These Data Processing Terms (“Terms”) govern how ThreatCaptain, Inc. (“ThreatCaptain,” “we,” “us,” or “our”) processes personal data on behalf of its customers.
These Terms form part of the ThreatCaptain End User License Agreement and applicable ordering documents (together, the “Agreement”) when incorporated into an Agreement accepted by Customer and ThreatCaptain. They may be accepted electronically and do not require a separate handwritten signature. Publication alone does not amend an existing Agreement.
1 Scope and definitions
These Terms apply to personal data contained in Customer Data that ThreatCaptain processes on Customer’s behalf to provide the Services, including personal data in submissions, prompts, support requests, and generated Outputs (“Customer Personal Data”).
“Data Protection Laws” means privacy and data protection laws applicable to that processing, including, where applicable, United States state privacy laws, the California Consumer Privacy Act as amended (“CCPA”), the European Union General Data Protection Regulation (“EU GDPR”), United Kingdom data protection laws, Swiss data protection laws, and Canadian privacy laws.
“Subprocessor” means an organization engaged by ThreatCaptain to process Customer Personal Data on Customer’s behalf.
“Personal Data Breach” means a breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
Other capitalized terms have the meanings given in the Agreement.
2 Roles and customer instructions
Customer acts as controller or business for Customer Personal Data. ThreatCaptain acts as processor or service provider. Where Customer processes data for an end client or another controller, ThreatCaptain acts as Customer’s subprocessor.
Customer is responsible for obtaining the authority, lawful basis, notices, permissions, and consents necessary for its submissions, processing instructions, and appointment of ThreatCaptain. Each party remains responsible for obligations applying directly to it under Data Protection Laws.
ThreatCaptain will process Customer Personal Data only on Customer’s documented instructions, unless applicable law requires otherwise. The Agreement as limited by these Terms, authorized configurations and use of the Services, and additional written instructions accepted by ThreatCaptain constitute those instructions.
ThreatCaptain will promptly inform Customer if it believes an instruction violates Data Protection Laws and may suspend the affected processing while the parties resolve the issue. Where law requires processing beyond Customer’s instructions, ThreatCaptain will notify Customer beforehand unless legally prohibited.
Affiliates are covered only where their participation is authorized under the Agreement. These Terms do not independently authorize access across affiliated organizations or separate instances.
3 Processing details
Subject matter and purposes. Processing necessary to provide purchased Services, including customer-directed prospect discovery, assessments, financial-impact modeling, proposals, executive reporting, business reviews, risk registries, AI assistance, and related support.
Activities. Receiving, storing, organizing, retrieving, analyzing, generating Outputs from, transmitting, securing, returning, and deleting Customer Personal Data.
Individuals. Customer’s authorized users and business contacts; prospect and end-client representatives; and individuals identified in records submitted by Customer.
Data categories. Names, business contact details, job roles, organization affiliations, account identifiers, communications, identifiable assessment responses, prompts, Outputs, support submissions, and technical identifiers, depending on Customer’s authorized use.
Duration. During the applicable Services and the limited periods necessary for return, deletion, or legally required retention under these Terms.
The purchased Services and lawful documented instructions determine the processing within this scope.
4 Purpose restrictions and artificial intelligence
ThreatCaptain will process Customer Personal Data only as necessary to provide, secure, support, and maintain the Services on Customer’s behalf and perform lawful documented instructions.
ThreatCaptain will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it for ThreatCaptain’s own targeted advertising, or use it to build personal profiles for unrelated customers.
ThreatCaptain will not use Customer Personal Data to train or fine-tune general-purpose or shared AI models. Customer-directed inference, retrieval, and generation of Outputs are permitted within these Terms. ThreatCaptain will impose corresponding purpose restrictions on AI Subprocessors.
ThreatCaptain may generate and use aggregated or de-identified Usage Data as permitted by the Agreement and applicable law. Information that remains identifiable or reasonably linkable to an individual remains protected under these Terms. ThreatCaptain will maintain reasonable safeguards against re-identification, will not attempt to re-identify individuals, and will impose applicable restrictions on recipients.
Personal data processed independently for ThreatCaptain’s own account administration, billing, or legal obligations is subject to applicable law and our Privacy Policy. This distinction does not exclude customer content merely because it appears in a support request or account record. Independently sourced information is not brought within a processor relationship solely because it is made available through the Services; the actual processing and applicable law determine the parties’ roles.
