Data Processing Agreement

This data processing agreement (DPA) applies whenever we process personal data on your behalf while delivering what you bought under the Third Vector Terms (the “Terms”). That covers three cases:

• Applied AI Services, where the SOW lists materials that contain personal data (section 12.2 of the Terms);
• Facilitated Nodes and review cycles, where you share outputs that contain personal data, or we see it in your environment during a session (section 12.1); and
• hosted Canopy features that store or process Client Content on our systems (section 12.3).

This DPA takes effect when an Order Form or SOW that says it applies is signed, or when both parties agree in writing that it applies to an existing engagement; email is enough. Signing that Order Form or SOW signs this DPA. It then applies for as long as we process Client Personal Data.

Personal data we process as controller under our Privacy Policy: the contact, booking and intake details of Academy participants (section 7.8 of the Terms), and the business contact details of your people that we use to run our relationship with you.

This DPA forms part of the agreement described in section 1.3 of the Terms. On the processing of personal data it prevails over the Terms and the SOW, and only an Order Form that names the section of this DPA it changes can vary it. Where this DPA is silent, the Terms apply. Where the SCCs apply (section 6), they prevail over this DPA.

You are the controller of Client Personal Data and we are your processor. Where you process that data as a processor for your own client, we are your sub-processor, and you confirm that your client has authorised you to engage us on these terms.

We process Client Personal Data only on your documented instructions, including on transfers outside the EEA (section 6). At signature, your instructions are the Order Form, the SOW, the Terms and this DPA, including Annex 1. You may give further instructions in writing; email is enough. An instruction that changes the scope, deliverables or timeline is a change under section 6.3 of the Terms. Where EU or Member State law requires us to process Client Personal Data other than on your instructions, we tell you before we do, unless that law forbids it.

We tell you immediately if we believe an instruction infringes Data Protection Law. We may pause the processing it concerns until you confirm, change or withdraw it.

You make sure that you have a lawful basis for the processing and for sharing Client Personal Data with us, that data subjects have been told what the law requires, and that your instructions comply with Data Protection Law. You share only the personal data the SOW needs, and remove or pseudonymise the rest where you can. You do not share special categories of personal data (Article 9 GDPR) or data on criminal convictions and offences (Article 10 GDPR) unless the Order Form or SOW names them and the extra measures that apply.

Where Canopy Nodes run in your own environment on the AI Provider you choose (sections 12.1 and 13.1 of the Terms), that AI Provider processes data for you under your contract with it. It is not our sub-processor, and this DPA does not cover it.

We use Client Personal Data only to deliver what you bought. We never use it to train AI models, to develop other products, or for the learnings in section 10.6 of the Terms.

Only the people delivering your engagement, including contractors, and our directors have access to Client Personal Data. Where your Order Form asks for it, we limit access further to the people it names. Each of them is bound by confidentiality obligations at least as protective as section 11 of the Terms (section 16.1 of the Terms).

We apply the technical and organisational measures in Annex 2, which give a level of security appropriate to the risk, as Article 32 GDPR requires. We may update them as technology and risks change, provided the overall level of protection does not go down.

Where you give us access to your own systems, we also follow the security policies you give us in writing (section 12.2 of the Terms).

We keep a record of the processing we carry out on your behalf, as Article 30(2) GDPR requires.

You give us general authorisation to engage the sub-processors on our published list (Annex 3, at thirdvector.io/subprocessors) and any sub-processor named in your Order Form or SOW.

Before we add or replace a sub-processor, we tell you by email at least 14 days before it first processes Client Personal Data, and we update the published list.

You may object on reasonable data protection grounds within those 14 days. We then look in good faith for a solution, such as not using that sub-processor for your data. If we cannot find one, either party may end the affected SOW or hosted feature by written notice, and section 9.2 of the Terms applies as if you had ended it for cause.

We engage each sub-processor under a written contract that imposes data protection obligations that are, in substance, the same as those in this DPA, including sufficient guarantees on security. AI providers process Client Personal Data only on terms that exclude training on it (section 12.2 of the Terms).

We remain responsible to you for our sub-processors’ performance of their obligations, within section 11.

We transfer Client Personal Data to a country outside the EEA, or let a sub-processor access it from there, only on your instructions and with a transfer mechanism under Chapter V GDPR in place. Annex 3 shows where each sub-processor processes data and the mechanism it relies on, and signing this DPA instructs us to make the transfers Annex 3 describes.

Each transfer relies on one of:

• an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for a recipient certified under it;
• the SCCs, Module 3 (processor to processor), in place between us and the sub-processor or between the sub-processor and its own sub-processor; or
• another mechanism Chapter V GDPR allows.

For data subject to UK or Swiss law, the SCCs apply with the UK International Data Transfer Addendum or the Swiss adjustments, as the case requires.

