Snapshot 4531
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
Data Processing Addendum
This Data Processing Addendum, including its appendices and the Standard Contractual Clauses (collectively “DPA”) is
incorporated into and subject to, the terms and conditions of the Agreement (defined below) between ThoughtSpot and the
company set forth in the signature block below (“Customer”), and is made as of the effective date set forth in the signature
block below (“Effective Date”). All capitalized terms not otherwise defined herein will have the meaning given to them in
the Agreement. Any inconsistency between the terms of this DPA and the Agreement will be resolved in favor of this DPA
with respect to the subject matter herein.
Addendum If the Customer entity signing this DPA is a party to the Agreement, this DPA is an addendum to and forms
part of the Agreement. In such case, the ThoughtSpot entity that is party to the Agreement is party to this
DPA.
If the Customer entity signing this DPA executed an Order Form with ThoughtSpot pursuant to the
Agreement, but is not itself a party to the Agreement, this DPA is an addendum to that Order Form and
applicable renewal Order Forms, and the ThoughtSpot entity that is party to such Order Form is party to
this DPA.
If the Customer entity signing this DPA is neither a party to an Order Form nor the Agreement, this DPA is
not valid and is not legally binding. Such entity should request that the Customer entity who is a party to
the Agreement executes this DPA.
CUSTOMER THOUGHTSPOT
EACH ACTING UNDER DUE AND PROPER AUTHORITY, THE PARTIES EXECUTE THIS DPA AS OF THE EFFECTIVE DATE.
Customer: ThoughtSpot, Inc.
(include entity type, e.g., Inc., Ltd., etc.)
By: By:
Travis Geurre
Name: Name:
General Counsel
Title: Title:
March 13, 2026 | 13:59 PDT
Effective Date: Signature Date:
THOUGHTSPOT EMEA LTD. THOUGHTSPOT INDIA PRIVATE LIMITED
By: By:
Travis Geurre Travis Geurre
Name: Name:
Title: Director Title: Director
March 13, 2026 | 13:59 PDT Signature Date: March 13, 2026 | 13:59 PDT
Signature Date:
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
1. Definitions.
1.1. “Administrative Information” means information submitted by Customer into ThoughtSpot Cloud in connection with
the administration of its instance of ThoughtSpot Cloud, including usernames, login credentials, and search terms, as
further described in the Documentation, and any reproductions, adaptations, and displays, from any of the foregoing.
1.2. “Affiliate” means, with respect to a party, any legal entity (such as a corporation, partnership, or other legal entity)
that controls, is controlled by, or is under common control with such party. For purposes of this definition, “control”
means the legal power to direct or cause direction of the general management of the corporation, partnership, or other
legal entity. Affiliates of Customer are “Customer Affiliates” and Affiliates of ThoughtSpot are “ThoughtSpot
Affiliates.”
1.3. “Agreement” means the Order Form between ThoughtSpot and Customer and the subscription or service agreement
referenced therein.
1.4. “California Consumer Privacy Act” or “CCPA” means the California Consumer Privacy Act of 2018, as may be
amended from time to time.
1.5. “Data Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly
with others, determines the purposes and means of Processing of Personal Data.
1.6. “Data Privacy Framework” or "DPF" means (as applicable) the EU-U.S. Data Privacy Framework, the UK Extension
to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework self-certification programs
operated by the U.S. Department of Commerce, and any respective successors.
1.7. “DPF Principles” means the Principles and Supplemental Principles contained in the relevant DPF (as amended,
superseded or replaced from time to time).
1.8. “Data Processor” means the natural or legal person, public authority, agency or other body that Processes Personal
Data on behalf of the Customer, including as applicable any “service provider” as that term is defined by the CCPA.
1.9. “Data Protection Law(s)” means all applicable data protection and privacy laws regulating the Processing of Personal
Data, including where applicable, EU & UK Data Protection Law, and the CCPA.
1.10. “Data Subject” means an identified or identifiable natural person.
1.11. “Documentation” means the then-current service operating and interface instructions (including API documentation)
published for use of each version of ThoughtSpot Cloud at https://docs.thoughtspot.com/.
