Data Consumer API Terms of Use

1.1 For the purposes of these terms (the “API Terms of Use”) the following definitions apply: 

APIM Developer Portal: means the developer portal located at https://developer.api.cdp.net through which the Customer will set up its access to the Data Consumer API. 

Business Day: means a day other than a Saturday, Sunday or public holiday, in the United Kingdom when banks in London are open for business. 

CDP: means the CDP entity which has contracted with the Customer for supply chain services. 

CDP Portal: means the online disclosure platform where disclosing organizations are required to complete and submit their response to the Questionnaire.  

Credentials: has the meaning stated in clause 3.2.1. 

Customer: means the legal entity which has contracted with CDP for supply chain services. References to “you” and “your” in these API Terms of Use are references to you as the Customer. 

Data Consumer API: means the application programming interface connected to the CDP Portal that you use to view the response status of your suppliers.  

Documentation: means any documentation relating to the Data Consumer API provided or made available to the Customer by CDP. 

Intellectual Property Rights: means any and all copyright, rights in inventions, patents, know-how (including trade secrets), trademarks and trade names, service marks, design rights, rights in get-up, database rights and rights in data, the right to sue for passing off, utility models, domain names and all similar rights and in each case: (a) whether registered or not; (b) including any applications to protect or register such rights; (c) including all renewals and extensions of such rights or applications; (d) whether vested, contingent or future; and (e) wherever existing. 

License: has the meaning states in clause 4.1.

Response Status Data: means the status of the responses of the Suppliers to CDP’s questionnaire.  

Suppliers: means the Customer’s suppliers whom the Customer has requested to disclose to CDP under the Supply Chain Agreement. 

Supply Chain Agreement: means the agreement for the provision of supply chain membership services entered into between CDP and the Customer.

2.1 These Data Consumer API Terms of Use are a legally binding contract between the Customer and CDP.

3.1 In consideration of the mutual promises set out in these API Terms of Use and subject to the Customer’s compliance with these API Terms of Use, CDP agrees to grant Customer access to the Data Consumer API. 

3.2 You agree: 

3.2.1 to keep your passwords, usernames, login details, and access credentials which relate to the Data Consumer API (“Credentials”) secure and not to store your Credentials in a publicly accessible code repository; 

3.2.2 that you are responsible for any use of the Data Consumer API using your Credentials at all times; 

3.2.3 that you shall not provide your Credentials or direct access to the Data Consumer API to any third party that is not authorized by CDP (including without limitation any third-party system integrator, platform, or partner) without the prior written consent of CDP; and 

3.2.4 to make any individual to whom you grant access to your Credentials aware of the restrictions on the use of the Data Consumer API contained herein.

3.3 If you become aware, or reasonably suspect, that any of your Credentials have been compromised or disclosed to an unauthorized third party, you must: 

3.3.1 notify CDP immediately; 

3.3.2 provide any information reasonably requested by CDP; and 

3.3.3 cooperate fully with CDP to restore secure access to the Data Consumer API.

4.1 CDP hereby grants the Customer a non-exclusive, worldwide, royalty-free, non-sublicensable, revocable license to use the Response Status Data accessed through the Data Consumer API during the term of these API Terms of Use: 

4.1.1 for its internal purposes; and 

4.1.2 for the purposes of contacting its Suppliers to encourage disclosure,  

(the “License”). Any other use of the data contained within the Data Consumer API is strictly prohibited. 

4.2 Where CDP gives prior written consent for you to engage a third party to build or maintain your integration on your behalf, you remain fully responsible for ensuring that third party complies with these API Terms of Use and you shall be liable for the actions of such third party. 

4.3 You agree not to attempt to reverse-engineer, probe, or stress test the Data Consumer API infrastructure. 

4.4 You may access the Data Consumer API using third-party software and tools, provided that such software and tools:  

4.4.1 do not incorporate or transmit Response Status Data to AI-related technologies, large language models or other foundation models (including via Model Context Protocol (MCP) servers or similar agent integrations); and  

4.4.2 do not disclose or make Response Status Data available to any unauthorized third party, in each case without CDP’s prior written approval. 

5.1 CDP will make reasonable efforts to maintain availability of the Data Consumer API but does not guarantee uninterrupted access. Planned maintenance will be communicated in advance wherever possible. 

5.2 CDP accepts no liability for loss or damage arising from downtime of the Data Consumer API, whether planned or unplanned.

6.1 CDP reserves the right to (a) suspend or revoke access, temporarily or permanently, to the Data Consumer API with immediate effect without notice; and/or (b) suspend or terminate the Licence with immediate effect with notice, in each case in the event of: 

6.1.1 an actual or suspected breach of clause 3 (Access); 

6.1.2 any breach of the License; 

6.1.3 any actual or suspected security breach; 

6.1.4 your use of the Data Consumer API in a manner that risks degrading the Data Consumer API service for other users; 

6.1.5 breach of any obligation on the Customer contained herein; or 

6.1.6 non-payment of the fee set out in the Supply Chain Agreement in accordance with the payment terms contained therein. 

