the possible legal bases include (but are not limited to): your consent, the processing is necessary to perform a contract with you, the processing is necessary to fulfill our legal obligations, or a company has a legitimate business interest to process your personal data. Where we are a controller, we only collect and process data where we have established a legal basis. Below you can find more details about specific legal bases. Under Israeli law, the legal basis for processing is consent. You are not required under law to provide us with the Personal Data described in this Privacy Notice. However, if you do not agree to provide the same, we will not be able to provide you with some or all of our Services.

2. Personal Data We Collect, How We Use It, and Why

Below is a description of the types of personal data we collect, how we use it, and the reason why we consider each use lawful. You have no legal obligation to provide us with personal data, but if you don't provide us with certain information, we may not be able to provide you with the associated services.

2.1. Site Visitors

When you visit our site, we may collect the following types of data about you.

2.1.1. Contact Form Information

When you send us a message through the contact form on our site, we collect data you provide, such as your name and surname, company name, country/location, email address, phone number, and the content of your inquiry.

How We Use this Data: To respond to your inquiry and manage our relationship with you; to provide newsletters and other promotional materials; and to route technical or agronomic support or other service requests to the appropriate team.

Legal Basis: When we use this data to respond to your inquiry, manage our relationship with you, or route your request to the appropriate team, we do so on the basis of our legitimate interests in operating our business and providing services you request, and, where applicable, performance of a contract or to take steps at your request prior to entering into a contract. When we use this data to send you newsletters or other promotional materials, we do so on the basis of your consent, in jurisdictions where required by law. You can withdraw consent at any time using the unsubscribe link or by contacting us at info@grapaglobal.com.

2.1.2. Activity and System Data (Including Cookies)

When you visit our site, we automatically collect data about your computer or mobile device, including personal data such as your IP address, device ID, usage data, metadata, and your activity on our site (e.g. what pages you visited, for how long, and what links you clicked on). For more information about the Cookies we use and how to adjust your preferences, see the Cookies and Similar Technologies section below.

How We Use this Data: (a) to provide and secure the site and related services you request; and (b) to generate aggregated analytics to maintain and improve the site and our services, including customer retention, analyzing usage patterns and predicting customer needs, identifying market trends. One of the tools we use to collect and analyze this data is Google Analytics. For more information about how Google collects information and how you can control such use, see: www.google.com/policies/privacy/partners/.

Legal Basis: Providing the site and related services you request is necessary for the performance of a contract with you (our site terms). Improvement and analytics activities are based on your consent for non-essential cookies (which you may withdraw at any time via our cookie banner).

2.2. Business Contacts, Licensees and Sub-Licensees

If you are a business contact, licensee, sub-licensee, or an individual acting on behalf of same, agent, or other partner, we collect the following information about you.

2.2.1. Licensee, Sub-Licensee and Partner Contact Details

Names, job titles, business contact details (email, phone), company affiliation, territory, and communications, including legal representative and signatory details. This includes contract execution details processed via electronic signature as part of our contracting workflows (e.g., signatory names, email addresses, and signing metadata). We may also collect information related to your agricultural operations such as plantation details, crop varieties, field coordinates, total farm area, farm addresses, and landowner identity.

How We Use this Data: To negotiate, enter into, and manage licenses and sub-licenses and related agreements; to administer sublicensing structures; to provide technical and agronomic support and other services; and to maintain our CRM.

Legal Basis: Performance of a contract or taking steps at your request prior to entering into a contract; compliance with legal obligations (e.g., tax/accounting); and our legitimate interests in operating and growing our licensing programs and enforcing our rights.

2.2.2. Publicly Available Business Information

We may collect publicly available professional information about existing business contacts from sources such as LinkedIn, including name, job title, employer, professional history, and business contact details.

How We Use this Data: To verify, update, or supplement contact details in our CRM; to ensure the accuracy and currency of our business contact records; and to support relationship management with existing licensees, sub-licensees, agents, and partners.

