Data Processing Addendum

1.1 This addendum forms part of the Terms of Service between Teasr Technologies Limited (teasr) and each Advisory Firm or Seller that uploads Deal Data to the Platform (the Customer). It applies whenever teasr processes Deal Data for the Customer. Words defined in the Terms of Service have the same meaning here.

1.2 In this addendum:

• (a) Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any law that amends or replaces them;
• (b) Deal Data means personal data in Deal Documents, and personal data a Customer enters on the Platform about other people for a Deal or an Exit Readiness Report, that teasr processes for the Customer;
• (c) Sub-processor means another processor teasr engages to process Deal Data; and
• (d) controller, processor, data subject, personal data, personal data breach and processing have the meanings in the UK GDPR.

1.3 If this addendum conflicts with the Terms of Service, this addendum prevails on Deal Data.

2.1 The Customer is the controller of Deal Data and teasr is its processor. Where an Advisory Firm and a Seller both upload Deal Data for the same Deal, each is the controller of what it uploads and of what it instructs teasr to do with it.

2.2 The Customer is responsible for the lawfulness of the Deal Data and of its instructions, including having a lawful basis, giving data subjects any information the law requires, uploading only what a Deal needs, and deciding to whom Deal Data is released. The Customer should not upload special category or criminal offence data unless it is necessary and lawful to do so.

3.1 teasr is a controller, and not the Customer’s processor, only for these purposes, which it sets itself:

• (a) accounts: creating and running user accounts, sign-in and two-factor authentication;
• (b) billing: plans, payments, invoices and tax records;
• (c) security and records: logs, preventing fraud and abuse, rate limits and bot checks, investigating misuse, and keeping records of who accepted which terms and confidentiality agreements and who opened or downloaded which documents, so that teasr can establish, exercise or defend legal claims;
• (d) buyer matching on buyers’ own criteria: buyer accounts and the criteria buyers record, and comparing them with a Deal’s sector, region and revenue band to show a Deal released at the Open stage to verified Buyers whose criteria fit. The decision to release a Deal at that stage is the Customer’s;
• (e) owner profiles: the anonymous profiles owners choose to make visible to Advisory Firms, and requests to talk;
• (f) Companies House data: information teasr obtains from the public register to check figures, including in the Exit Readiness Report;
• (g) support and communications: answering enquiries and sending service emails;
• (h) legal obligations: complying with the law and with requests from regulators and courts; and
• (i) platform activity notices: when the market briefing is live, telling members that a listing has been published in a given sector, profit band and region, for Deals released at the Open stage. A notice contains no name or other detail that identifies the business. The market briefing is not live at the date of this addendum.

3.2 The Privacy Policy explains that processing.

3.3 teasr does not use Deal Data for any purpose other than providing the Platform to the Customer and the purposes in clause 3.1. In particular, it does not use Deal Data for any other customer, build datasets, benchmarks or market data from it, use it to train or evaluate AI models, sell it, or use it for marketing.

3.4 teasr does not create or use anonymised or aggregated information derived from Deal Documents. If it wishes to, it will first change this addendum under clause 24 of the Terms of Service.

5.1 teasr processes Deal Data only on the Customer’s documented instructions, including on transfers outside the UK, unless the law requires otherwise. In that case teasr tells the Customer before processing, unless the law forbids it.

5.2 The Customer’s instructions are the Terms of Service and this addendum, the Customer’s use of the Platform’s features (for example uploading documents, generating documents, approving requests, choosing a Release Stage and granting data room access), and any other written instruction teasr agrees to.

5.3 teasr tells the Customer at once if it believes an instruction infringes Data Protection Law.

6.1 teasr ensures that everyone it authorises to process Deal Data is bound by a duty of confidentiality, and gives access only to those who need it to provide the Platform, review documents, give support, keep the Platform secure or comply with the law.

7.1 teasr takes appropriate technical and organisational measures to protect Deal Data, as Article 32 of the UK GDPR requires, including those in Annex 2, and keeps them under review.

8.1 The Customer authorises teasr to engage the Sub-processors listed in Annex 3. teasr imposes on each Sub-processor data protection obligations that give at least the protection this addendum requires, and remains liable to the Customer for each Sub-processor’s performance.

