Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Agreement”) between the entity identified as the Customer in the applicable order form or subscription (“Controller” or “Customer”) and Thoriad (“Processor” or “we”).

This DPA applies to the extent that Thoriad processes Personal Data on behalf of the Customer in the course of providing the Thoriad governed AI notebook platform (the “Service”). It supplements and is incorporated into the Agreement. In the event of conflict between this DPA and the Agreement, this DPA prevails with respect to data processing matters.

• “Personal Data” means any information relating to an identified or identifiable natural person that is processed by Thoriad on behalf of the Customer through the Service.
• “Processing” means any operation performed on Personal Data, including collection, storage, use, transmission, and deletion.
• “Data Subject” means the natural person to whom the Personal Data relates.
• “Sub-processor” means a third party engaged by Thoriad to process Personal Data on behalf of the Customer.
• “Applicable Data Protection Law” means all laws and regulations applicable to the processing of Personal Data, including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA), and any successor legislation.

In the course of providing the Service, Thoriad may process the following categories of Personal Data:

• Identity data: names, email addresses, usernames, and organisational roles of individuals using the Service
• Authentication data: SSO tokens, session identifiers, and identity provider attributes
• Notebook content: code, markdown, execution outputs, and file attachments created by users, to the extent they contain or reference Personal Data
• Usage metadata: IP addresses, browser fingerprints, access timestamps, and feature usage patterns
• Audit log data: event records including user identifiers, actions performed, timestamps, and hash-chain integrity values

Data Subjects include the Customer’s employees, contractors, and any individuals whose Personal Data is included in notebook content processed through the Service.

Thoriad implements and maintains appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

Thoriad will assist the Customer in fulfilling its obligations to respond to Data Subject requests under Applicable Data Protection Law, including requests for access, rectification, erasure, portability, restriction, and objection. Where a Data Subject contacts Thoriad directly, we will redirect the request to the Customer without undue delay.

The Service provides administrative tools that enable Customer administrators to access, export, correct, and delete user data directly.

Thoriad will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach. The notification will include:

• A description of the nature of the breach, including the categories and approximate number of Data Subjects and records affected
• The name and contact details of our data protection contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach, including measures to mitigate its adverse effects

Thoriad will cooperate with the Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of each breach.

To the extent that the processing of Personal Data involves a transfer from the EEA, UK, or Switzerland to a jurisdiction that has not received an adequacy decision, the parties agree to rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): The EU Commission’s Standard Contractual Clauses (Module Two: Controller to Processor) are incorporated into this DPA by reference. For UK transfers, the International Data Transfer Addendum applies.
• Supplementary Measures: Thoriad implements supplementary measures including encryption in transit and at rest, access controls, and DLP scanning to ensure an essentially equivalent level of protection.
• Region Hints: Enterprise customers may configure region hints to prefer specific Cloudflare data centre locations for data storage and processing.

Upon termination of the Agreement, Thoriad will delete all Personal Data processed on behalf of the Customer within 90 days, except where retention is required by Applicable Data Protection Law or for the establishment, exercise, or defence of legal claims. The Customer may request an export of their data within 30 days of termination.

During the term of the Agreement, data retention periods are governed by the Customer’s plan:

• Starter: 30-day audit log retention
• Team: 1-year audit log retention
• Enterprise: Unlimited audit log retention with configurable archival policies

Thoriad will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and Applicable Data Protection Law. Upon reasonable written request and subject to appropriate confidentiality obligations, the Customer (or a qualified third-party auditor appointed by the Customer) may conduct an audit of Thoriad’s data processing activities, no more than once per year, with at least 30 days’ advance notice.

Thoriad may satisfy audit requests by providing relevant certifications, audit reports (such as SOC 2 Type II), or summaries of security assessments, to the extent these adequately address the Customer’s concerns.

Thoriad will provide reasonable assistance to the Customer in conducting data protection impact assessments and prior consultations with supervisory authorities, to the extent required under Applicable Data Protection Law and to the extent the assessment relates to the processing performed by Thoriad.

Each party’s liability under this DPA is subject to the limitations and exclusions set forth in the Agreement. Nothing in this DPA limits either party’s liability with respect to any rights that Data Subjects may have under Applicable Data Protection Law.

This DPA takes effect on the date the Customer first accesses the Service and remains in effect for the duration of the Agreement. Obligations relating to the processing and deletion of Personal Data survive termination of this DPA until all Personal Data has been deleted or returned.

This DPA is governed by the same law that governs the Agreement. For matters relating to GDPR compliance, the laws of the EU Member State in which the Customer is established shall apply. For matters relating to UK GDPR compliance, the laws of England and Wales shall apply.

For questions about this DPA or to exercise rights under it, contact us at:

Thoriad — Data Protection
Email: dpa@thoriad.com