Legal Basis: Our legitimate interest in maintaining accurate and up-to-date contact information for our business relationships and in managing our commercial relationships efficiently. This collection is limited to publicly indexed information about business contacts, such as links to professional networking profiles like LinkedIn.

2.2.3. Finance and Invoicing Records

Business billing contacts (name, role, work email/phone); organization identifiers (legal name, registered address, registration number, VAT/tax ID, billing/shipping addresses); commercial records tied to invoicing (PO numbers, contract/license references, territory codes, customer account ID); invoice and payment data (invoice numbers/dates, line items, amounts, currency, discounts/credits, payment terms, due dates, remittance details, payment status); and banking/remittance details if provided by the counterparty (beneficiary name, bank name/address, IBAN/account number, SWIFT/BIC).

How We Use this Data: To issue invoices, process payments, and reconcile accounts, and to resolve billing queries (including maintaining an ERP audit trail).

Legal Basis: Performance of a contract (to fulfill our invoicing and payment obligations); compliance with legal obligations (such as tax and accounting); and our legitimate interests in operating our business efficiently.

2.3. Job Applicants

2.3.1. Application Details

If you apply for a job with us, we collect the information you provide as part of your application and during the course of application processes. This may include your name, contact details, resume, recommendations, and any other information we may request or that you choose to share with us.

How We Use this Data: We use this data to process your job application, including using your contact details to contact you for scheduling purposes and to provide you with updates. We also use this data to manage our recruitment campaigns, as well as to analyze their results and improve future campaigns.

Legal Basis: When we use this data to process your job application, we do so based on performance of a contract with you or in order to take steps at your request prior to entering into a contract. When we use this data to manage our current campaigns and improve future campaigns, we process your application data based on our legitimate interest to attract and assess candidates for employment.

2.4. Event and Survey Participants

From time to time, we hold special events or surveys in which we may invite you to participate. If you receive an invitation, we may collect the following Personal Data from you:

2.4.1. Registration Data

When you register for and participate in an event or survey, we collect your name, contact details, and any other information we may request.

How We Use this Data: We use this data for logistical purposes, such as to help us plan and administer the event or survey, as well as to contact you with reminders and updates about the event and to ask for your feedback regarding the event so that we may improve future surveys, events or our services. If you consent, we may also send you marketing information about future events and other (promotional) updates.

Legal Basis: When we process this personal data in the course of planning for and running the event or survey, we do so in order to perform a contract with you. When we process this personal data to improve our events and services, we do so based on our legitimate interest to grow and improve our business and services. When we process this personal data to send you marketing information, we do so based on your consent. You may withdraw your consent at any time by contacting us at info@grapaglobal.com.

2.4.2. Event Pictures

We may hire photographers to cover certain events. Event participants may be photographed directly or may appear in the background of event photos.

How We Use this Data: We may post event pictures, including on social media, to notify or update the public that the event took place. We may tag individuals in specific photos. We may also use the photos in other marketing materials.

Legal Basis: When we collect event pictures, we do so on the basis of our legitimate interest to market future events and our services.

2.5.1. Visitors' Interactions

When you engage with our social media outlets, such as when you post on our LinkedIn page, like, share, or comment on our posts, answer surveys, or similar activities, we collect the personal data you provide, such as the content of your post and the information available to us through your profile or account. The social media companies we use may also provide us with aggregate and analytical information about activity relating to us.

How We Use this Data: We may use this information to engage with you or respond to your posts and comments and to analyze the effectiveness of our social media efforts and to improve how we manage them, and for marketing purposes.

Legal Basis: When we process your personal data to engage with you or respond to your posts and comments, we do so on the basis of our legitimate interest to engage with and serve our audiences in an effective manner. When we process your personal data to improve our social media outlets or for marketing purposes, we do so based on our legitimate interest to effectively market our products and services, improve our services, and develop new ones.

2.6. Enforcement and Legal Compliance

In all cases, we may also process personal data as necessary to enforce our rights and contracts, protect our assets, prevent and respond to fraud, security, or legal incidents, and to pursue available remedies or limit damages we may sustain. We carry out this processing on the basis of our legitimate interests and, where applicable, to comply with legal obligations.

