Legal / 03

Data Processing Addendum

Last updated 10 September 2026

This addendum forms part of the customer agreement when THAVIQ processes personal data on the customer's behalf.

Request the Data Processing Addendum (privacy@thaviq.com)

Support access

Authorised support personnel may access a customer workspace solely to investigate or resolve service issues. Each impersonation session expires after 30 minutes, displays a persistent staff-facing banner, and records the administrator, customer organisation, action, timestamp and truncated source IP in an append-only audit trail. Support staff cannot change billing; analysts have read-only access. Administrators use a separate identity realm and mandatory two-factor authentication.

Core terms

• The customer is controller and THAVIQ is processor for submitted scan data.
• Processing is limited to providing, securing and supporting the contracted service.
• Personnel are bound by confidentiality and access is limited by role.
• Sub-processors are governed by equivalent data-protection duties.
• THAVIQ assists with data-subject requests, incidents, assessments and audits.
• At termination, data is returned or deleted subject to documented legal retention.

These subjects follow the processor-contract requirements in GDPR Article 28 .