If a mechanism we rely on is invalidated or suspended, we move the transfer to another valid mechanism without undue delay, or stop it.

Where you are established outside the EEA and we send Client Personal Data to you, Module 4 of the SCCs (processor to controller) applies where Data Protection Law requires it, and is incorporated into this DPA by reference.

We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data.

As far as we know it at the time: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, what we have done or propose to do, and who to contact. Where we do not yet have all of it, we send what we have and follow up as we learn more.

We take reasonable steps to contain the breach and limit its effects, and we help you meet your own obligations to notify the supervisory authority and data subjects under Articles 33 and 34 GDPR. We do not notify the authority or data subjects on your behalf unless you ask us to or the law requires it. Notifying you of a breach is not an admission of fault or liability.

We send breach notices to the contact named in the Order Form, or otherwise to the person who signed it. You report a suspected breach to us at legal@thirdvector.io.

If a data subject contacts us directly about Client Personal Data, we pass the request to you within 5 business days and do not answer it ourselves, other than to say we have passed it on. We help you respond to requests to exercise rights under Chapter III GDPR, through appropriate technical and organisational measures and taking into account the nature of the processing.

We give you reasonable help with your obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to us.

Help under this section is included up to four hours in any twelve months. Beyond that, we charge at the rates in the Order Form or SOW, or otherwise at our standard rates, and agree an estimate with you first. Help needed because we breached this DPA is always free.

On request, we give you the information you reasonably need to show that we meet Article 28 GDPR and this DPA. That includes our current measures under Annex 2, the sub-processor list, and, once in any twelve months, our answers to a reasonable security questionnaire.

Where that information is not enough, or a supervisory authority asks for it, you may audit our compliance with this DPA, yourself or through an independent auditor who is bound by confidentiality and is not our competitor. An audit takes place once in any twelve months, unless a personal data breach or a supervisory authority gives reason for another, on at least 30 days’ written notice, during business hours, and without unreasonable disruption to our work.

For our sub-processors, we meet this section by passing on the audit reports and certifications they make available to us, such as SOC 2 or ISO/IEC 27001 reports, where their terms allow.

You bear the cost of an audit, including our reasonable time at the rates in the Order Form. We bear our own costs where an audit finds that we materially breached this DPA.

When the SOW or hosted feature ends, or earlier on request, we return or delete Client Personal Data, as you choose, within 90 days. If you have not chosen within 14 days of the end, we delete it.

Deletion covers copies on our systems and with our sub-processors. Copies in backups, or in a sub-processor’s own deletion cycle, are kept out of use and deleted in that cycle. Where EU or Member State law requires us to keep Client Personal Data, we keep only what it requires, protect it under this DPA, and delete it when the requirement ends.

On request, we confirm the deletion in writing.

Our liability under this DPA falls within section 15 of the Terms, including the cap in section 15.1. This DPA does not say otherwise.

The cap works between the two of us. It does not limit the rights of data subjects under Article 82 GDPR, or liability that the law does not allow to be limited (section 15.4 of the Terms). Each party bears any administrative fine a supervisory authority imposes on it.

Where one party has paid full compensation to a data subject for damage the other party caused in part, it may recover the other party’s share under Article 82(5) GDPR. Our share stays within the cap.

This DPA applies for as long as we process Client Personal Data for you, and ends once section 10 is complete. Sections 7, 10 and 11 continue for as long as they are needed.

The version of this DPA in force when your Order Form or SOW is signed applies to it. We may update it on 30 days’ written notice where Data Protection Law, a supervisory authority or a court requires it, or where the change does not reduce the protection of Client Personal Data. Any other change needs your written agreement.

This DPA is governed by Dutch law, and disputes go exclusively to the competent court in Rotterdam (section 17 of the Terms). Where the SCCs apply, they are governed by Dutch law and the Dutch courts are their forum.

• Client Personal Data is handled only in Third Vector’s company accounts on the services in Annex 3, never in personal accounts.
• Multi-factor authentication is on for every account that can reach Client Personal Data.
• Access is limited to the people delivering the engagement, including contractors, and Third Vector’s directors. Where the Order Form asks for it, we limit access further to the people it names.

• Client materials are kept in a folder per client in our Google Workspace shared drives, and in a project space per client in Notion.
• Client Personal Data is not stored on removable media or outside the systems in Annex 3.
• Data is encrypted in transit and at rest by the providers in Annex 3.

• Client Personal Data is processed only through the AI providers in Annex 3, on commercial terms that exclude training on it.
• Where the SOW allows, we remove or pseudonymise personal data before AI processing.

• Work laptops use full-disk encryption, automatic screen lock and current operating system updates.

• Everyone with access is bound by confidentiality obligations at least as protective as section 11 of the Terms.
• Sessions are recorded only with the consent of everyone present (section 7.8 of the Terms).

• Return or deletion of Client Personal Data within 90 days after the engagement ends (section 10).