Thanex Data Processing Addendum
Last updated: 30 October 2026
1. About this Addendum
1.1 The Thanex Data Processing Addendum, referred to as the “Addendum,” sets out the terms on which Thanex Ltd, referred to as “Thanex,” “we,” “us,” or “our,” processes personal data on behalf of a Customer when providing the Service. It supplies the terms required by Article 28(3) of the UK GDPR and, where it applies, of the EU GDPR.
1.2 Thanex Ltd is a private limited company incorporated in England and Wales under company number 16426957. Its registered office is at Flat 11, Mill Pond Place, Mill Lane, Maidstone, England, ME14 1GL, United Kingdom. It is registered with the Information Commission’s Office under registration number ZC007423.
1.3 The Addendum forms part of the Thanex Terms and Conditions, referred to as the “Terms.” It applies automatically, without signature, from the moment a Customer first does any of the following: buys a Business plan, creates or takes ownership of a Business Workspace, or uses a Personal Workspace for the purposes of a trade, business, or profession in a way that involves personal data about other people.
1.4 A Customer that needs a countersigned copy of the Addendum may request one from [email protected]. A countersigned copy carries the same terms as the published version and does not replace it.
1.5 Where the Addendum and the Terms conflict on the processing of Customer Personal Data, the Addendum prevails. Where the Addendum and the Standard Contractual Clauses or the United Kingdom International Data Transfer Addendum conflict, those transfer terms prevail.
1.6 The Addendum does not apply to a person using the Service wholly for personal or household purposes, because Article 2(2)(c) of the UK GDPR places that processing outside its scope.
1.7 The Addendum does not cover the personal data for which Thanex acts as controller, such as Account registration, authentication, subscription status, support, Service security, and its own operational records. The Thanex Privacy Policy describes that processing.
2. Definitions
2.1 Terms defined in the Terms, including Account, Business Customer, Business plan, Business Workspace, Contributor, Live Project, Owner, Personal Workspace, Project, Project Content, Report, Service, Store, Task, User, View-Only Mode, and Workspace, have the same meaning in the Addendum.
2.2 “Customer” means the Business Customer that controls a Business Workspace and, in the case described in clause 1.3, the individual User who controls the Project Content in a Personal Workspace used for a trade, business, or profession.
2.3 “Customer Personal Data” means the personal data contained in Project Content, and any other personal data that Thanex processes on behalf of the Customer in providing the Service, as described in Schedule 1.
2.4 “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the amendments made to each of them by the Data (Use and Access) Act 2025, and, where they apply to the processing of Customer Personal Data, the EU GDPR and any other law on the protection of personal data, including the laws referred to in clause 17.
2.5 “UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018, and “EU GDPR” means Regulation (EU) 2016/679.
2.6 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
2.7 “Sub-processor” means a third party appointed by Thanex that processes Customer Personal Data on behalf of Thanex for the Customer.
2.8 “Controller,” “processor,” “data subject,” “personal data,” “processing,” and “supervisory authority” have the meanings given in Data Protection Law.
3. Roles of the parties
3.1 The Customer is the controller of Customer Personal Data, and Thanex is its processor. Schedule 1 describes the subject matter, duration, nature, and purpose of the processing, and the categories of personal data and of data subjects.
3.2 The User holding the Owner role over a Business Workspace accepts the Addendum on behalf of the Business Customer and confirms that the User has authority to do so. Holding the Owner role does not make that individual the controller, and a workspace ownership transition between authorised representatives of the same Business Customer does not change the controller.
3.3 Where a Business Workspace is transferred to a different organisation, the incoming organisation becomes the Customer under the Addendum when its representative accepts ownership under clause 21 of the Terms.
3.4 Project Content supplied by a Contributor through a Task is Customer Personal Data of the Customer that controls the Workspace in which the Task was created.
3.5 Thanex acts as an independent controller, and not as processor, for the limited processing needed to protect the Service, to investigate unlawful use, to comply with a binding legal requirement, or to establish, exercise, or defend legal claims. That processing is confined to the purpose concerned.
4. The Customer’s instructions
4.1 Thanex processes Customer Personal Data only on the documented instructions of the Customer, unless Data Protection Law, or other law of the United Kingdom or of a Member State of the European Union to which Thanex is subject, requires otherwise. Where the law requires other processing, Thanex will tell the Customer before carrying it out, unless the law forbids that on important grounds of public interest.
