In plain terms
This addendum applies when you use Torchrunner to process personal data about your own clients, contacts, staff and others, and data protection law requires a contract between us. You are the controller of that data and we are the processor. It forms part of our Terms of Service and applies automatically once you accept them. To countersign a copy, write to legal@torchrunner.ai.
Scope and roles
This Data Processing Addendum (“DPA”) is between Torchrunner, Inc., a Delaware corporation (“Torchrunner”), and the customer that accepted the Terms (“Customer”). It applies to Personal Data in Customer Data that Torchrunner processes on Customer’s behalf in providing the Service, and to which data protection laws apply, including the GDPR, the UK GDPR, the Swiss FADP and US state privacy laws (“Data Protection Law”). Terms such as controller, processor, Personal Data, processing and Personal Data Breach have the meanings in Data Protection Law. Customer Data and Service have the meanings in the Terms.
For this Personal Data, Customer is the controller (or a processor acting for its own controller) and Torchrunner is the processor (or a sub-processor). Torchrunner is an independent controller of account, billing and website data as described in the Privacy Policy, and this DPA does not cover that data. Where US state privacy law applies, Torchrunner acts as a service provider or contractor, and it will not sell or share Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, or combine it with other data except as the law permits.
Instructions and confidentiality
Torchrunner will process Personal Data only on Customer’s documented instructions, which are the Terms, this DPA, and Customer’s use of the Service’s features and settings, unless the law requires otherwise, in which case Torchrunner will tell Customer first where it may. Customer is responsible for its instructions being lawful and for having the notices, consents and legal bases it needs, including for calls, recordings, messages and the information of the people it records or contacts. Torchrunner will tell Customer if it believes an instruction breaks Data Protection Law. Torchrunner does not use Customer Data to train AI models. People who process Personal Data for Torchrunner are bound to confidentiality.
Security
Torchrunner will maintain technical and organizational measures appropriate to the risk, at least those in Annex II, and may update them provided it does not materially reduce the protection. Customer is responsible for its own account security, including who it gives access to and the permissions it sets.
Subprocessors
Customer gives Torchrunner general authorization to use the subprocessors described on the subprocessor page and named in the list Torchrunner gives Customer on request (the “Subprocessor List”), and Torchrunner will remain responsible for them. Torchrunner will enter into written agreements with each that require appropriate data protection and security safeguards. Before Torchrunner authorizes a new subprocessor for Customer Data, it will update that page where the type of provider changes and email account owners who have asked for notice, naming the provider. Customer may object on reasonable data protection grounds by writing to privacy@torchrunner.ai within a reasonable time. The parties will talk in good faith, and if the issue cannot be resolved, Customer may stop using the affected feature or cancel the affected subscription.
International transfers
Torchrunner processes Personal Data in the United States and in the countries where its subprocessors operate. Where Customer transfers Personal Data subject to the GDPR to Torchrunner in a country without an adequacy decision, the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 apply and are incorporated: Module Two (controller to processor) or Module Three (processor to processor), as applicable. The parties select: clause 7 docking clause, not used; clause 9(a), Option 2 (general authorization) with notice as in the Subprocessors section; clause 11(a) optional language, not used; clause 17, Option 1 with the law of Ireland; clause 18(b), the courts of Ireland. The clauses are incorporated by reference, and the party details in Annex I.A are those in the Terms and the account. Annex I and Annex II of this DPA are Annexes I and II of the clauses, and the Subprocessor List is Annex III. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to those clauses applies, with Tables 1 to 3 completed from the same information and the Table 4 option for neither party to end it, and for Swiss transfers the clauses apply with references to the GDPR read as the Swiss FADP and the Swiss Federal Data Protection and Information Commissioner as the supervisory authority. Torchrunner will give Customer a completed Annex III naming each provider and its processing location when Customer asks for it or signs the clauses, and that annex forms part of this DPA. On request, Torchrunner will also sign a completed copy of the clauses and addendum for Customer’s records.
Help with requests and assessments
Taking into account the nature of the processing, Torchrunner will give Customer the tools in the Service, and reasonable help beyond them, to respond to requests from individuals to exercise their rights, and to carry out data protection impact assessments and consult regulators. If an individual contacts Torchrunner about Customer Data, Torchrunner will refer them to Customer where it can identify the Customer, and will not respond to the substance unless the law requires. Torchrunner may charge for help that goes beyond what is reasonable.