6.2 In addition to the rights set out in clause 6.1, CDP reserves the right to throttle request volumes where CDP reasonably determines that your use of the Data Consumer API poses a risk to the stability of the Data Consumer API or fair access for other clients.  

6.3 In the event of suspension or revocation of access under clause 6.1: 

6.3.1 CDP will notify you of any such suspension or revocation as soon as reasonably practicable following the action being taken; 

6.3.2 you shall provide such information as reasonably requested by CDP to support your investigation; and 

6.3.3 reinstatement of access is at CDP's sole discretion and may be subject to additional conditions. 

7.1 The rights granted to you under these API Terms of Use shall automatically terminate in the event your Supply Chain Agreement terminates or expires for any reason. 

7.2 CDP may withdraw the availability of the Data Consumer API and accordingly terminate these API Terms of Use at any time for convenience by giving thirty (30) days’ notice in writing to you. 

7.3 On termination of these API Terms of Use, you will cease use of the Data Consumer API.

8.1 CDP reserves the right to monitor your usage of the Data Consumer API for the purposes of security, compliance, and fair use enforcement and you consent to CDP logging request metadata, including volume, frequency, and timestamps, for these purposes. 

8.2 CDP may request reasonable evidence from you at any time during the term of your Supply Chain Agreement to demonstrate compliance with these API Terms of Use, and you agree to cooperate with any such request.

9.1 Throttling of request volumes may be applied at any time where CDP reasonably determines that usage poses a risk to system stability or fair access for other clients. CDP will endeavor to provide advance notice where throttling is planned.  

9.2 You shall ensure that you prevent the introduction of any viruses, worms, software bombs or similar items into the CDP Portal or the Data Consumer API. 

10.1 You acknowledge that data refresh frequencies are as defined in the technical documentation provided separately and that CDP does not guarantee real-time accuracy.

11.1 The Intellectual Property Rights in the Data Consumer API together with any related documentation shall remain the property of CDP or its licensors (as the case may be). 

11.2 Except as expressly granted in clause 4, no Intellectual Property Rights are transferred or licensed (whether implied or otherwise) as a result of this Terms of Use.

12.1 CDP reserves the right to modify, deprecate, or discontinue any aspect of the Data Consumer API, including data fields, structure, or authentication methods, subject to providing reasonable advance notice in accordance with the technical documentation provided separately.  

13.1 CDP does not exclude or limit its liability to you for: 

13.1.1 fraud or fraudulent misrepresentation; 

13.1.2 gross negligence; 

13.1.3 death or personal injury; or 

13.1.4 any matter in respect of which it would be unlawful to exclude or limit liability. 

13.2 Subject to clause 13.1, CDP shall not in any circumstances be liable for any consequential or indirect loss or damages or loss of revenue, loss of profit, loss of business, business interruption, loss of business opportunity, loss of goodwill, loss of reputation or loss of, damage to or corruption of data, or software. 

13.3 Notwithstanding anything contained herein, CDP's aggregate liability to you under these API Terms of Use shall be limited to GBP £5,000.  

14.1 Any notice to be sent to CDP under or in connection with these API Terms of Use shall be sent by email to notices@cdp.net and dataconsumerapi@cdp.net. Any notice to be sent to Customer under or in connection with these API Terms of Use shall be sent by email to the addresses(s): (a) used to register for the CDP Portal; and (b) of any Customer engineers who have registered via the APIM Developer Portal and have an active subscription key. In the absence of evidence of non-delivery, any notice shall be deemed received at the start of the next Business Day after the day on which it is sent.

15.1 CDP may at any time assign, novate, transfer or sub-contract any of its rights or obligations under these API Terms of Use without your prior written consent. 

16.1 These API Terms of Use constitute the entire agreement between you and CDP in relation to the Data Consumer API. Notwithstanding the foregoing, the Supply Chain Agreement shall remain in force.

17.1 CDP reserves the right to change these API Terms of Use at any time and any such changes shall be effective immediately or such other time as CDP elects. Every time you wish to use the Data Consumer API, please check these API Terms of Use to ensure you understand the terms that apply at that time.

18.1 Each of the clauses of these API Terms of Use operates separately. If any court or relevant authority decides that any of them are unenforceable, the remaining clauses will remain in full force and effect.

19.1 Nothing in these API Terms of Use is intended to, or shall be deemed to, establish any partnership, agency relationship or joint venture between you and us.

20.1 CDP shall not be in breach of these API Terms of Use for delay in performing, or failure to perform, any of its obligations under these API Terms of Use if that delay or failure results from events, circumstances or causes beyond its reasonable control.

21.1 Except as expressly provided elsewhere in these API Terms of Use, a person who is not a party to these API Terms of Use shall not have any right to enforce any of its terms.

22.1 These API Terms of Use are governed by English law and both the Customer and CDP submit to the exclusive jurisdiction of the English courts to resolve any dispute or claim arising out of or in connection with these terms, their subject matter or formation.