Data Processing Addendum

This Addendum applies where Theraputo processes personal data on your behalf in the course of providing the Platform. It forms part of the Terms and Conditions. For the purposes of the GDPR (and equivalent provisions of the UK GDPR and the Swiss FADP) you are the controller and Theraputo is the processor; for the purposes of India’s Digital Personal Data Protection Act 2023 you are the Data Fiduciary and Theraputo is a Data Processor.

A fully executable version of this Addendum, including the Standard Contractual Clauses where required, is available free of charge by writing to [email protected]. We will return a countersigned copy within five (5) business days.

Subject matter

Provision of the Renomira AI governance platform.

Duration

The Subscription Term, plus any post-termination export window and legal retention.

Nature and purpose

Hosting, storing, organising, classifying, generating documents from, transmitting and displaying Customer Data as instructed through the Platform.

Categories of data subjects

Your employees and contractors recorded as tool owners, approvers, oversight contacts or incident reporters; individuals named in free-text fields; your users.

Categories of personal data

Identification and business contact data, role and employer, authentication identifiers, activity and audit records, and any personal data you choose to enter into free-text fields.

Special category data

Not required by the Platform and not intentionally processed. You must not enter special category or criminal-offence data.

Frequency

Continuous for the duration of the Subscription.

1. Process personal data only on your documented instructions, including for transfers to a third country, unless required to do otherwise by law, in which case we will inform you unless the law prohibits it.
2. Ensure that personnel authorised to process personal data are bound by appropriate confidentiality obligations.
3. Implement the technical and organisational measures described in the Terms and Conditions and summarised at renomira.com/security.
4. Assist you, by appropriate technical and organisational measures and insofar as possible, in responding to data subject requests.
5. Assist you in ensuring compliance with Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to us.
6. Notify you without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting your data, with the information you need to meet your own obligations.
7. At your choice, delete or return all personal data at the end of the provision of services, and delete existing copies unless the law requires storage — backups are purged on a rolling cycle.
8. Make available all information necessary to demonstrate compliance, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality undertakings and no more than once per year absent a breach.
9. Not engage a new sub-processor without giving you notice and an opportunity to object on reasonable data protection grounds; if you object and we cannot accommodate it, you may terminate the affected Subscription with a pro-rata refund.

You grant us general written authorisation to engage sub-processors. The categories currently engaged are cloud hosting and infrastructure, transactional email delivery, error and performance monitoring, and payment processing. We maintain a named list with locations and processing purposes, available on request, and we will give you at least thirty (30) days’ notice before adding a sub-processor that processes personal data.

We flow down data protection obligations no less protective than those in this Addendum, and we remain liable to you for the performance of our sub-processors.

Where we transfer GDPR-protected personal data outside the EEA, we rely on the European Commission’s Standard Contractual Clauses, with a transfer risk assessment and supplementary measures where required. You authorise us to execute the SCCs on your behalf as the data exporter where we are the importer, and to complete the annexes with the information in this Addendum.

Data protection queries and DPA execution requests: [email protected].

See also: Contact Us