4.2 The Customer’s documented instructions are the Terms, the Addendum, and the actions taken through the Service by the Customer’s authorised Users, including the Owner, administrators, and members acting within their permissions. Creating a Project, inviting a member, setting project tags, enabling stamp fields, creating a Task, making a Report, exporting photographs, completing a Project, and deleting content or a Workspace are all instructions.
4.3 The Customer instructs Thanex in advance to keep the Project Content of a Business Workspace in View-Only Mode, without a fixed end, when paid Business access ends, as clause 20 of the Terms describes. The Customer may end that retention at any time by deleting the Workspace.
4.4 Further instructions outside the Service may be given in writing to [email protected]. An instruction that would change the Service for one Customer, or that carries a cost, takes effect only once Thanex agrees to it in writing.
4.5 Thanex will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Law. Thanex is not obliged to carry out an instruction that it reasonably believes to be unlawful.
4.6 Thanex does not sell Customer Personal Data, does not use it for advertising, and does not use it to train or improve artificial-intelligence models. Thanex does not inspect the content of photographs, notes, or Project records except where needed to provide support the Customer has asked for, to keep the Service secure, or under clause 3.5.
5. Confidentiality of people working for Thanex
5.1 Thanex gives access to Customer Personal Data only to the directors, employees, and contractors who need it to provide, support, maintain, or secure the Service, and only to the extent they need it.
5.2 Everyone given that access is bound by a written duty of confidentiality, or is under an appropriate statutory duty of confidentiality, and has agreed to process Customer Personal Data only for the purpose of their work for Thanex.
5.3 Thanex removes a person’s access to systems holding Customer Personal Data when that person’s work for Thanex ends, or sooner when the access is no longer needed.
5.4 Thanex makes sure that the people given access understand that deletion in the Service is immediate and cannot be reversed, and that no recovery facility exists for them to use.
6. Security
6.1 Thanex applies the technical and organisational measures described in Schedule 2 to protect Customer Personal Data, as required by Article 32 of the UK GDPR. The measures take account of the state of the art, the cost of implementation, and the nature, scope, context, and purposes of the processing, together with the risk to the rights and freedoms of individuals.
6.2 Thanex may update the measures in Schedule 2 over time, provided that an update does not materially reduce the overall level of protection.
6.3 The Customer is responsible for the security measures within its own control, including choosing who joins its Workspaces, assigning roles, removing access when someone leaves, keeping credentials secure, choosing which stamp fields are enabled, and sending Task links and Reports only to people entitled to see them.
7. Sub-processors
7.1 The Customer gives Thanex general written authorisation to appoint Sub-processors. The Sub-processors in use on the date of the Addendum are listed in Schedule 3, and the Customer authorises each of them.
7.2 Thanex appoints each Sub-processor under a written contract that imposes data-protection obligations providing at least the same level of protection as the Addendum, as required by Article 28(4) of the UK GDPR.
7.3 Thanex remains responsible to the Customer for the performance of each Sub-processor’s data-protection obligations.
7.4 Thanex will give at least 30 days’ notice before adding or replacing a Sub-processor. Notice is given by updating Schedule 3 on the Thanex website and by email to the Owner of each Business Workspace, except where an urgent replacement is needed to keep the Service secure or available, in which case notice is given as soon as practicable.
7.5 The Customer may object to a new Sub-processor on reasonable data-protection grounds by writing to [email protected] within the notice period. Thanex will then work with the Customer in good faith to find a solution. If none is found, the Customer may stop using the affected part of the Service, export its Project Content, and cancel its Subscription through the relevant Store.
7.6 Payments, renewals, and refunds for Subscriptions are handled by the Store that sold them, under its own rules, so Thanex cannot itself refund a Subscription when the Customer cancels under clause 7.5.
8. International transfers
8.1 Thanex transfers Customer Personal Data outside the United Kingdom only where a lawful transfer mechanism under Chapter 5 of the UK GDPR is in place. The Customer authorises the transfers described in Schedule 3.
8.2 Depending on the destination and the Sub-processor, the mechanism is United Kingdom adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where the recipient holds a valid certification, the United Kingdom International Data Transfer Agreement, or the United Kingdom International Data Transfer Addendum to the Standard Contractual Clauses of the European Commission. Where the EU GDPR applies to an onward transfer, the mechanism is the EU-US Data Privacy Framework for a certified recipient or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914.
8.3 Where the EU GDPR applies to a Customer, transfers of Customer Personal Data from the European Economic Area to Thanex in the United Kingdom rely on the adequacy decision adopted by the European Commission in respect of the United Kingdom.
