Data Processing Addendum — PatentSonar

Version 1.0 · Effective 2026-09-26 · Signed on request (Team and Enterprise plans, or any Subscriber that requires it)

This Addendum forms part of the agreement between Rockfort Hub de Inovação Ltda (PatentSonar) ("Processor" for the data described below) and the Subscriber ("Controller") and applies where PatentSonar processes personal data on the Subscriber's behalf.

1. Scope and roles. PatentSonar acts as processor for Reader data the Subscriber provides for delivery of the Service (names, work emails, roles, watchlist preferences). PatentSonar acts as an independent controller for billing contacts, its own business records, deliverability events and legal compliance, as described in its Privacy Policy. Where the Brazilian LGPD applies, "controller" and "processor" mean controlador and operador (Art. 5, VI and VII).

2. Details of processing. Subject matter: delivery of patent-intelligence content and related account administration. Duration: the subscription term plus the deletion period in Section 8. Nature and purpose: storing Reader contact data, sending issues, reports and alerts, honouring opt-outs, providing support. Categories of data subjects: the Subscriber's employees and contractors named as Readers. Categories of data: business contact details, delivery and engagement events (delivered, bounced, unsubscribed). No special categories are intended or requested.

3. Instructions. PatentSonar processes Reader data only on the Subscriber's documented instructions, which are the agreement, this Addendum and the Subscriber's use of the Service, unless required by law, in which case PatentSonar informs the Subscriber before processing unless the law forbids it. PatentSonar informs the Subscriber if it considers an instruction unlawful.

4. Confidentiality and security. Persons authorised to process the data are bound by confidentiality. PatentSonar implements appropriate technical and organisational measures: TLS in transit, encryption at rest by hosting providers, per-service credential segregation, least-privilege access, audit logging of automated actions, suppression-list enforcement, and tested backups by the database provider.

5. Sub-processors. The Subscriber gives general authorisation to the sub-processors listed in the Privacy Policy (Supabase, Hostinger, ActiveCampaign/Postmark, Cloudflare, Anthropic for drafting assistance). PatentSonar gives at least 30 days' notice by email before adding or replacing a sub-processor; the Subscriber may object on reasonable data-protection grounds, in which case the parties will seek a solution and, failing one within 30 days, the Subscriber may terminate the affected Service with a pro-rata refund. PatentSonar imposes equivalent obligations on each sub-processor and remains liable for their performance.

6. Assistance. Taking into account the nature of the processing, PatentSonar assists the Subscriber with data-subject requests (forwarding any it receives within 5 business days), with security, breach notification, impact assessments and consultations with authorities, at no charge for reasonable requests.

7. Personal-data breach. PatentSonar notifies the Subscriber without undue delay, and in any case within 48 hours of becoming aware, of a personal-data breach affecting Reader data, with the information available at the time and updates as it becomes known.

8. Deletion and return. At the end of the Service, PatentSonar deletes Reader data within 30 days, or returns it on request in a common electronic format before deletion, except where law requires retention or for the suppression list, which is kept solely to honour opt-outs.

9. Audits. PatentSonar makes available the information necessary to demonstrate compliance and, once a year or after a breach, allows an audit by the Subscriber or an independent auditor bound by confidentiality, on 30 days' notice, during business hours, limited to the systems processing the Subscriber's data; the Subscriber bears its own costs.

10. International transfers. For data subjects in the EU or UK, the parties adopt the EU Standard Contractual Clauses (Decision 2021/914, Module 2 controller-to-processor, with Module 3 for sub-processors) and the UK International Data Transfer Addendum, incorporated by reference with PatentSonar as data importer, the Subscriber as data exporter, the optional docking clause enabled, Option 2 for Clause 9 (general authorisation with 30 days' notice), and the law and courts of Ireland for Clause 17 and 18. For transfers out of Brazil, the parties adopt the ANPD standard contractual clauses (Resolução CD/ANPD 19/2024). In case of conflict, the transfer clauses prevail.

11. Liability and term. Each party's liability under this Addendum is subject to the limitations in the Terms of Service, except where data-protection law does not allow limitation. This Addendum lasts as long as PatentSonar processes Reader data.

12. Signatures. Signed electronically by the parties' authorised representatives; the Subscriber's acceptance by email from the billing contact is sufficient.

Version 1.0, effective 2026-09-26. Reviewed and adopted at the founder's direction (legal/REVIEWSTATUS.md)._