Data Processing Addendum

1. Scope

This Data Processing Addendum ("DPA") is part of the Terms of Service. It applies when Thora processes personal information that is part of Your Data ("Customer Personal Data"), such as details about your customers and workers. You are the business (or controller) for that data; Thora is your service provider (or processor).

2. Instructions

We process Customer Personal Data only to provide, secure and support the Services, and as you instruct through your use of the Services or in writing. We will tell you if we believe an instruction breaks the law. We will not sell or share Customer Personal Data, keep or use it outside our direct business relationship with you, or combine it with other data except as the law allows a service provider to do.

3. Our people

Everyone at Thora who can access Customer Personal Data is bound by confidentiality and gets access only when their work requires it.

4. Security

We maintain the safeguards described in our Security overview and keep them appropriate to the risk.

5. Subprocessors

You authorize us to use the subprocessors on our Subprocessors page. We bind each to data-protection terms appropriate to the data it handles and remain responsible for them. We will give at least 30 days' notice of a new subprocessor by updating that page and emailing account owners. If you object on reasonable data-protection grounds, we will work with you on a solution. If there is none, you may cancel before the new subprocessor starts handling your data; because plans are monthly, cancellation takes effect at the end of your current billing period, within that notice window.

6. Helping you

The Services let you access, correct, export and delete Customer Personal Data yourself. Where you cannot, we will reasonably help you answer requests from individuals and meet your legal duties, including any needed assessments. If an individual contacts us directly about your data, we will send them to you.

7. Security incidents

If we confirm a security incident affecting Customer Personal Data, we will notify you without undue delay, and where feasible within 72 hours, with what we know, what we are doing and what you may need to do. We will update you as we learn more.

8. Return and deletion

You can export Customer Personal Data at any time while your account is active and for 30 days after cancellation takes effect. We then delete it within 90 days of cancellation taking effect, including backups, as described in the Privacy Policy, unless the law requires us to keep it.

9. Information and audits

On request, we will give you the information reasonably needed to show we meet this DPA, such as answers to security questionnaires. We do not hold third-party security certifications today and will say so honestly.

10. Location and transfers

We host the Services in the United States. If you are subject to laws that restrict transfers of personal data to the United States, contact us before uploading such data so we can discuss whether any required transfer terms can be put in place.

11. Conflicts

If this DPA and the Terms conflict about personal data, this DPA controls. The limits on liability in the Terms apply to this DPA.

Contact us

Questions about this document go to hello@thora.cloud.

Formal legal notices go by email to legal@thora.cloud, as described in the Terms of Service. Thora Cloud LLC is an Ohio limited liability company.