Data processing addendum

For the personal data in your customer data, you are the controller and Vendor Benchmark LLC is the processor, for the term of the agreement and until the data is deleted or returned. Where you act as a processor for a third-party controller, the addendum applies with you as processor and us as sub-processor, and that controller's instructions reach us through you.

We process personal data only on your documented instructions: the agreement, the addendum and the way you configure the service. We tell you if an instruction appears to infringe data protection law and may pause that processing until it is confirmed or withdrawn. We do not sell personal data and process it for no purpose other than providing and supporting the service.

Everyone we authorize to process personal data is bound by confidentiality obligations, trained on their data protection responsibilities, and given access only as needed, under least privilege.

We implement the technical and organizational measures in Annex 2: tenant isolation enforced at the database, encryption in transit and at rest, least-privilege access with multi-factor authentication, audit logging of views and downloads, private file storage behind short-lived signed URLs, secure development, encrypted backups with tested restoration, and personnel measures. We may update them, never materially reducing the level of protection during the term. The full architecture is on the security overview.

You give general authorization for the subprocessors on the subprocessor list. We give at least thirty days notice before adding or replacing one; you may object on reasonable data protection grounds, and if the objection cannot be resolved you may terminate the affected part of the service with a refund of prepaid unused fees. Every subprocessor is bound by written obligations no less protective than the addendum, and we remain fully liable for their performance.

We assist you, with appropriate technical and organizational measures, in responding to data subjects exercising their rights. A request made directly to us is referred to you unless the law requires otherwise.

Taking into account the nature of the processing, we assist you with the security of processing, personal data breaches, data protection impact assessments and prior consultation with supervisory authorities.

We notify you without undue delay after becoming aware of a personal data breach affecting your personal data, with the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken, supported by the audit trail that shows what was accessed. Our standing commitment is that you hear it from us within 72 hours of confirmation.

All data is hosted in the United States today. Where a transfer reaches a country without an adequacy decision, the applicable standard contractual clauses are incorporated by reference and completed by the annexes, with the United Kingdom or Swiss addendum where that regime applies. The clauses prevail over the addendum for the transfers they govern.

If a public authority makes a legally binding request for your personal data, we notify you before responding unless the law prohibits it, review the legality of each request, challenge requests we consider unlawful or overbroad, and disclose only the minimum required.

On termination, and on your request at any time, we delete or return your personal data at your direction, using the platform's hard-delete path that removes both the database rows and the stored files and writes a deletion certificate. Unless you direct otherwise, deletion follows within ninety days of termination, except where the law requires retention, and then only for as long as it requires.

We make available the information reasonably necessary to demonstrate compliance, including third-party certifications and audit reports where available, and allow audits by you or an auditor you mandate on reasonable notice, once in any twelve-month period unless a supervisory authority or a breach requires more, during business hours and without compromising other customers' data.

Each party's liability under the addendum is subject to the limitations in the agreement. On data protection, the addendum prevails over the agreement, and the standard contractual clauses prevail over both for the transfers they govern.

This page is a summary. The addendum itself, with the annexes and the standard contractual clauses where they apply, is at /legal/data-processing-addendum.pdf. To execute it, email info@vendorbenchmark.com or your account team, and we complete signature as part of your procurement, on our paper or through your process.

On our paper or through your process, as part of procurement.

Email info@vendorbenchmark.com or your account team with the entity names and the signatories, and we return the executed addendum with the annexes completed. Standard contractual clauses and the UK or Swiss addendum are included where a transfer requires them.