Data Processing Addendum

1. Definitions

• "Data Protection Laws" means all privacy and data protection laws that apply to the processing of personal information under the Agreement, which may include Canada's Personal Information Protection and Electronic Documents Act and provincial equivalents, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and United States state privacy laws such as the California Consumer Privacy Act ("CCPA").
• "Customer Personal Data" means personal information in Customer Content, meaning the notes, lists, comments, plain-English search descriptions and other content the Customer's users create in or upload to the Service, that ForesIQ processes on the Customer's behalf.
• "Researcher Data" means the researcher profiles and related information that ForesIQ compiles from public sources, together with what researchers who have claimed their profile state about themselves, and makes available through the Service.
• "Account Data" means information about the Customer's users that ForesIQ processes to administer accounts, secure the Service, provide support and invoice the Customer.
• "controller", "processor", "data subject", "personal data breach", "processing", "business", "service provider" and "sub-processor" have the meanings given in the applicable Data Protection Laws.

2. Roles of the parties

• Customer Personal Data: the Customer is the controller (or business) and ForesIQ is its processor (or service provider).
• Researcher Data: ForesIQ and the Customer are each independent controllers. They are not joint controllers, and each is responsible for its own compliance.
• Account Data: ForesIQ is the controller, and processes Account Data as described in its Privacy Policy.

3. ForesIQ's obligations as processor

For Customer Personal Data, ForesIQ will:

• process it only on the Customer's documented instructions, which are the Agreement and the Customer's use of the Service's features, unless the law requires otherwise, in which case ForesIQ will inform the Customer first unless the law prohibits it; ForesIQ will tell the Customer if it believes an instruction breaches Data Protection Laws;
• ensure that everyone authorised to process it is bound by confidentiality;
• implement and maintain the technical and organisational measures in Annex 2;
• engage sub-processors only as permitted by section 4;
• taking into account the nature of the processing, assist the Customer by appropriate measures in responding to requests from data subjects exercising their rights, and promptly pass on any such request it receives directly;
• assist the Customer, where reasonably required, with data protection impact assessments and consultations with supervisory authorities relating to the Service;
• notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its own obligations, and take reasonable steps to contain and remedy it;
• when a user's account is removed, keep the Customer Content that user created with the Customer, shown as written by a former team member, where the Customer's administrators can edit or delete it;
• at the end of the Agreement, delete or return Customer Personal Data within 90 days at the Customer's choice, except where the law requires it to be kept; copies in backups expire on their normal schedule and are protected until then; and
• make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in section 6.

4. Sub-processors

The Customer gives ForesIQ general authorisation to engage the sub-processors listed in Annex 3. ForesIQ will impose on each sub-processor data protection obligations no less protective than those in this DPA, and remains responsible for their performance. ForesIQ will announce any new sub-processor for Customer Personal Data on this page, and by email to the Customer's account contacts, no later than when the change takes effect. A sub-processor that serves only an optional feature receives Customer Personal Data only after the Customer has asked for that feature to be switched on. The Customer may object to a new sub-processor on reasonable data protection grounds at any time; the parties will then discuss the concern in good faith, and if it cannot be resolved, the Customer may end the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused period.

5. International transfers

ForesIQ and its sub-processors process personal information in Canada, the United States, the European Union and Singapore, as described in Annex 3. Where Data Protection Laws restrict a transfer of personal information out of the European Economic Area, the United Kingdom or Switzerland, the parties agree that the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference: Module Two (controller to processor) for Customer Personal Data and Module One (controller to controller) for Researcher Data, with the optional docking clause omitted, Option 2 of Clause 9(a) applying with the notice in section 4, Clause 11's optional language omitted, the competent supervisory authority determined under Clause 13, the governing law and courts of Ireland for Clauses 17 and 18, and Annexes 1 to 3 of this DPA completing the Appendix. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies, and for transfers from Switzerland the Clauses apply as adapted for Swiss law. Where another lawful transfer mechanism applies, the parties may rely on it instead.

6. Audits

ForesIQ will answer the Customer's reasonable written questions about its data protection practices and provide relevant documentation of its security measures. Where the Customer reasonably needs more to demonstrate compliance, or a supervisory authority requires it, the Customer may conduct an audit no more than once a year, with at least 30 days' written notice, during business hours, at its own cost, under confidentiality, and in a way that does not compromise the security of the Service or other customers' data.

