Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the customer organisation that has accepted the Terms of Service (the “Customer”, acting as controller) and THYNKR SYSTEMS LTD, company number 15306717, Office 2, 1st Floor, 73 Station Passage, London E18 1JL, United Kingdom (“LexSalim”, acting as processor). It applies whenever LexSalim processes personal data on the Customer’s behalf in the Service and forms part of the Terms. Where the Customer is itself a processor for its own clients, the Customer warrants that its instructions are authorised by the relevant controller.

“Data Protection Law” means the UK GDPR and Data Protection Act 2018, the EU GDPR, and, where applicable, US state privacy laws and Canadian federal and provincial privacy laws. Review: confirm whether a separate US state-law addendum and a Quebec Law 25 addendum are needed

LexSalim processes personal data only on the Customer’s documented instructions, which are the Terms, this DPA and the actions the Customer’s authorised users take in the Service (for example uploading a document or requesting analysis), unless required to do otherwise by law, in which case LexSalim informs the Customer before processing where legally permitted. LexSalim will tell the Customer if it believes an instruction infringes Data Protection Law.

LexSalim will: (a) ensure persons authorised to process personal data are bound by confidentiality; (b) implement the technical and organisational measures described in Security and Data Handling; (c) assist the Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting its obligations on security, breach notification and impact assessments; (d) make available the information necessary to demonstrate compliance with Article 28 of the UK GDPR and EU GDPR; and (e) not use Customer personal data for its own purposes, including training models.

The Customer gives general authorisation for LexSalim to engage the sub-processors listed in the sub-processor disclosure. LexSalim will give at least 30 days’ notice of any intended addition or replacement by updating that page and notifying the Customer’s administrators by email. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees. LexSalim imposes data-protection obligations on each sub-processor equivalent to those in this DPA and remains liable for their performance. Review: confirm 30-day notice and the pro-rata refund remedy

The measures in Security and Data Handling apply, including encryption in transit and at rest, per-case access control, passwordless sign-in with optional authenticator step-up, malware scanning on upload, audit logging and EU hosting. LexSalim may update the measures provided they do not reduce the overall level of protection.

LexSalim will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, with the information reasonably available at the time and updates as it becomes known, so that the Customer can meet its own notification obligations. Review: confirm an internal target of notifying within 72 hours of awareness, or sooner

LexSalim will make available documentation describing its controls and, no more than once in any twelve-month period unless required by a supervisory authority or following a breach, allow an audit by the Customer or an independent auditor bound by confidentiality, on at least 30 days’ notice, during business hours and without disrupting the Service. The Customer bears its own audit costs. Review: confirm audit frequency and cost allocation

Customer personal data is hosted in the European Union. Where LexSalim or a sub-processor transfers personal data outside the UK or EEA, the transfer relies on adequacy regulations or decisions, the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor), with supplementary measures where required. The applicable mechanism per sub-processor is recorded in the sub-processor disclosure. Review: attach the IDTA/Addendum and SCC modules as annexes once sub-processor contracts are final

On termination or expiry the Customer may export Customer Content from the Service for 30 days. After that period LexSalim deletes Customer personal data, including from backups within the backup rotation period, unless retention is required by law. On request LexSalim will confirm deletion in writing. Review: confirm the export period and backup rotation (up to 35 days)

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Law does not permit limitation. Review: confirm whether a separate, higher cap for data-protection claims is offered

Annex 1, details of processing: section 02 above. Annex 2, technical and organisational measures: Security and Data Handling. Annex 3, sub-processors: sub-processor disclosure. Annex 4, transfer mechanisms: to be attached on approval.