5 Restricted data and customer safeguards
Customer will limit submissions to data reasonably necessary for its authorized use.
Unless separately authorized in writing with appropriate safeguards, Customer must not submit protected health information, payment-card details, government identification numbers, passwords, authentication secrets, special-category personal data, criminal-conviction data, or personal data about children.
These Terms do not constitute a HIPAA business associate agreement or authorize otherwise restricted data.
Customer remains responsible for its user permissions, credentials, endpoints, configurations, integrations under its control, and review of Outputs. These responsibilities do not relieve ThreatCaptain of its own duties.
6 Security and confidentiality
ThreatCaptain will maintain administrative, technical, and organizational safeguards appropriate to the processing risks, taking account of the nature of the data and Services, the state of the art, and implementation costs.
Safeguards will address access control, confidentiality, integrity, availability, resilience, incident handling, restoration, and regular evaluation of security measures, as appropriate.
Personnel authorized to process Customer Personal Data will be subject to confidentiality obligations and have access limited to their responsibilities.
ThreatCaptain will not materially reduce the overall protection of Customer Personal Data during the applicable Services. Protection and confidentiality obligations continue for as long as the data is retained.
Customers may request information about applicable security measures at Privacy@ThreatCaptain.com. Confidentiality protections may be required before sensitive security information is provided. Certifications and audit reports apply only to their expressly stated scope and period.
7 Subprocessors and integrations
Customer generally authorizes ThreatCaptain to engage Subprocessors in accordance with this section.
Before processing begins under these Terms, ThreatCaptain will provide Customer with, or make available to Customer, a current Subprocessor register identifying each Subprocessor’s legal entity, processing purpose, and processing countries. Customer may request the register at Privacy@ThreatCaptain.com.
ThreatCaptain will assess Subprocessors and bind them by written agreements imposing data protection obligations appropriate to their work and substantively equivalent to those required here. ThreatCaptain remains responsible to Customer for their performance of those obligations.
ThreatCaptain will give Customer at least 30 days’ prior written notice of a new or replacement Subprocessor. Customer may object within 30 days after receiving notice, on reasonable grounds relating to the protection of Customer Personal Data.
The parties will work in good faith to resolve a timely objection. ThreatCaptain will not permit the disputed Subprocessor to process the affected Customer Personal Data while that objection remains unresolved.
If no reasonable solution is available, either party may terminate the affected Service by written notice. ThreatCaptain will refund prepaid unused fees for the terminated portion, and Customer will owe no future committed fees for that portion.
Customer-selected independent third-party services are governed by their providers’ terms. A vendor processing on ThreatCaptain’s behalf remains a Subprocessor even when its functionality is described as an integration.
8 Personal Data Breaches
ThreatCaptain will notify Customer without undue delay after becoming aware of a Personal Data Breach. Initial notice will not be delayed until the investigation is complete.
ThreatCaptain will provide available information about the nature of the breach, affected categories and approximate numbers of individuals and records where known, likely consequences, measures taken or proposed, and a contact for further information. Material updates will follow as information becomes available.
ThreatCaptain will reasonably investigate, contain, and remediate the breach and assist Customer with legally required notifications. Customer directs notifications to its controllers, individuals, and authorities unless ThreatCaptain has an independent legal duty to notify. Notice does not itself admit liability.
9 Privacy rights and compliance assistance
Taking account of the processing and information available, ThreatCaptain will assist Customer with applicable individual rights requests, security duties, breach notifications, data protection impact assessments, required consultations, and relevant regulatory inquiries.
ThreatCaptain will promptly forward requests received directly concerning Customer Personal Data and will respond substantively only on Customer’s instructions or as required by law. Customer is responsible for verifying identity and determining the appropriate response, with reasonable assistance from ThreatCaptain.
Assistance will be timely enough to support applicable legal deadlines communicated by Customer. Routine assistance is included. Exceptional assistance may incur reasonable fees agreed in advance where lawful, but fees will not excuse mandatory performance or assistance required because of ThreatCaptain’s breach.
10 International processing
Customer Personal Data may be processed in the United States and other countries disclosed in the Subprocessor register or otherwise agreed with Customer. Processing includes storage and remote access.
