1. Introduction & Scope
This Data Processing Agreement ("DPA") forms part of the agreement between ThryvLoop (productivity software operator, India) ("Processor," "ThryvLoop") and the business customer ("Controller," "Customer") that uses ThryvLoop team workspaces or other B2B features.
Where an individual uses ThryvLoop personally (not via an organisation), the Privacy Policy applies directly and this DPA does not apply unless separately agreed.
This DPA is offered to help Customers meet obligations under DPDPA (India), GDPR (EEA/UK), and similar laws when ThryvLoop processes personal data on the Customer's instructions.
2. Roles & Instructions
- Customer determines purposes and means of processing member/colleague data in the workspace (typically Data Fiduciary / Controller);
- ThryvLoop processes such data only on documented instructions from the Customer via use of the Service, these Terms, this DPA, and the Privacy Policy;
- Customer is responsible for lawful basis, notices to members, and internal policies;
- Customer instructs us not to process special-category or highly sensitive data via the Service (see Privacy Policy).
3. Subject Matter & Data
Processing relates to provision of ThryvLoop B2B features, including:
- Organisation membership, roles, and invitations (via Clerk Organizations);
- Shared tasks, assignees, and workspace activity;
- Org-level analytics where enabled;
- Support and security operations.
Categories of data subjects: Customer's employees, contractors, and invited members. Data categories mirror Section 3 of our Privacy Policy as applicable to workspace use.
4. Processor Obligations
- Process personal data only on Customer instructions unless required by law;
- Ensure personnel with access are bound by confidentiality;
- Implement appropriate technical and organisational security measures (encryption in transit, access controls, RLS where applicable);
- Assist Customer with data subject requests where technically feasible, via privacy@thryvloop.com;
- Delete or return Customer personal data upon termination, subject to legal retention and backup purge cycles in the Privacy Policy;
- Make available information reasonably necessary to demonstrate compliance.
5. Subprocessors
Customer authorises ThryvLoop to engage subprocessors listed in Section 9 of our Privacy Policy, including Clerk, Supabase, Vercel, Google (where members connect integrations), and Resend (transactional email).
We will notify Customers of material subprocessor changes via the Privacy Policy or email where required. Customers may object on reasonable grounds relating to data protection; if unresolved, Customer may terminate affected B2B features.
6. International Transfers
Personal data may be processed in India and other countries where subprocessors operate. Transfers are subject to safeguards described in the Privacy Policy (including Standard Contractual Clauses or equivalent where required).
7. Security Incidents
We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data processed under this DPA, and provide information reasonably required for the Customer to meet regulatory obligations, to the extent known.
8. Audits & Cooperation
Upon reasonable written request, we will provide summaries of security practices or certifications if available. Onsite audits are limited to once per year with 30 days' notice, during business hours, and subject to confidentiality, unless required by a supervisory authority.
9. Liability & Term
Liability under this DPA is subject to the limitation of liability in our Terms of Service, except where prohibited by applicable data protection law.
This DPA remains in effect while the Customer uses B2B features and survives termination as needed to wind down processing.
10. How to Execute
To execute this DPA with your organisation, email privacy@thryvloop.com with your company legal name, signatory details, and workspace domain. We will countersign or confirm acceptance by email.
- Privacy / DPA requests: privacy@thryvloop.com
- Grievance Officer (India): Grievance Officer, Data Protection & Grievance Officer · grievance@thryvloop.com
- Help Centre: https://thryvloop.com/help
ThryvLoop (productivity software operator, India) · Bengaluru, Bengaluru, Karnataka 560038, India
Need a signed DPA?
Email us with your organisation details. This document supplements our Privacy Policy and Terms of Service.
These documents are provided for transparency. They are not legal advice. Have qualified counsel review them for your jurisdiction and business model before relying on them commercially.