Security incidents
Torchrunner will notify Customer without undue delay after it becomes aware of a Personal Data Breach affecting Customer Data. The notice will describe, to the extent known, the nature of the breach, the affected data and people, the likely consequences, the steps taken to contain it, and a contact for follow-up. Torchrunner will add detail as it learns it, take reasonable steps to contain and fix the breach, and reasonably help Customer meet its own notification duties. A notice is not an admission of fault or liability.
Audits
Torchrunner will give Customer the information reasonably needed to show compliance with this DPA, such as available security documentation and summaries of independent reports. If that is not enough, or a regulator requires it, Customer may audit Torchrunner no more than once a year, on reasonable written notice, during business hours, under confidentiality, at Customer’s cost, and without access to other customers’ data or to anything that would compromise security.
Deletion and return
During the subscription, Customer can export the CRM records, tasks, activity and meeting notes that the Service’s export tools cover. For other data, or to have Customer Data deleted after the subscription ends, Customer can write to privacy@torchrunner.ai. Torchrunner will explain what can be exported or deleted and apply the retention periods in the Privacy Policy. Deleted items may stay in trash under those periods, and Torchrunner keeps data where the law requires. Data held in backups is overwritten on the ordinary backup cycle. Meeting recordings are removed from our notetaker provider after 60 days.
Liability and precedence
Each party’s liability under this DPA is subject to the limitations in the Terms, except where the Standard Contractual Clauses or the law do not allow it. If this DPA conflicts with the Terms on the processing of Personal Data, this DPA controls. If it conflicts with the Standard Contractual Clauses, the clauses control. This DPA lasts as long as Torchrunner processes Customer Data. Otherwise the governing law and venue in the Terms apply.
Annex I: details of processing
| Item | Detail |
|---|---|
| Parties | Customer is the data exporter and controller. Torchrunner is the data importer and processor. Contact for each is the account owner and privacy@torchrunner.ai. |
| Subject matter and nature | Providing Torchrunner and runnerID: hosting, storing, retrieving, organizing, transmitting, analyzing with AI, and deleting Customer Data as the Customer directs. |
| Purpose | To provide the Service to Customer and support it. |
| Duration | The term of the subscription plus the retention periods in the Privacy Policy and the Deletion and return section. |
| Frequency of transfer | Continuous, while Customer uses the Service. |
| Data subjects | Customer's staff and users; its clients, prospects and their staff and contacts; people who email, call, text, meet or sign documents with Customer; and others whose data Customer puts into the Service. |
| Categories of Personal Data | Names, email addresses, phone numbers and other contact details; job titles; email, calendar, call, voicemail, text and chat content; meeting recordings, transcripts and notes; documents and notes; financial and invoice data and bank transaction data; credentials and tokens Customer stores; and any other data Customer submits. |
| Sensitive data | Not intended. Customer should not submit special categories of data or health data unless it has assessed the risk, and remains responsible for doing so. Stored credentials and financial account data are protected by the measures in Annex II. |
| Retention | As described in the Privacy Policy and in the Deletion and return section. |
| Subprocessors | See the subprocessor page for each provider type, what it does and where. The named Subprocessor List is available on request. |
| Supervisory authority | For GDPR transfers, the authority of the Member State where Customer is established, or if none, the Irish Data Protection Commission. |
Annex II: security measures
- Separation of customers. Tenant isolation enforced in the database so one organization cannot read another’s data, and access checks in the application.
- Encryption. HTTPS for data in transit. Credentials, connection tokens and similar secrets are encrypted before storage with keys specific to the Customer’s organization, and runnerID encrypts each identity with its own key. Our infrastructure providers encrypt stored data at rest.
- Access and authentication. Individual accounts, strong password rules with breach checks, optional two-factor sign-in, role-based permissions, and hashed tokens for programmatic access.
- AI controls. Approval gates for actions that leave the business, move money or delete data; scoped access for AI agents; and a log of agent actions.
- Logging and monitoring. Audit logs for agent and financial actions, and error monitoring.
- Resilience. Provider-managed backups and recovery for the database, and a documented recovery process.
- Vendor management. Subprocessors are chosen with security in mind, are bound by written terms, and are described on our subprocessor page.
- People and development. Confidentiality obligations for people with access, code review and automated checks before changes ship, and security checks on database changes.