8.4 Where a mechanism stops being valid, Thanex will move to another lawful mechanism without undue delay and will tell the Customer if that cannot be done.
9. Requests from data subjects
9.1 The Service gives the Customer’s authorised Users the means to answer most requests from data subjects themselves: they can find, view, download, and export photographs, Reports, and Tasks, correct the structured details held with a photograph, remove a member, and delete photographs, Projects, or a Workspace.
9.2 Where Thanex receives a request from a data subject about Customer Personal Data, it will pass the request to the Customer without undue delay and will not answer it directly, except to confirm that it has been passed on, unless the Customer authorises Thanex to answer or the law requires it.
9.3 Thanex will give the Customer reasonable assistance, taking account of the nature of the processing, in meeting its obligation to respond to requests under Chapter 3 of the UK GDPR. Assistance includes preparing a structured export on request where the Service does not provide one, as clause 23 of the Terms explains.
10. Personal Data Breaches
10.1 Thanex will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice is given by email to the Owner of the Business Workspace concerned, or to the individual Customer, and through the Service where practicable.
10.2 The notice will describe, so far as the information is then available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to deal with the breach and to reduce its effects. Information not available at first will be given in stages as it becomes available.
10.3 Thanex will take reasonable steps to contain, investigate, and remedy the breach, and will give the Customer the assistance it reasonably needs to meet its own obligations to notify the Information Commission or another competent supervisory authority and data subjects under Articles 33 and 34 of the UK GDPR or, where it applies, of the EU GDPR.
10.4 Notifying a Personal Data Breach is not an admission of fault or liability by Thanex. The Customer decides whether to notify the Information Commission or another competent supervisory authority or data subjects, and Thanex will not notify them on the Customer’s behalf unless the Customer asks it to or the law requires it.
11. Impact assessments and prior consultation
11.1 Thanex will give the Customer the information about the Service that it reasonably needs to carry out a data protection impact assessment under Article 35 of the UK GDPR or of the EU GDPR, and to consult the Information Commission or another competent supervisory authority under Article 36 where that is required.
11.2 Information that Thanex already publishes, including the Terms, the Privacy Policy, and the Addendum, is given by reference to it. Where the Customer needs more than that, Thanex may charge a reasonable fee agreed in advance.
12. Retention, deletion, and return
12.1 Thanex keeps Customer Personal Data for as long as the Customer keeps it in the Service, and deletes it when the Customer’s authorised Users delete it, subject to clause 12.6.
12.2 When paid Business access ends, the Business Workspace enters View-Only Mode under clause 20 of the Terms, on the instruction given in clause 4.3. Its Project Content is kept, viewable and exportable, without a fixed end, until the Owner holds a Business plan again or deletes the Workspace. Thanex does not delete a Workspace because it is in View-Only Mode.
12.3 A photograph deleted by a member of a Business Workspace moves to the bin of that Workspace and stays there until an administrator or the Owner restores it or deletes it permanently.
12.4 The Customer chooses between deletion and return at any time, and at the end of the Service. Return is available through the Service, in which the Customer’s authorised Users can download or export photographs, Reports, and Tasks, including during View-Only Mode and from Completed Projects; where the Customer needs Customer Personal Data in a form the Service does not offer, Thanex will prepare a structured export on written request, within 30 days of the request. Deletion is carried out by the Owner, who can delete a Business Workspace, or by an individual Customer, who can delete the Account, and it removes the Project Content from the active systems of the Service immediately; it cannot be reversed by the Customer, by Thanex, or by anyone else.
12.5 The Customer should complete any export it needs before deleting, because Thanex cannot recover deleted Project Content.
12.6 After deletion from active systems, copies may remain in encrypted routine backups that cannot be reached through the Service and are never used to restore a deleted Account or Workspace. Those copies are purged as the backups are overwritten or expire, and in any event no later than 30 days after deletion. Thanex may also keep Customer Personal Data where the law of the United Kingdom, or other law to which Thanex is subject, requires it, and only for as long as that law requires.
12.7 Where an ordinary member of a Business Workspace deletes an Account, the Project Content that member created for the Workspace stays under the Customer’s control, as clause 22.8 of the Terms describes, and is not deleted by Thanex unless the Customer instructs it.
13. Information and audits
13.1 Thanex will make available to the Customer the information reasonably needed to show that it meets its obligations under Article 28 of the UK GDPR and the Addendum.