1.12. “EU & UK Data Protection Law” means: (a) Regulation 2016/679 of the European Parliament and of the Council on
the protection of natural persons with regard to the processing of Personal Data and on the free movement of such
data (General Data Protection Regulation) ("GDPR"), (b) the GDPR as it forms part of United Kingdom law pursuant
to Section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”) and the Data Protection Act 2018, and any
other successor United Kingdom data protection legislation; (c) the Swiss Federal Data Protection Act of 25
September 2020 and its corresponding ordinances (“Swiss DPA”); and (d) any applicable national data protection
laws made under or pursuant to or that apply in conjunction with (a) – (c), in each case, as superseded, amended or
replaced from time to time.
1.13. “Instructions” means Customer’s documented Processing instructions issued to ThoughtSpot in compliance with this
DPA.
1.14. “Order Form” means: (a) an order form or other ordering document signed by the authorized representatives of
Customer and ThoughtSpot or authorized ThoughtSpot partner that specifies subscriptions or licenses purchased,
corresponding pricing, and the Subscription Term, as well as the scope and price of consulting services purchased
(if any); or (b) an online web form or in-application electronic ordering process initiated by Customer that references
the Agreement.
1.15. “Personal Data” means any information relating to a Data Subject uploaded to ThoughtSpot Cloud as Administrative
Information by or for Customer or Customer’s agents, employees, or contractors, including, but not limited to, the
definition of “personal information” in the CCPA.
1.16. “Process” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether
or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or
combination, restriction, erasure or destruction.
1.17. “Restricted Transfer” means a transfer (directly or via onward transfer) of Personal Data that is subject to EU or UK
Data Protection Law or other applicable Data Protection Laws in jurisdictions that impose similar safeguards for
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
transfers of Personal Data to a country outside of the exporting jurisdiction, which is not covered by a suitable
framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts (e.g.,
European Commission, United Kingdom or Swiss authorities, as applicable) as providing an adequate level of
protection for Personal Data.
1.18. “ Standard Contractual Clauses” or “SCCs” means together (i) “EU SCCs” means the standard contractual clauses
for the transfer of personal data to third countries approved pursuant to Commission Decision (EU) 2021/914 of 4
June 2021, currently found at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-
protection/standard-contractual-clauses-scc_en, or any subsequent set of clauses approved by the European
Commission which amends, replaces, or supersedes these, and/or any national equivalents thereto pursuant to Data
Protection Laws; and (ii) “UK Addendum” means the International Data Transfer Addendum issued by the Information
Commissioner’s Office under s.119(A) of the UK Data Protection Act 2018, currently found at
https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf.
1.19. “Sub-Processor” means any legal person or entity engaged in the Processing of Personal Data by ThoughtSpot.
1.20. “Subscription Term” means the term of authorized access to, or use of, ThoughtSpot Cloud as set forth in the Order
Form.
1.21. “ThoughtSpot Cloud” means the particular ThoughtSpot software-as-a-service offering(s) ordered by Customer
under an Order Form or via a registration portal, as further described in the applicable Documentation, including all
data, functionalities, components, and materials provided by ThoughtSpot therein, any updates and upgrades thereto,
and any modifications, enhancements, or improvements, of or to any of the foregoing, however made.
PART 1 –DATA PROTECTION LAW(S)
2 Scope of the Processing.
2.1 ThoughtSpot as a Data Processor. As between ThoughtSpot and Customer, Customer is either the Data Controller
of Personal Data, or in the case that Customer is acting on behalf of a third-party Data Controller, then a Data
Processor, and ThoughtSpot will Process Personal Data only as a Data Processor acting on behalf of Customer and,
with respect to CCPA, as a “service provider” as defined therein. ThoughtSpot will comply with its obligations as a
Data Processor under applicable Data Protection Laws. Where ThoughtSpot is acting on behalf of Customer as a
service provider under the CCPA, Appendix 3 shall also apply.
2.2 Business Contact Information. ThoughtSpot and Customer may Process the other’s “Business Contact
Information” (“BCI”) (Personal Data used to contact, identify, or authenticate an individual in a professional or
business capacity, including an individual’s name, business e-mail address, physical address, telephone number or
similar attributes) as independent Controllers wherever they do business to deliver and receive the Products. The
parties are not entering a joint Controller relationship. The ThoughtSpot Privacy Statement contains additional details
on ThoughtSpot’s Processing of BCI. Each of the parties has implemented and follows appropriate technical and
organizational measures to protect the other’s BCI.
2.3 Instructions. The Agreement constitutes Customer’s Instructions to ThoughtSpot for Processing of Personal Data.
Customer may issue additional or alternate Instructions provided that such Instructions are: (a) consistent with the
purpose and the scope of the Agreement; and (b) confirmed in writing by Customer.