3. Our Marketing Activities

As described above, we may use personal data we collect for marketing purposes. We try to limit the marketing material we send to a reasonable and proportionate level. We send marketing communications on the basis of your consent. You can withdraw your consent at any time using the unsubscribe link in our emails or by contacting us at info@grapaglobal.com to request to unsubscribe. We may tailor communications based on your interests, location, and prior event participation. We may also use engagement metrics (e.g., opens and clicks) derived from cookies and similar technologies embedded in marketing materials we send you; for more information, see the Cookies and Similar Technologies section below. Note that if you are a customer or a partner (or representative thereof), we may need to contact you about administrative or service-related issues as part of the services we provide to you. This is not marketing communication and you will continue to receive these messages even if you opt-out of marketing emails.

We share your personal data as follows:

4.1. Affiliates

We share personal data with our affiliated companies, where this is necessary to operate our licensing, technical support, IP management, events and marketing, finance, and contracting activities.

4.2. Licensees, Sub-Licensees, Agents, and Partners

If you are a representative or employee of a licensee, sub-licensee, agent, or partner, your organization may have access to personal data we hold about you in connection with our business relationship. For example, if you interact with us on behalf of a licensee, we may share relevant contact and transaction details with that licensee or with agents involved in administering the license. Similarly, where a licensee transacts through an agent, we may share personal data with both the agent and the licensee to the extent necessary to perform our contractual obligations, manage the commercial relationship, and provide technical or agronomic support. We process such sharing on the basis of our legitimate interests in operating our licensing programs and, where applicable, performance of a contract.

4.3. Service Providers

Below is a list of the types of service providers we use, the service each provides, and the types of data shared with each. All service providers have agreed to confidentiality restrictions and have undertaken to use your personal data solely as we direct.

Type of Service	Description	Personal Data Shared
Productivity, collaboration, CRM platform, ERP and Invoicing, Hosting, IT support, and site development	Productivity and collaboration platform providing email, document storage/collaboration, CRM capabilities, and access control; device and endpoint management; and assistance features to increase productivity. Enterprise resource planning and invoicing platform used to issue invoices, manage finance operations, and reconcile accounts, hosted on cloud infrastructure (region to be confirmed); Hosting, maintenance, and technical support services that may involve incidental access to systems for troubleshooting, performance, and security.	All categories described in Section 2 (contact details, communications, CRM records, device telemetry). Finance and invoicing records (see Section 2.2.2). In addition, Access to all data stored on hosted systems, as needed for support.
Email Marketing and Campaign Management	Mailing list and campaign management service used to send newsletters and updates to opted-in recipients and to measure engagement for performance evaluation and personalization.	Name and email address (see Section 3).
E-signature	Electronic signature platform used to execute contracts and record signing events and metadata. We currently use DocuSign as our e-signature platform. For more information, see DocuSign's Privacy Policy.	Signatory names, email addresses, and signing metadata (see Section 2.2.1).

Type of Service

Description

Personal Data Shared

Productivity, collaboration, CRM platform, ERP and Invoicing, Hosting, IT support, and site development

Productivity and collaboration platform providing email, document storage/collaboration, CRM capabilities, and access control; device and endpoint management; and assistance features to increase productivity.

Enterprise resource planning and invoicing platform used to issue invoices, manage finance operations, and reconcile accounts, hosted on cloud infrastructure (region to be confirmed); Hosting, maintenance, and technical support services that may involve incidental access to systems for troubleshooting, performance, and security.

All categories described in Section 2 (contact details, communications, CRM records, device telemetry).

Finance and invoicing records (see Section 2.2.2). In addition, Access to all data stored on hosted systems, as needed for support.

Email Marketing and Campaign Management

Mailing list and campaign management service used to send newsletters and updates to opted-in recipients and to measure engagement for performance evaluation and personalization.

Name and email address (see Section 3).

