Data Processing Addendum

Definitions

Controller, Data Subject, Personal Data, Personal Data Breach and Processing shall have the same meaning as in the Data Protection Law, and their cognate terms shall be construed accordingly.

Data Protection Law means the General Data Protection Regulation (EU) 2016/679 (GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as applicable) and any other relevant local laws relating to the protection of Personal Data, the privacy of individuals and the privacy of electronic communications.

If ThoughtRiver processes any Personal Data on the Customer's behalf when performing its obligations under the Terms, the parties record their intention that the Customer shall be the Data Controller and ThoughtRiver shall be a Data Processor and in any such case:

• The Customer agrees that the Personal Data may be transferred or stored outside the EEA or the country where the Customer and the Authorised Users are located, provided adequate safeguards are in place.
• The Customer shall ensure it is entitled to transfer the Personal Data so that ThoughtRiver may lawfully use and process it as per the Terms.
• ThoughtRiver shall ensure authorised persons are committed to confidentiality.
• ThoughtRiver shall process data in accordance with the Terms, Data Protection Law, and lawful Customer instructions. If an instruction breaches law, ThoughtRiver will notify the Customer.
• Where required by law to process contrary to instructions, ThoughtRiver will inform the Customer unless prohibited by law.
• Both parties shall implement appropriate technical and organisational measures to protect Personal Data.

2. ThoughtRiver may use sub-processors for hosting and storage, subject to equivalent safeguards. ThoughtRiver remains liable for their actions.

3. ThoughtRiver shall notify the Customer without undue delay of any Personal Data Breach affecting the Customer’s data.

4. ThoughtRiver will co-operate with the Customer in mitigating any breach and the Customer shall cover reasonable costs.

5. ThoughtRiver shall provide information to demonstrate compliance and allow for audits upon reasonable notice, at the Customer’s expense.

6. ThoughtRiver shall assist with Data Subject rights requests under Data Protection Law, at the Customer’s cost.

7. On termination, ThoughtRiver will delete or return all Personal Data unless backed up or required by law to retain it.

ANNEX: Details of Processing

The Customer’s personal data may include any personal data uploaded via documents to the Platform. This may include names, customer lists, addresses, birth dates, and other attributes — but not typically sensitive personal data.

Processing includes contract risk review, data extraction, ML training, feature enhancement and customer support. For more details, see our Privacy and Security Policy.

Either party may amend Paragraphs 2 and 3 of this Annex by written notice to comply with applicable Data Protection Law.