2.4 Data Protection Law(s). The parties shall comply with all of their respective obligations under Data Protection Laws
with respect to Personal Data. Customer warrants to ThoughtSpot that: (a) it has provided, and will continue to
provide, all notice and obtained, and will continue to obtain, all consents, permissions and rights necessary under
Data Protection Laws for ThoughtSpot to lawfully Process Customer Personal Data for the purposes contemplated
by the Agreement; (ii) it has complied with Data Protection Laws in the collection and provision or Personal Data to
ThoughtSpot and its Sub-processors; and (iii) it shall ensure its Processing Instructions comply with applicable laws
(including Data Protection Laws) and that the Processing of Customer Personal Data by ThoughtSpot in accordance
with Customer’s instructions will not cause ThoughtSpot to be in breach of Data Protection Laws. ThoughtSpot will
have no liability for any harm or damages resulting from ThoughtSpot’s compliance with Instructions received from
Customer.
2.5 Nature, Scope, and Purpose of the Processing. ThoughtSpot shall only Process Personal Data in accordance with
Customer’s Instructions and only to the extent necessary to provide ThoughtSpot Cloud as described in the
Agreement and the Documentation. Where ThoughtSpot believes that compliance with Customer’s Instructions could
result in a violation of Data Protection Laws or is not in the ordinary course of ThoughtSpot’s obligations in operating
ThoughtSpot Cloud, ThoughtSpot shall promptly notify Customer thereof.
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
2.6 Compliance with Data Protection Laws. The parties shall comply with all of their respective obligations under Data
Protection Laws with respect to Personal Data.
3. Authorized Affiliates.
3.1. Customer’s Affiliates. The obligations of ThoughtSpot set forth herein will extend to Customer’s Affiliates to which
Customer provides access to ThoughtSpot Cloud or whose Personal Data is Processed within ThoughtSpot Cloud,
subject to the following conditions:
3.1.1. Compliance. Customer shall at all times be liable for its Affiliates’ compliance with this DPA and all acts and omissions
by a Customer Affiliate are considered acts and omissions of Customer.
3.1.2. Claims. Except where applicable Data Protection Laws require the Affiliate to exercise a right or seek a remedy under
this DPA directly against ThoughtSpot, in the event a Customer Affiliate wishes to assert a valid legal action, suit,
claim or proceeding against ThoughtSpot (a “Customer Affiliate Claim”): (a) Customer must bring such Customer
Affiliate Claim against ThoughtSpot on behalf of such Customer Affiliate; (b) all Customer Affiliate Claims will be
considered claims made by Customer and are at all times subject to any aggregate limitation of liability set forth in
the Agreement; and (c) the Customer that is the contracting party to the Agreement shall exercise any such rights
under this DPA not separately for each Affiliate individually but in a combined manner for itself and all of its Affiliates
together.
3.1.3. Affiliate Audits. The parties agree that the Customer that is the contracting party to the Agreement shall, when
carrying out an onsite audit of the procedures relevant to the protection of Personal Data, take all reasonable
measures to limit any impact on ThoughtSpot and its Sub-Processors by combining, to the extent reasonably possible,
several audit requests carried out on behalf of itself and all of its Affiliates in one single audit.
3.1.4. Customer Affiliate Ordering. If a Customer Affiliate purchased a separate subscription or license from ThoughtSpot
under the terms of the Agreement between ThoughtSpot and Customer, then such Customer Affiliate will be deemed
a party to this DPA and shall be treated as Customer under the terms of this DPA.
3.2. Communication. Unless otherwise provided in this DPA, all requests, notices, cooperation, and communication,
including Instructions issued or required under this DPA (collectively, “Communications”), must be in writing and
between Customer and ThoughtSpot only and Customer shall inform the applicable Customer Affiliate of any
Communications from ThoughtSpot pursuant to this DPA. Customer shall be solely responsible for ensuring that any
Communications (including Instructions) it provides to ThoughtSpot relating to Personal Data for which a Customer
Affiliate is Controller reflect the relevant Customer Affiliate’s intentions.
4. Cooperation.
4.1. Requests from Authorities. In the case of a notice, audit, inquiry or investigation by a government body, data
protection authority or law enforcement agency regarding the Processing of Personal Data, ThoughtSpot shall
promptly notify Customer unless prohibited by applicable law. Customer shall keep records of the Personal Data it
submits to ThoughtSpot Cloud and shall cooperate and provide all necessary information to ThoughtSpot in the event
ThoughtSpot is required to produce such information to a data protection authority.
