Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the agreement between VentureScout (the "Processor") and the customer (the "Controller") governing the processing of personal data submitted through the VentureScout service under the applicable subscription terms.

This DPA applies where the GDPR, UK GDPR, or equivalent data protection legislation governs the processing of personal data by VentureScout on behalf of the customer.

Controller. The customer determines the purposes and means of processing personal data within their account workspaces, suites, and saved outputs. The customer is responsible for ensuring they have a lawful basis for processing and for responding to data subject requests regarding their own data.

Processor. VentureScout processes personal data only in accordance with the customer's documented instructions, as described in the subscription terms and this DPA. VentureScout will not process personal data for its own purposes or for any purpose other than providing the service.

Categories of data subjects. End users authorized by the customer to use the VentureScout service, including employees, contractors, and collaborators.

Categories of personal data. Account identifiers (name, email address), authentication credentials, and any personal data the customer or its users choose to store within discoveries, suites, or other product features.

Processing purposes. Providing the VentureScout service, including discovery, scoring, synthesis, suite management, API access, account administration, and support.

Processing duration. For the duration of the applicable subscription term plus up to 90 days post-termination for data retrieval, after which personal data is deleted or anonymized.

VentureScout will assist the customer in fulfilling their obligation to respond to data subject requests under the GDPR. If VentureScout receives a request directly from a data subject, it will notify the customer promptly and will not respond to the request without the customer's prior authorization, except where required by law.

VentureScout provides the following mechanisms to support data subject rights:

• Account deletion tools available through the product interface
• Data export functionality for user-generated content
• Designated point of contact for data subject requests

The customer authorizes VentureScout to engage the following subprocessors for the delivery of the service:

• Cloud infrastructure provider. Database hosting, compute, and storage
• Authentication provider. Identity and access management
• AI model provider. Inference and scoring operations
• Payment processor. Subscription billing (no personal data from the product itself)

VentureScout will provide at least 30 days' notice before engaging any new subprocessor. The customer may object to a new subprocessor in writing within 14 days of notice. If the objection is reasonable and the parties cannot agree on an alternative, the customer may terminate the affected services.

VentureScout may transfer personal data to jurisdictions outside the European Economic Area or the United Kingdom. Such transfers will be governed by:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, or
• An adequacy decision by the European Commission or UK Government, or
• Other valid transfer mechanism recognized under applicable data protection law

Copies of relevant safeguards are available upon request.

VentureScout maintains technical and organizational security measures appropriate to the risk, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls based on role and subscription tier
• Regular security assessments and vulnerability scanning
• Incident response procedures
• Staff training on data protection

VentureScout will notify the customer without undue delay upon becoming aware of a personal data breach affecting customer data. Notification will include:

• The nature of the breach
• Categories and approximate number of data subjects and records affected
• Likely consequences and measures taken or proposed
• Contact point for further information

VentureScout will cooperate with the customer and provide reasonable assistance for the customer's breach notification obligations to supervisory authorities and data subjects.

Upon termination of the agreement or upon the customer's instruction, VentureScout will delete or return all customer personal data within 90 days, unless retention is required by applicable law. VentureScout may retain aggregated, anonymized data that cannot identify data subjects after deletion.

Data Protection Officer. VentureScout has appointed a Data Protection Officer reachable at dpo@inventionscout.ai.

Supervisory authority. The customer may lodge a complaint with their local data protection supervisory authority. VentureScout will cooperate with the relevant supervisory authority in the performance of its duties.

Data Protection Impact Assessment. VentureScout will provide reasonable assistance to the customer for any data protection impact assessments required under applicable law.

Records of processing. VentureScout maintains records of all processing activities carried out on behalf of customers in accordance with Article 30 of the GDPR.

This DPA is governed by the laws of the customer's country of establishment and shall be interpreted in accordance with the GDPR.

For DPA-related inquiries, contact dpo@inventionscout.ai or reach out through our contact page.

Last updated: June 2026