7. Researcher Data

For Researcher Data, each party will comply with Data Protection Laws as an independent controller. In addition:

• ForesIQ compiles Researcher Data only from publicly accessible sources and from what researchers state about themselves, excludes contact details and sensitive information (any email address ForesIQ holds for a researcher is kept apart from Researcher Data and is not made available to the Customer), applies identity and consistency safeguards, and provides researchers with notice and a way to see, correct or remove their profile;
• the Customer will use Researcher Data only for the Permitted Purpose defined in the Terms of Service, will not use it as the sole basis for any decision with legal or similarly significant effects on a person, and will give researchers any notice Data Protection Laws require when it contacts them;
• when ForesIQ notifies the Customer that a researcher has objected to processing, asked for deletion or corrected their information, the Customer will update or delete the corresponding Researcher Data it holds, including exports, within 30 days;
• when a researcher's profile is removed from the Service at the researcher's request or where Data Protection Laws require it, Customer Content attached to that profile, such as notes and list entries, is removed with it, and the Customer instructs ForesIQ to do so; when a profile leaves the ForesIQ dataset for any other reason, that Customer Content is kept, on the researcher's updated profile or on the earlier profile marked as no longer in the dataset; and
• each party will promptly tell the other about any complaint, request or regulatory enquiry about Researcher Data that concerns the other party's processing, and cooperate reasonably to resolve it.

8. United States state privacy laws

To the extent ForesIQ processes Customer Personal Data as a service provider or contractor under the CCPA or similar United States state laws, ForesIQ will not sell or share it, retain, use or disclose it for any purpose other than providing the Service or as those laws otherwise permit, or combine it with personal information from other sources except as those laws permit. ForesIQ will comply with the obligations those laws place on service providers, notify the Customer if it can no longer meet them, and permit the Customer to take reasonable steps to stop and remedy any unauthorised use. ForesIQ certifies that it understands and will comply with these restrictions.

9. The Customer's obligations

The Customer is responsible for the lawfulness of the Customer Personal Data it provides and of its instructions, and for having any notices and consents needed for ForesIQ to process Customer Personal Data under this DPA. The Customer will not include in Customer Content any sensitive or special category personal information, or any information about children.

10. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions of the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow them. This DPA applies for as long as ForesIQ processes personal information under the Agreement. ForesIQ may update this DPA to reflect changes in law or in its sub-processors under section 4, and will not reduce the overall protection it provides to Customer Personal Data during a subscription term without the Customer's agreement.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

• Encryption: all connections to the Website and the Service use TLS; hosted databases are encrypted at rest by the database provider.
• Access control: users sign in with individual credentials; access to data is enforced per user and per organisation in the database; administrative access is limited to authorised personnel, and administrative actions are logged.
• Confidentiality: personnel with access to personal information are bound by confidentiality obligations and receive only the access their role requires.
• Availability and resilience: hourly database backups kept for 14 days and monthly archives kept for up to 12 months; restoration from backup is tested; release changes pass automated tests and review before deployment.
• Monitoring: security-relevant events, including authentication activity and data access patterns, are recorded and reviewed, and usage limits restrict bulk extraction.
• Data minimisation: researcher profiles exclude contact details and sensitive information, any email address held for a researcher is kept apart from profiles and is not available to customers, and the public website shows only a small reviewed sample with surnames hidden.
• AI search: plain-English search is not offered to customers, and no user's search text is sent to an AI model. Before it is offered, ForesIQ will update this Annex to describe its safeguards.
• Incident response: suspected incidents are investigated promptly, contained and documented, and notified as section 3 requires.
• Physical security: servers and databases run in professionally managed data centres operated by the providers in Annex 3, which maintain their own physical and environmental controls.
• Secure development: code is kept under version control, and changes that affect customer data require recorded evidence of testing and review before release.

Annex 3: Sub-processors

Apart from the plain-English search sub-processors above, ForesIQ also uses AI text-processing and web search providers, including OpenRouter, Inc., to read and check public scholarly and professional sources, including career and education sources, and to write short descriptions of researchers' published work when compiling Researcher Data. Public source excerpts may include names, organisations and other identifying information. These profile-preparation and quality checks do not send Customer Personal Data.