4.2. Security Risk Assessment. Customer agrees that in accordance with Data Protection Laws and before submitting
any Personal Data to ThoughtSpot Cloud, Customer will perform an appropriate risk assessment to determine whether
the security measures within ThoughtSpot Cloud provide an adequate level of security, taking into account the nature,
scope, context and purposes of the Processing, the risks associated with the Personal Data and the applicable Data
Protection Laws. ThoughtSpot shall provide Customer reasonable assistance by providing Customer with information
requested by Customer to conduct Customer’s security risk assessment. Customer is solely responsible for
determining the adequacy of the security measures within ThoughtSpot Cloud in relation to the Personal Data it
submits to ThoughtSpot Cloud for Processing. Customer may influence the scope and the manner of Processing of
its Personal Data by its own implementation, configuration and use of ThoughtSpot Cloud, including third-party
integrations and any other products or services offered by ThoughtSpot.
4.3. Requests from Data Subjects. Customer is solely responsible for fulfilling any requests from Data Subjects regarding
access, correction, rectification, erasure, or to transfer or port such Personal Data, within ThoughtSpot Cloud, as may
be required under Data Protection Laws. ThoughtSpot Cloud includes technical and organizational measures that
have been designed, taking into account the nature of its Processing, to enable Customer, insofar as possible, in
fulfilling its obligations to respond to Data Subject Requests.
4.4. Data Protection Impact Assessments (DPIA). ThoughtSpot will, on request, provide Customer with reasonable
information required for Customer to carry out a data protection impact assessment for Processing of Personal Data
within ThoughtSpot Cloud.
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
4.5. ThoughtSpot Assistance. ThoughtSpot will assist Customer in ensuring compliance with Customer’s obligations
pursuant to Articles 32 to 36 of the GDPR taking into account the nature of Processing by providing Customer with
reasonable information requested pursuant to the terms of this DPA, including information required to conduct
Customer’s security risk assessment. For clarity, Customer is solely responsible for carrying out its obligations under
GDPR and this DPA. ThoughtSpot shall not undertake any task that can be performed by Customer.
5. International Data Transfers.
5.1. Transfer Mechanisms. ThoughtSpot shall rely on the DPF to lawfully receive Personal Data in the United States,
and ThoughtSpot shall ensure that it provides at least the same level of protection to such Personal Data as is required
by the DPF Principles. The parties agree that when the transfer of Personal Data from Customer to ThoughtSpot is a
Restricted Transfer or the DPF is invalidated or cannot be relied upon for any other reason, the SCCs shall
automatically be incorporated into this DPA and apply to the Restricted Transfers as set forth in 5.4 below.
5.2. Enforcement. Any Standard Contractual Clauses executed by ThoughtSpot and Customer will only be enforceable
against ThoughtSpot as integrated with this DPA and will form the entire agreement with regard to the Processing of
Customer Personal Data unless the applicable EU & UK Data Protection Law to which the relevant Customer entity
is subject requires that the Customer entity itself bring or be a party to such a claim. Any such Customer claim will at
all times be subject to any aggregate limitation of liability that applies to the Customer under the Agreement. The
existence of more than one claim will not enlarge this limit.
5.3. Standard Contractual Clauses with New Sub-Processors. Where required under EU & UK Data Protection Law,
ThoughtSpot or ThoughtSpot’s Affiliates shall require Sub-Processors to abide by: (a) the DPF; (b) the Standard
Contractual Clauses for Data Processors established in third countries; or (c) another lawful mechanism for the
transfer of Personal Data as approved by the European Commission.