ThreatCaptain will not make a transfer restricted by Data Protection Laws without a valid transfer mechanism and required supplementary safeguards.
Before an affected restricted transfer begins, the parties will complete and enter into any necessary transfer instruments. These may include EU Standard Contractual Clauses using the appropriate module, an approved UK Addendum or International Data Transfer Agreement, and applicable Swiss adaptations.
These Terms alone do not constitute completed transfer instruments or establish certification under an adequacy framework. Mandatory transfer provisions prevail over conflicting Agreement terms.
ThreatCaptain will notify Customer of binding government demands unless prohibited, disclose only what is legally required, and comply with applicable duties to assess, challenge, or seek protection against demands. If a transfer safeguard becomes ineffective, the parties will implement a lawful alternative or suspend the affected transfer.
11 Return and deletion
At the end of the affected Services, Customer may instruct ThreatCaptain to return Customer Personal Data in a reasonably usable format or delete it and remaining copies, unless applicable law requires retention.
Customer may provide its choice during the Services or within 30 days after termination. ThreatCaptain will preserve the data necessary to honor that choice during this period, subject to law and necessary security restrictions. If no instruction is received, deletion is the default after that period.
ThreatCaptain will complete return or deletion without undue delay and cause its Subprocessors to do the same. Mandatory return and deletion rights will not depend on payment of outstanding subscription fees.
Where immediate deletion from backups or archives is technically impracticable, retained copies will be protected and placed beyond ordinary use until deletion through an appropriate documented expiration cycle. If restored, applicable deletion instructions will be reapplied.
Copies retained because of a legal requirement will be access-limited, used only for that requirement, and deleted when it ends. An internal retention preference alone does not establish a legal requirement.
ThreatCaptain will confirm completion on written request.
12 Compliance information and audits
ThreatCaptain will provide information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections, by Customer or its qualified independent auditor.
Relevant existing reports and documentation may be provided first where sufficient. Routine audits require reasonable notice, confidentiality protections, and safeguards for other customers’ information and systems, and ordinarily occur no more than annually.
These conditions will not prevent additional review required by law, a regulator, a Personal Data Breach, or reasonable evidence of material noncompliance. Intrusive security testing requires a separately agreed scope.
Reasonable external costs may be allocated by prior agreement, except where review results from ThreatCaptain’s material breach or law provides otherwise.
13 Additional US state privacy terms
Where applicable US state privacy laws govern processing on Customer’s behalf, ThreatCaptain acts as processor, service provider, or contractor, as applicable, and will provide the legally required level of protection.
ThreatCaptain will not retain, use, or disclose Customer Personal Data outside the specific purposes described here or outside the direct business relationship, except as permitted by applicable law. It will not combine that data with personal information from other customers or its own interactions with individuals except where specifically permitted by law and consistent with these Terms.
Customer may take reasonable and appropriate steps to verify compliance and, on notice, stop and remediate unauthorized use. ThreatCaptain will notify Customer if it determines it can no longer meet applicable obligations.
ThreatCaptain certifies that it understands these restrictions and will comply with them.
14 Relationship to the Agreement
These Terms prevail over conflicting Agreement provisions solely concerning Customer Personal Data processing, including broader permissions concerning service improvement, Subprocessor responsibility, return and deletion, and the limited termination remedy in Section 7.
Otherwise, the Agreement’s commercial terms, indemnities, liability exclusions, and aggregate liability limits remain applicable. These Terms create no separate liability cap or additional indemnity.
Nothing limits duties, individual rights, regulator powers, or liabilities that cannot lawfully be limited, including mandatory transfer-instrument rights.
The Agreement’s governing law and venue apply except where mandatory law or an applicable transfer instrument requires otherwise.
These Terms continue while ThreatCaptain or its Subprocessors retain Customer Personal Data. Amendments require the parties’ written agreement or another valid contractual acceptance process. Posting a revised page alone does not amend an accepted version.
15 Contact and notices
ThreatCaptain, Inc.
25 Goldsmith St
Greenville, SC 29609
United States
Privacy and data protection inquiries: Privacy@ThreatCaptain.com
Formal legal notices: support@threatcaptain.com, following the Agreement’s formal notice requirements.
Customer must maintain current privacy and security contact information. Operational notices under these Terms may be delivered electronically without a courier copy.