Data Processing Addendum
The processor contract: documented instructions, breach notice, subprocessors, and audits.
- Effective June 23, 2026
- v1.1
- Thorbis, Inc., a Delaware corporation
In progress, and said so: This document is undergoing counsel review before final execution.
01
Order of precedence
The DPA is part of the Terms of Service and takes precedence over other terms on data-protection matters only.
02
Roles
The Customer is the controller (or a processor); Thorbis is the processor or sub-processor, and processes personal data only on the Customer’s documented instructions unless law requires otherwise, with prior notice where permitted.
03
What the processing covers
Hosting, communications, scheduling, invoicing, and AI features, over contact details, service addresses, financial records, and payroll figures, for data subjects including end customers, personnel, and contacts.
04
Processor obligations
Staff confidentiality, appropriate security, assistance with data-subject requests, and the compliance documentation a customer needs for its own obligations.
05
Breach notice
Thorbis notifies without undue delay after becoming aware of a personal data breach, with the information available, to support the Customer’s own obligations.
06
Sub-processors
General authorization for the published subprocessor list, with equivalent obligations flowed down. Thorbis remains responsible for each sub-processor’s performance, and material changes come with advance notice and objection rights on data-protection grounds.
07
International transfers
EEA, UK, and Swiss transfers rely on Standard Contractual Clauses, with the UK International Data Transfer Addendum incorporated for UK transfers.
08
CCPA service-provider terms
Thorbis acts as a CCPA/CPRA service provider: no selling or sharing of personal information, and use only to perform the service or as law permits.
09
Deletion, audits, and liability
On termination the Customer elects deletion or return, with a limited export window. Compliance documentation and reasonable audits are available under confidentiality and scope conditions, and DPA liability follows the Terms' limitations.
This summary is provided for transparency and is not legal advice. Your use of Thorbis is governed by the agreement you accept. Questions: legal@thorbis.com · Thorbis, Inc., a Delaware corporation, Pickens County, Georgia, United States. The mailing address is available by request.