5.4. SCCs. In relation to Restricted Transfers of Personal Data originating from the EEA and/or UK and protected by the
GDPR and/or UK GDPR respectively, the SCCs will apply completed as follows:
5.4.1. The below shall apply to the SCCs, including the election of specific terms and/or optional clauses as described
in more detail below, and any optional clauses not expressly selected are not included (including with respect
to Table 2 of the UK Addendum):
5.4.1.1. The Module 2 terms apply to the extent Customer is a Data Controller and the Module 3 terms
apply to the extent Customer is a Data Processor of the Customer Personal Data. The foregoing shall apply
with respect to Table 2 of the UK Addendum;
5.4.1.2. The optional Clause 7 in Section I of the SCCs is incorporated, and Affiliates may accede to this
DPA and the SCCs under the same terms and conditions as Customer, subject to Section 3.1 of this DPA via
mutual agreement of the Parties. The foregoing shall apply with respect to Table 2 of the UK Addendum;
5.4.1.3. For purposes of Clause 9 of the SCCs, Option 2 (“General written authorization”) is selected and
the process and time period for the addition or replacement of Sub-Processors shall be as described in Section
6 (Sub-Processors) of this DPA. The foregoing shall apply with respect to Table 2 of the UK Addendum;
5.4.1.4. For purposes of Clause 13 and Annex 1.C of the SCCs, Customer shall maintain accurate records
of the applicable Member State(s) and competent supervisory authority, which shall be made available to
ThoughtSpot on request;
5.4.1.5. For purposes of Clause 14(c), Customer may subscribe to the Sub-Processor Site to receive
notifications regarding updates to ThoughtSpot’s overview of relevant laws and practices of Third Countries;
5.4.1.6. For purposes of Clause 17 and Clause 18 of the SCCs, the Member State for purposes of governing
law and jurisdiction shall be Ireland. Part 2, Section 15(m) and Part 2, Section 15(n) of the UK Addendum
regarding Clause 17 and Clause 18 of the EU SCCs shall apply;
5.4.1.7. For purposes of Annex 1.A, the “data importer” shall be ThoughtSpot and the “data exporter” shall
be Customer and any Affiliates that have acceded to the SCCs pursuant to this DPA. The foregoing shall apply
with respect to Table 3 of the UK Addendum;
5.4.1.8. For purposes of the description of the transfer, it is as described in Appendix 1 to this DPA. The
foregoing shall apply with respect to Table 3 of the UK Addendum;
5.4.1.9. For purposes of the description of the technical and organization measures, it is as described in
Appendix 2 to this DPA. The foregoing shall apply with respect to Table 3 of the UK Addendum;
5.4.1.10. The Sub-Processors shall be as described in Section 6 (Sub-Processors) of this DPA. The
foregoing shall apply with respect to Table 3 of the UK Addendum; and
5.4.1.11. With respect to Table 4 of the UK Addendum, Customer may suspend or terminate the Processing
of the Customer Personal Data by ThoughtSpot that is subject to UK GDPR at any time by deleting all such
Customer Personal Data in the Product. Additionally, either Party may terminate the UK Addendum pursuant
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
to Section 19 of the UK Addendum if, after a good faith effort by the Parties to amend this DPA to account for
the approved changes and any reasonable clarifications to the UK Addendum, the Parties are unable to come
to a mutual agreement.
6. Sub-Processors.
6.1. Use of Sub-Processors. Customer generally authorizes the engagement of Sub-Processors and
specifically consents to those listed at http://www.thoughtspot.com/legal/sub-processors as of the Effective Date. For
clarity, the execution of this DPA by Customer constitutes Customer’s general consent for ThoughtSpot’s engagement
of onward Sub-Processors under the Standard Contractual Clauses.
6.2. Sub-Processor Obligations. ThoughtSpot will: (a) enter into a written agreement with each Sub-Processor
imposing data protection obligations no less protective of Personal Data as ThoughtSpot’s obligations in this DPA to
the extent applicable to the nature of the services provided by such Sub-Processor; and (b) remain liable for each
Sub-Processor’s compliance with the obligations in this DPA. Upon written request, ThoughtSpot will provide
Customer all relevant information it reasonably can in connection with its applicable Sub-Processor agreements where
required to satisfy Customer’s obligations under Data Protection Laws.
6.3. Changes to Sub-Processors. ThoughtSpot will make available on its Sub-Processor site a mechanism for
Customer to subscribe to notifications of new Sub-Processors. ThoughtSpot will provide such notification at least
fourteen (14) days in advance of allowing the new Sub-Processor to Process Personal Data (the “Objection Period”).
During the Objection Period, Customer may object in writing to ThoughtSpot’s appointment of the new Sub-Processor,
provided that such objection is based on reasonable grounds relating to data protection. In such event, the parties
will discuss Customer’s concerns in good faith with a view to achieving resolution. If Customer can reasonably
demonstrate that the new Sub-Processor is unable to Process Personal Data in compliance with the terms of this
DPA and ThoughtSpot cannot provide an alternative Sub-Processor, or the parties are not otherwise able to achieve
resolution as provided in the preceding sentence, Customer, as its sole and exclusive remedy, may terminate the
Order Form(s) with respect only to those aspects of ThoughtSpot Cloud which cannot be provided by ThoughtSpot
without the use of the new Sub-Processor by providing written notice to ThoughtSpot. ThoughtSpot will refund
Customer any prepaid unused fees of such Order Form(s) following the effective date of termination effective under
this Section 6.