E-signature

Electronic signature platform used to execute contracts and record signing events and metadata. We currently use DocuSign as our e-signature platform. For more information, see DocuSign's Privacy Policy.

Signatory names, email addresses, and signing metadata (see Section 2.2.1).

4.4. Change of Ownership

If we are looking to sell our company, liquidate assets, or merge with another, we may share your personal data with other interested parties as part of negotiations toward that transaction. In such case, or where we do sell our company, your personal data shall continue to be subject to the provisions of this Privacy Notice.

4.5. Law Enforcement Related Disclosure

We may share your personal data with government agencies or other relevant parties, such as a law office or independent auditor: (i) if we believe that such disclosure is appropriate to protect our rights, property or safety (including the enforcement of site terms of service, licenses, sub-licenses or other agreements and this Privacy Notice) or those of a third party; (ii) if required by law or court order; or (iii) as is necessary to comply with any legal and/or regulatory obligations, such as audit requirements.

5. International Transfers

Some of our service providers and affiliates are located in countries other than your own. When we transfer your personal data internationally, we will do so safely and securely and in accordance with applicable law.

5.1. If you are located in the EU, when we share your personal data with third parties based outside of the European Economic Area (EEA), we ensure that such transfers are made in accordance with applicable law. To that end, we implement one or more of the following safeguards:

5.1.1. When we transfer your personal data to Israel, we rely on the European Commission's adequacy decision recognizing Israel as providing an adequate level of data protection.

5.1.2. When we transfer your personal data to entities in the United States that participate in the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision for those certified organizations.

5.1.3. Where we transfer your personal data to other countries or to US entities that are not DPF-certified, we use the European Commission's Standard Contractual Clauses and, where appropriate, additional supplementary measures.

5.1.4. Please contact us at info@grapaglobal.com if you would like further information on the specific mechanism used by us when transferring your Personal Data out of the EEA.

6. Security

We maintain organizational and technical measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures include role-based access controls across our platforms, multi-factor authentication for users, device management for company endpoints, and endpoint protection. Access to personal data is limited to personnel with a need to know and is periodically reviewed. We also require appropriate safeguards from our service providers. While we cannot guarantee absolute security, we work to maintain protections aligned with the nature of our processing and industry practice.

7. Your Rights - How to Control Our Use of Your Personal Data

Depending on which laws apply, you have certain legal rights over your data. Below is some general information about rights that may apply to you, but we recommend checking the law or consulting with a lawyer to understand what applies in your specific case. To exercise your rights, please contact us at info@grapaglobal.com. We may ask for reasonable evidence to verify your identity before we can comply with any request.

7.1. Right of Access

You may have a right to know what personal data we collect about you. We may charge you with a fee to provide you with this information, if permitted by law. If we are unable to provide you with all the information you request, we will do our best to explain why. See Article 15 of the GDPR for more details, if your personal data is subject to GDPR.

7.2. Right to Correct Personal Data

You may request that we update, complete, correct or delete inaccurate, incomplete, or outdated Personal Data. See Article 16 of the GDPR for more details, if your personal data is subject to GDPR.

7.3. Deletion of Personal Data ("Right to Be Forgotten")

If you are located in the EU, you may have the right to request that we delete your personal data. Note that we cannot restore information once it has been deleted. Even after you ask us to delete your personal data, we may be allowed to keep certain data for specific purposes under applicable law. See Article 17 of the GDPR for more details, if your personal data is subject to GDPR.

7.4. Right to Restrict Processing

If you are located in the EU, you may have the right to ask us to stop processing your personal data. See Article 18 of the GDPR for more details, if your personal data is subject to GDPR.

7.5. Right to Data Portability

If you are located in the EU, you may have the right to request that we provide you with a copy of the personal data you provided to us in a structured, commonly-used, and machine-readable format. See Article 20 of the GDPR for more details, if your personal data is subject to GDPR.

7.6. Right to Object

If you are located in the EU, you may have the right to object to certain processing activities. See Article 21 of the GDPR for more details, if your personal data is subject to GDPR.