8.2 teasr gives at least 10 days’ notice before adding or replacing a Sub-processor, by email to the Customer’s account address (for an Advisory Firm, its owner and billing administrators) and by updating this page.

8.3 The Customer may object on reasonable data protection grounds within those 10 days. teasr will then work with the Customer in good faith to resolve the objection. If it cannot, the Customer may end the affected plan, and teasr will refund the part of any fee paid for the period after it ends.

8.4 Where a Sub-processor must be replaced urgently to protect Deal Data or keep the Platform running, teasr may do so with shorter notice, and tells the Customer as soon as it can. Clause 8.3 still applies.

8.5 Stripe processes payment data as an independent controller, not as a Sub-processor, and receives no Deal Documents.

9.1 teasr passes to the Customer without undue delay any request it receives from a data subject about Deal Data, and does not answer it except on the Customer’s instructions. Taking into account the nature of the processing, teasr helps the Customer respond to requests to exercise data subjects’ rights, through the Platform’s features and with information it holds.

10.1 Taking into account the nature of the processing and the information available to it, teasr helps the Customer meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation with the Information Commission (ICO).

11.1 teasr notifies the Customer of a personal data breach affecting Deal Data without undue delay, and in any event within 48 hours of becoming aware of it.

11.2 The notice describes, as far as teasr then knows, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, its likely consequences, and the measures taken or proposed. teasr provides further information as it becomes available and takes reasonable steps to contain the breach and reduce its effects.

12.1 When the Customer stops using the Platform, the Customer may download its Deal Documents through the Platform for 30 days. teasr then deletes the Deal Data within a further 60 days. The Customer may ask teasr to delete the Deal Data for a Deal sooner.

12.2 Copies in back-ups are deleted as the back-ups expire in their normal cycle, and are kept secure and unused until then. teasr may keep Deal Data where the law requires it, only for as long and for the purpose the law requires.

12.3 The records described in clause 3.1(c) are teasr’s own, and are kept for the periods stated in the Privacy Policy.

12.4 Copies a recipient downloaded before access ended are held by that recipient under its confidentiality agreement, outside teasr’s control.

12.5 teasr confirms deletion in writing if asked.

13.1 teasr makes available to the Customer the information needed to show that it meets Article 28 of the UK GDPR, and answers reasonable written questions about its processing.

13.2 The Customer, or an independent auditor bound by confidentiality, may audit teasr’s compliance with this addendum on at least 30 days’ notice, during business hours, at the Customer’s cost, and no more than once in any 12 months unless a personal data breach or a regulator requires it. teasr may meet a request with its suppliers’ certifications or audit reports where they cover the matter.

14.1 teasr transfers Deal Data outside the UK only to the Sub-processors in Annex 3, and only under a mechanism Data Protection Law recognises: UK regulations that approve the destination (including the UK Extension to the EU-US Data Privacy Framework, for organisations certified under it), or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where the law requires one. Annex 3 states which mechanism applies to each.

15.1 Each party’s liability under this addendum is subject to clause 21 of the Terms of Service, including the separate cap for data protection claims in clause 21.4.

15.2 This addendum continues for as long as teasr processes Deal Data for the Customer.

As set out in clause 4.

• (a) All connections to the Platform are encrypted in transit (HTTPS). Data held by Supabase is encrypted at rest.
• (b) Database rules restrict each account to the data it is entitled to see. Data room access is granted per recipient, and documents are served only through the Platform after that entitlement is checked.
• (c) Documents are watermarked on the server before they are downloaded, so no unmarked copy is served, and a format that cannot be watermarked is not served for download.
• (d) The Platform records acceptances of confidentiality agreements and each opening and download of a document.
• (e) Two-factor authentication is available for every account and is required for teasr’s administrative accounts. Staff access to Deal Data is limited to those who need it.
• (f) Sign-up and other sensitive actions are rate-limited, and sign-up uses bot checks.
• (g) Everyone teasr authorises to process Deal Data is bound by confidentiality.

Questions about this addendum: hello@teasr.co.uk.