PART 2 – GENERAL DATA PROTECTION OBLIGATIONS
7. Security.
7.1. Security Program. A comprehensive description of the security program supporting ThoughtSpot Cloud is available
as incorporated into the Agreement as the ThoughtSpot Cloud Program Guide, including under its previous name the
ThoughtSpot Subscription Service Program Guide (“Program Guide”). If the Program Guide is not incorporated into
the Agreement for any reason, then the following terms will apply:
7.1.1.Data Security Measures. ThoughtSpot shall maintain appropriate technical and organizational safeguards
designed to protect the security, confidentiality and integrity of Administrative Information, including any
Personal Data contained therein. Customer acknowledges that ThoughtSpot’s data security measures are
subject to technical progress and development and that ThoughtSpot may update or modify the security
measures from time to time provided that such updates and modifications do not result in a material reduction
in the commitments, protections or overall level of service provided to Customer.
7.1.2.Data Protection Contact. ThoughtSpot and its Sub-Processor Affiliates will respond to data protection
inquiries throughout the duration of this DPA and can be contacted at privacy@thoughtspot.com.
7.1.3.No Assessment of Customer Personal Data by ThoughtSpot. ThoughtSpot shall have no obligation to
assess the contents of Customer Personal Data to identify information subject to any specific legal
requirements. Customer is responsible for reviewing the information made available by ThoughtSpot relating
to data security and making an independent determination as to whether ThoughtSpot Cloud meets
Customer’s requirements and legal obligations under Data Protection Laws.
7.1.4.Third-Party Certifications and Audits. ThoughtSpot has obtained third-party certifications and audits. Upon
Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in
the Agreement, ThoughtSpot will make available to Customer (provided that Customer is not a competitor of
ThoughtSpot) or Customer’s independent, third-party auditor, as requested (provided that such auditor is not
a competitor of ThoughtSpot) a copy of ThoughtSpot’s then most recent third-party audits or certifications, as
applicable.
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
7.1.5.Breach Notification. ThoughtSpot will report to Customer any breach of security leading to the accidental or
unlawful destruction, loss, alteration, unauthorized disclosure of or access to Administrative Information
(“Breach”) that it becomes aware of within seventy-two (72) hours following determination by ThoughtSpot
that a Breach has occurred. ThoughtSpot’s notification of, or response to, a Breach will not be construed as
an acknowledgement by ThoughtSpot of any fault or liability with respect to such Breach.
7.1.6.Breach Report. The initial report will be made to Customer’s security or privacy contact(s) designated in
ThoughtSpot’s customer support portal (or if no such contact(s) are designated, to the primary contact
designated by Customer). As information is collected or otherwise becomes available, ThoughtSpot shall
provide without undue delay any further information regarding the nature and consequences of the Breach to
allow Customer to notify relevant parties, including affected Data Subjects, government agencies and data
protection authorities in accordance with EU & UK Data Protection Law. The report will include the name and
contact information of the ThoughtSpot contact from whom additional information may be obtained.
ThoughtSpot shall inform Customer of the measures that it will adopt to mitigate the cause of the Breach and
to prevent future Breaches. Notwithstanding the foregoing, Customer acknowledges that because
ThoughtSpot personnel cannot view the content of Personal Data, it will be unlikely that ThoughtSpot can
provide information as to the particular nature of the Personal Data, or where applicable, the identities, number
or categories of affected Data Subjects. Communications by or on behalf of ThoughtSpot with Customer in
connection with a Breach shall not be construed as an acknowledgment by ThoughtSpot of any fault or liability
with respect to the Breach. Customer will cooperate with ThoughtSpot in maintaining accurate contact
information in the customer support portal and by providing any information that is reasonably requested to
resolve any security incident, including any Breaches, identify its root cause(s) and prevent a recurrence
Customer is solely responsible for determining whether to notify the relevant supervisory authorities and
impacted Data Subjects and for providing such notice.