7.7. Withdrawal of Consent

If we are processing your data based on your consent, you are always free to withdraw your consent, however, this won't affect processing we have done from before you withdrew your consent.

7.8. Right to Lodge a Complaint with Your Local Data Protection Authority

If you are located in the EU, you have the right to submit a complaint to the relevant data protection authority if you have any concerns about how we are processing your personal data, though we ask that as a courtesy you please attempt to resolve any issues with us first.

7.9. Your Rights Under Israeli Law

If you are subject to Israeli law, you may request to access any personal data you have provided to us and request that such personal data be corrected, updated, or deleted, including in accordance with Articles 13 through 14 of the Israeli Privacy Protection Law, 1981. You may exercise such rights by emailing us at info@grapaglobal.com. You may have the right to delete your personal data subject to and in accordance with Article 3 of the Israeli Privacy Protection Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 2023.

8. Cookies and Similar Technologies

8.1. What are Cookies?

A cookie is a small piece of text that is sent to your browser by a site you visit. This piece of text acts as a sort of tag, letting the site know that it's you (really, your device) that's visiting. There are other technologies that act similarly, like web beacons, pixel tags, and Device IDs for apps, but for simplicity's sake we'll refer to them all as "cookies".

8.2. First-Party / Third-Party Cookies

Sites can place their own cookies (called "first-party cookies") but can also place cookies from other sites (called "third-party cookies"). If your browser holds both first and third-party cookies for a given site, both the site and the third party are notified when you visit the site. We may place both first and third-party cookies on our site.

8.3. How We Use Cookies

While the specific names and types of cookies we use may change from time to time, they generally fall into one of the categories listed below.

Cookie Type	Function
Necessary	These cookies allow the site to work correctly. They enable your access to the site, move around, and access different services, features, and tools. They also help us identify and prevent security risks, for example by storing your session information to prevent others from changing your password without your login information. These cookies cannot be disabled.
Functionality	These cookies remember your settings, preferences, and other choices you make (like placing an item in a shopping cart) in order to help personalize and streamline your experience.
Performance / Analytics	These cookies and similar technologies (such as pixel tags in emails) collect analytical information to help us understand how you use our site and interact with our email communications, for example whether you have viewed messages, clicked on links, and how long you spent on each page. This helps us improve our site and marketing communications to better suit your needs.

8.4. Third Party Cookies

In addition to our first-party cookies, we place cookies from the third parties listed below who serve as independent data controllers of your personal data and who process such data in accordance with their respective privacy notices:

a. Google LLC – Google Analytics (Performance/Analytics). For further information, please see section 2.1.2.
b. Mailchimp (Intuit Inc.) (Performance/Analytics). We use Mailchimp to send marketing emails and newsletters. Mailchimp places cookies and similar tracking technologies (such as pixel tags) in our emails to measure open rates, click-through rates, and other engagement metrics. For more information, see Section 3 and Mailchimp's privacy policy at mailchimp.com/legal/privacy/.

8.5. How to Adjust Your Preferences

Most web browsers are initially configured to accept cookies, but you can change the settings so your browser refuses all cookies or certain types of cookies. In addition, you are free to delete any existing cookies at any time. Please note that some features of the services may not function properly when cookies are disabled or removed. For example, if you delete cookies that store your account information or preferences, you will be required to input these each time you visit.

9. Third-Party Services

You may have access to third-party services through our services. Please note that all use of third-party services is at your own risk and subject to such third party's terms and privacy policies. We do not take any responsibility for the performance of other services.

10. Children

We do not knowingly collect nor transfer personal data from/of children under the age of eighteen (18). In the event that you become aware that an individual under the age of eighteen (18) has provided data without parental permission, please advise us immediately.

11. Changes to the Privacy Notice

We may update this Privacy Notice from time to time to keep it up to date with legal requirements and the way we operate our business. We will place any updates on this webpage. Please come back to this page every now and then to make sure you are familiar with the latest version.