13.2 The Customer may ask for that information in writing to [email protected], including by sending a reasonable set of written security or data-protection questions no more than once in any 12 months. Thanex will answer within 30 days.
13.3 Where the information given under clause 13.2 is not enough to show compliance, or where a supervisory authority or a Personal Data Breach requires it, the Customer, or an independent auditor bound by confidentiality, may carry out an audit. The Customer must give at least 30 days’ written notice, agree the scope with Thanex in advance, carry out the audit during business hours without disrupting the Service, and bear its own costs.
13.4 An audit does not give access to the data of other customers, to Thanex’s security-sensitive configuration beyond what the audit needs, or to the premises of a Sub-processor, whose own audit reports and certifications are given instead where available.
14. The Customer’s obligations
14.1 The Customer is responsible for having a lawful basis for the processing it instructs, for giving data subjects the privacy information that Data Protection Law requires, and for meeting its own obligations as controller.
14.2 The Customer is responsible for deciding what is photographed and recorded, which stamp fields and location data are enabled, who may join its Workspaces, and how long its records are kept, and for telling its workers, visitors, contractors, and clients where photography and location recording take place.
14.3 The Customer must not instruct Thanex to process special-category data or criminal-offence data unless it has identified a lawful condition for that processing. Thanex does not ask for such data, although a photograph may contain it because of what a User chooses to capture.
14.4 The Customer must make sure its own instructions comply with Data Protection Law.
15. Liability
15.1 Each party’s liability under or in connection with the Addendum is subject to the exclusions and limits in clause 30 of the Terms, which apply to the Addendum and the Terms together and not separately.
15.2 Nothing in the Addendum limits a party’s liability to data subjects under Article 82 of the UK GDPR, or any liability that cannot lawfully be limited.
16. Duration, changes, and governing law
16.1 The Addendum continues for as long as Thanex processes Customer Personal Data, including during View-Only Mode, and ends once that processing has ended under clause 12. Clauses that by their nature should continue after it ends, including clauses 5, 12, 13, and 15, continue.
16.2 Thanex may update the Addendum to reflect changes in Data Protection Law, in the Service, or in its Sub-processors. Thanex will give notice of a material change by email to the Owner of each Business Workspace and through the Service at least 30 days before it takes effect, unless a shorter period is required by law. A change will not reduce the protection the Addendum gives to Customer Personal Data.
16.3 If a provision of the Addendum is found invalid or unenforceable, the rest of it continues in effect.
16.4 The Addendum, and any non-contractual obligation arising from it, is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Standard Contractual Clauses or the United Kingdom International Data Transfer Addendum require otherwise.
16.5 Notices to Thanex under the Addendum should be sent to [email protected] or to Thanex Ltd, Flat 11, Mill Pond Place, Mill Lane, Maidstone, England, ME14 1GL, United Kingdom.
17. Additional Provisions for Particular Laws
17.1 Where the Customer is a business subject to the California Consumer Privacy Act of 2018, Thanex acts as its service provider and processes the personal information contained in Customer Personal Data for the business purpose of providing the Service described in Schedule 1. Thanex shall not sell or share that personal information; retain, use, or disclose it for any purpose other than the business purposes specified in the Addendum, including for a commercial purpose; retain, use, or disclose it outside the direct business relationship between Thanex and the Customer; or combine it with personal information received from or on behalf of another person, or collected from its own interaction with the consumer, except as that Act and its regulations permit. Thanex will comply with the obligations applying to it under that Act, provide the same level of privacy protection as that Act requires, notify the Customer if it determines that it can no longer meet those obligations, and permit the Customer, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use. Sub-processors are engaged under written terms binding them to the same requirements, and the Customer is informed of each engagement under clause 7. The same commitments apply, with the necessary changes, under any other comprehensive privacy law of a state of the United States that requires them of a processor.
17.2 Where the Customer is bound by the Privacy Act 1988 (Cth), Thanex will handle Customer Personal Data consistently with the Australian Privacy Principles that apply to the Customer, will not use or disclose it other than to provide the Service, and will notify the Customer without undue delay of any Personal Data Breach, so that the Customer can carry out the assessment required by section 26WH and any notification required by Part IIIC of that Act.
17.3 Where the processing of Customer Personal Data is subject to Law No. 124/2024 on personal data protection, Thanex will also meet the obligations that the Law imposes on a processor, and transfers outside Albania are made under Chapter IV of that Law, including Decision No. 01 of 30 April 2025 of the Commissioner for the Right to Information and Personal Data Protection, which lists the United Kingdom among the countries ensuring an adequate level of protection.