7.1.7.Audit. No more than once per year and upon written request by Customer, Customer will have the right
directly or through its representative(s) (provided however, that such representative(s) shall enter into written
obligations of confidentiality and non-disclosure directly with ThoughtSpot), to access all reasonable and
industry recognized documentation evidencing ThoughtSpot’s policies and procedures governing the security
of Administrative Information (“Audit”). ThoughtSpot reserves the right to refuse to provide Customer (or its
representatives) with any information which would pose a security risk to ThoughtSpot or its customers, or
which ThoughtSpot is prohibited to provide or disclose under applicable law or contractual obligation. Any
expenses incurred by Customer in connection with the Audit will be borne exclusively by Customer. Audits
will be scheduled at least sixty (60) days in advance of taking place with Customer submitting a detailed
proposed audit plan for ThoughtSpot approval at least two (2) weeks in advance of the proposed audit date
describing the proposed scope, duration, and start date of the Audit. Audits may be subject to an added cost
where the cost of the audit to ThoughtSpot exceeds 2% of the total annual contract commitment under the
Agreement.
7.1.8.Audit Output. Upon completion of the Audit, ThoughtSpot and Customer may schedule a mutually convenient
time to discuss the output of the Audit. ThoughtSpot may in its sole discretion, consistent with industry and
ThoughtSpot’s standards and practices, make commercially reasonable efforts to implement Customer’s
suggested improvements noted in the Audit to improve ThoughtSpot’s security. The Audit and the results
derived therefrom are Confidential Information of ThoughtSpot.
7.2. ThoughtSpot Personnel. Access to Personal Data by ThoughtSpot will be limited to personnel who require such
access to perform ThoughtSpot’s obligations under the Agreement, who are bound by obligations to maintain the
confidentiality of such Personal Data at least as protective as those set forth herein and in the Agreement, and who
have received appropriate training. ThoughtSpot will ensure that such confidentiality obligations survive the
termination of the personnel engagement.
7.3. Customer Protection. Customer is responsible for its use of ThoughtSpot Cloud, including making appropriate use
of ThoughtSpot Cloud to ensure a level of security appropriate to the risk in respect of the Administrative Information,
securing its account and user credentials, managing its data back-up strategies, and protecting the security of
Administrative Information when in transit to and from ThoughtSpot Cloud and taking any appropriate steps to
pseudonymize, securely encrypt, or backup any Administrative Information.
7.4. Deletion of Customer Administrative Information. ThoughtSpot will enable Customer to delete Administrative
Information during the term of the Agreement in a manner consistent with the functionality of ThoughtSpot Cloud.
Upon termination or expiry of the Agreement and at Customer’s written direction, ThoughtSpot shall promptly delete
any remaining Administrative Data in Customer’s instance of ThoughtSpot Cloud, unless retention of the
Administrative Data is required by law.
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
8. General Obligations.
8.1. Confidentiality. Customer may only disclose the terms of this DPA to a supervisory authority to the extent required
by Data Protection Laws, provided however, that any such disclosure shall be limited to the minimum information
necessary to satisfy such disclosure requirement. Customer shall use commercially reasonable efforts to ensure that
data protection or regulatory authorities do not make this DPA public.
8.2. Limitation of Liability. Notwithstanding anything to the contrary in the Agreement or this DPA, Customer’s remedies
with respect to any breach by ThoughtSpot of the terms of this DPA will be subject to any aggregate limitation of
liability under the Agreement. If ThoughtSpot, Inc., ThoughtSpot EMEA Ltd. and ThoughtSpot India Private Limited
are not a party to the Agreement, the section of the Agreement titled ”Limitations of Liability” (or equivalent) will apply
to ThoughtSpot, Inc., ThoughtSpot EMEA Ltd. and ThoughtSpot India Private Limited, and in such respect any
references to ThoughtSpot will include ThoughtSpot, Inc., ThoughtSpot EMEA Ltd., ThoughtSpot India Private Limited
and the ThoughtSpot entity who is party to the Agreement. Customer further agrees that any regulatory penalties
assessed against ThoughtSpot in relation to Personal Data that arise as a result of, or in connection with, Customer’s
failure to comply with its obligations under this DPA or any applicable Data Protection Laws will count toward and
reduce ThoughtSpot’s liability under the Agreement as if it were liability to the Customer under the Agreement.
8.3. Termination. This DPA will terminate simultaneously and automatically with the termination of the Agreement or
expiration of the Subscription Term where Customer does not renew.
8.4. Waivers and Modifications. A waiver of any right is only effective if it is in writing and only against the party who
signed such writing and for the circumstances given. Any modification of this DPA must be in writing and signed by
authorized representatives of both parties.