Schedule 1. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Hosting, storing, organising, displaying, sharing, exporting, and deleting the Customer’s site photographs and Project records through the Service |
| Duration | For as long as the Addendum continues under clause 16.1, including View-Only Mode, plus the backup period in clause 12.6 |
| Nature | Collection through the mobile applications, the web application, and Task links, including photographs a User chooses to upload to a Task; storage; organisation by Project, record type, and project tags; stamping; search and filtering; display; making Reports; sending notifications; export; backup; deletion |
| Purpose | Providing the Service to the Customer under the Terms, and supporting, maintaining, and securing it |
| Frequency | Continuous |
Categories of data subjects
The data subjects are the Customer’s Owner, administrators, and members; Contributors who supply photographs through a Task link; people who appear in, or can be identified from, photographs, notes, or Reports, such as workers, visitors, clients, and members of the public; and people who receive a Task link or a Report.
Categories of personal data
The personal data comprises the names, job titles, roles, company names, and email addresses of members and invited people; photographs and the images of people in them; the details held with each photograph, namely the record type, the Project, the project tags, the note, the date and time, the person who took it, the GPS coordinates where enabled, and the Photo ID; Task records, comprising descriptions, photographs, due dates, the people assigned, replies, and decisions to accept a reply or send it back; Reports, comprising the photographs selected, the actions written in them, and the identity of the person who made them; activity records showing who captured, uploaded, downloaded, exported, invited, or deleted what, and when; and, for Contributors, any name or note entered, the time of upload, and technical details of the device and connection.
Special-category and criminal-offence data
Thanex does not ask for either. A photograph may contain them because of what a User chooses to capture, and clause 14.3 applies.
Schedule 2. Security measures
| Area | Measure |
|---|---|
| Data in transit | Encrypted connections between the mobile applications, the web application, and Thanex servers |
| Data at rest | Photographs stored in Amazon S3 in London with AES-256 server-side encryption |
| Access by Users | Every Account is personal; role-based permissions (Owner, administrator, member); Personal Workspaces and Business Workspaces kept separate; access granted per Project |
| Access by people working for Thanex | Given only where needed for the work, bound by confidentiality, removed when no longer needed |
| Links | Task links expire after 30 days or when the Task is closed; Report photograph links are hard to guess, cannot be found from a Photo ID, and open one photograph only |
| Member search | The Find Thanex User lookup finds someone only when their full email address is typed exactly, has no name search, and is available only to people inviting members |
| Logging | Authentication, security, and administrative events are logged and kept for no more than 12 months in the ordinary course |
| Resilience | Routine encrypted backups, purged no later than 30 days after deletion |
| Suppliers | Sub-processors assessed before appointment and bound by written data-protection terms |
| Incidents | An incident response procedure, with notice to the Customer under clause 10 |
| Offline use | Photographs taken without a connection are held in the mobile application’s own storage on the device until uploaded, not in the device’s photo library |
Schedule 3. Sub-processors
| Sub-processor | What it does | Customer Personal Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services | Hosts the application, its database, and its logs, stores photographs in Amazon S3, stamps them and prepares downloads with AWS Lambda, and delivers them through Amazon CloudFront | All Customer Personal Data | United Kingdom (London) for hosting and storage. AWS Lambda runs in the United States. CloudFront may cache copies briefly outside the United Kingdom | None needed for hosting and storage in the United Kingdom; processing outside it is covered by the AWS data processing addendum |
| Plus Five Five, Inc. (Resend) | Sends the Service’s emails, such as invitations and Task emails | Names, email addresses, and the content of those emails | United States | UK Extension to the EU-US Data Privacy Framework, and the Resend data processing addendum |
| Google LLC (Google Workspace) | Email for [email protected] | Whatever the Customer or its Users include in support correspondence | United States and elsewhere | UK Extension to the EU-US Data Privacy Framework, and the Google Cloud Data Processing Addendum |
| 650 Industries, Inc. (Expo) | Sends push notifications, passing them to Apple and Google for delivery | Push tokens and notification text, which may include names and Project or Task names. Notification text is not stored | United States | UK Extension to the EU-US Data Privacy Framework |
RevenueCat, Inc., the Apple App Store, Google Play, and Cloudflare Web Analytics process data for which Thanex is controller, as the Thanex Privacy Policy describes. They are not Sub-processors of Customer Personal Data.