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
APPENDIX 1
TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix 1 forms part of the Clauses and must be completed by the parties.
The Member States may complete or specify, according to their national procedures, any additional necessary information
to be contained in this Appendix 1.
Data Exporter
The Data Exporter is the legal entity identified as the "Customer" in the Data Processing Addendum in place between data
exporter and data importer and to which these Clauses are appended.
Data Importer
The Data Importer is the provider of search and AI-driven analytics Products in accordance with the Agreement.
Data Subjects
Data Exporter may submit Personal Data to the Product, the type and extent of which is determined and controlled by
Customer in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories
of data subjects:
● Prospects, customers, business partners and vendors of Customer (who are natural persons);
● Employees or contact persons of Customer’s prospects, customers, business partners and vendors;
● Employees, agents, advisors, freelancers of Customer (who are natural persons); and/or
● Customer’s Users authorized by Customer to use the Services.
Categories of Data
The Data Exporter may submit Personal Data as Administrative Information to the Product, the extent of which is determined
and controlled by the Data Exporter in its sole discretion and which may include, but is not limited to, Personal Data relating
to the following categories of Personal Data:
The types of Customer Personal Data are determined and controlled by Customer in its sole discretion, and may include,
but are not limited to:
● Identification and contact data (name, address, title, contact details);
● Financial information (account details, payment information);
● Employment details (employer, job title, geographic location, area of responsibility); and/or
● IT information (IP addresses, usage data, cookies data, location data).
Special Categories of Data (if appropriate)
Customer may, subject to the restrictions set out in the Documentation, submit special categories of Personal Data to the
Product, the extent of which is determined and controlled by Customer in its sole discretion, and which is for the sake of
clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or
trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural
person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Processing Operations
The Data Importer will Process Personal Data in the provision of the Product and support thereof pursuant to the Agreement.
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
APPENDIX 2
TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix 2 forms part of the Clauses and must be completed and signed by the parties.
Description of the technical and organisational security measures implemented by the data importer in
accordance with Clause 4(d) and Clause 5(c) (or documents/legislation attached):
Data Importer maintains a written information security program of policies, procedures and controls as described in the
Agreement, which is incorporated in this Appendix 2 by this reference.
Docusign Envelope ID: CB4D5A49-4F13-4F70-BCBD-ED9064C251D0
APPENDIX 3
STATE LAW APPENDIX
This Appendix 3 applies to ThoughtSpot’s provision of, and Customer’s use, of the ThoughtSpot Cloud to the extent that
Customer is a “Business” and ThoughtSpot is Processing Personal Information on Customer’s behalf pursuant to CCPA.
The parties agree as follows:
1. The terms “Business”, “Business Purpose”, “Personal Information”, “Sensitive Personal Information”, “Sale”, “Share”,
and “Service Provider” have the meanings ascribed to them in the CCPA. In this Appendix 3, the term Personal
Information includes Sensitive Personal Information.
2. ThoughtSpot is a Service Provider under the Agreement and will not:
a. Sell or Share any Personal Information;
b. retain, use, or disclose any Customer Personal Information (i) for any purpose other than for the Business
Purposes in the Agreement, including for any commercial purpose, or (ii) outside of the direct business
relationship between Customer and ThoughtSpot; or
c. combine Personal Information received from or on behalf of customer with Personal Information received from
or on behalf of any third party or collected from ThoughtSpot’s own interaction with individuals or data subjects,
except to perform a Business Purpose that is permitted by the CCPA and the Agreement.
3. The parties acknowledge that the Personal Information Customer discloses to ThoughtSpot is provided only for the
limited and specified purposes set forth in the Agreement. ThoughtSpot shall provide the same level of protection to
Personal Information as required by the CCPA and as more fully set out in the Agreement.
4. Customer may take such reasonable steps as may be necessary (a) to remediate ThoughtSpot’s unauthorized use of
Personal Information (if any), and (b) to ensure that Personal Information is used in accordance with the terms of this
Appendix 3 and the Agreement.
5. ThoughtSpot shall promptly notify Customer if it is not able to meet the requirements under this Appendix 3.
6. This Appendix 3 shall not change any of the other rights, obligations, and terms under the Agreement. Subject to the
modifications herein, the Agreement shall remain in full force and effect.
7. To the extent ThoughtSpot is deemed a “contractor” under the CCPA, ThoughtSpot certifies that it understands the
restrictions set forth in this DPA and in this Appendix 3 and will comply with them.