Data processing addendum

Data processing addendum

For business customers: how we process personal information on your instructions, what we commit to on security and sub-processors, and the basis on which data crosses borders — which, given how this platform is built, it largely does not.

1. Scope and relationship to the Terms of Service

1.1 This Data Processing Addendum (Addendum) forms part of the Terms of Service between TNX Data Pty Ltd (TNX) and the Customer, and applies to TNX’s processing of Personal Information contained in Customer Data.

1.2 Capitalised terms not defined here have the meaning given in the Terms of Service. Where this Addendum and the Terms of Service conflict in respect of the processing of Personal Information, this Addendum prevails.

1.3 This Addendum applies for as long as TNX processes Personal Information on Customer’s behalf.

2. Roles of the parties

2.1 In respect of Personal Information contained in Customer Data, Customer is the controller (or, where Customer is itself a processor for another party, the processor) and TNX is the processor (or sub-processor).

2.2 TNX is an independent controller in respect of personal information it collects about individuals in their own right — visitors to tnxdata.com, and the account and usage records of Authorised Users. That processing is governed by the TNX Privacy Policy, not by this Addendum.

2.3 Each party is responsible for its own compliance with Data Protection Law in respect of the processing it carries out.

3. Processing on documented instructions

3.1 TNX will process Personal Information only on Customer’s documented instructions, which comprise this Addendum, the Terms of Service, and Customer’s use of the features of the Services.

3.2 TNX will inform Customer if, in its opinion, an instruction infringes Data Protection Law, unless prohibited from doing so by law.

3.3 If TNX is required by law to process Personal Information otherwise than on Customer’s instructions, it will inform Customer of that requirement before processing, unless the law prohibits it.

4. Details of processing

4.1 The subject matter, duration, nature and purpose of the processing, the types of Personal Information and the categories of data subjects are set out in Annex 1.

5. Confidentiality

5.1 TNX will ensure that each person authorised to process Personal Information is subject to a duty of confidentiality, and will limit access to those personnel who need it to provide the Services.

6. Security

6.1 TNX will implement and maintain the technical and organisational measures described in Annex 2, which are designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

6.2 TNX may update those measures provided the level of protection is not materially reduced.

7. Data residency

7.1 The Services are operated as separate regional deployments. Each Regional Instance has its own storage, database, encryption keys, identity provider and application, operated in the country to which it relates.

7.2 Customer Data is held in the Regional Instance agreed with Customer and is not copied or synchronised to any other Regional Instance. Access is restricted geographically at the network edge.

7.3 Where Customer has enabled customer-managed encryption keys, Personal Information within Customer Data is encrypted under a key held in Customer’s own cloud account and under Customer’s own key policy. Withdrawing or disabling that key will prevent TNX from reading the data encrypted under it, including data already stored.

8. Sub-processors

8.1 Customer gives TNX general authorisation to engage sub-processors to process Personal Information, subject to this clause.

8.2 TNX will impose on each sub-processor data protection obligations no less protective than those in this Addendum, and remains liable to Customer for the performance of each sub-processor’s obligations.

8.3 TNX maintains a current list of sub-processors and the purpose each serves, available to Customer on request.

8.4 TNX will give Customer at least 30 days’ notice before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds within that period, in which case the parties will discuss in good faith; if no resolution is reached, Customer may terminate the affected Services.

9. Assistance to Customer

9.1 Taking into account the nature of the processing, TNX will assist Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights.

9.2 TNX will provide reasonable assistance to Customer with data protection impact assessments and prior consultation with a supervisory authority, taking into account the information available to TNX.

9.3 If TNX receives a request from a data subject relating to Customer Data, it will not respond to it directly other than to acknowledge receipt and direct the individual to Customer, and will notify Customer without undue delay.

10. Audit and information

10.1 TNX will make available to Customer the information reasonably necessary to demonstrate compliance with this Addendum, including its information security policies, its sub-processor list, and a summary of its most recent penetration test, in each case subject to confidentiality obligations.

10.2 Where a supervisory authority or Data Protection Law requires an audit or inspection that the information in clause 10.1 cannot satisfy, the parties will agree its scope, timing and cost in advance.

11. International transfers

11.1 TNX will not transfer Personal Information contained in Customer Data out of the country of the applicable Regional Instance except as permitted by clause 11.2 or as Customer instructs.

11.2 Personal Information relating to the operation of TNX’s business rather than the Services — for example the contact details of Authorised Users held for support and billing, and enquiries submitted through tnxdata.com — may be processed by providers located outside that country. Where Data Protection Law requires a transfer mechanism, the parties adopt the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated by reference.

12. Personal data breach

12.1 TNX will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Information within Customer Data, and will provide the information reasonably available to it to allow Customer to meet its own notification obligations.

12.2 TNX will take reasonable steps to contain and investigate the breach and will keep Customer informed.

12.3 Notification under this clause is not an acknowledgement of fault or liability.

13. Deletion and return

13.1 On termination or expiry of the Terms of Service, TNX will make Customer Data available for export for the period stated in them, and will then delete it, except to the extent it is required by law to retain a copy.

13.2 Customer acknowledges that the Services maintain an append-only record of extracted facts and corrections, which is the basis on which the Services produce evidence of what a disclosure said at the time it was made. Deletion of a source document appends a retraction rather than erasing history. Where Customer requires erasure of specific Personal Information within that record, the parties will discuss what is technically achievable.

14. Liability

14.1 Each party’s liability under this Addendum is subject to the limitations and exclusions of liability in the Terms of Service.

Annex 1 — Details of processing

Subject matter. TNX’s provision of the Services to Customer under the Terms of Service.

Duration. The term of the Terms of Service, plus the export and deletion period in clause 13.

Nature and purpose. Receiving, storing and processing documents and data supplied by or on behalf of Customer in order to extract, record and reconcile the financial facts they contain, and to generate compliance and governance outputs and the supporting evidence trail.

Types of Personal Information. Typically: names, business contact details and roles of Authorised Users; and any personal information contained within documents Customer supplies, which may include the names and holdings of investors and the names of fund, administrator and adviser personnel.

Categories of data subjects. Authorised Users; Customer’s personnel; investors and their representatives; personnel of Customer’s administrators, general partners and advisers.

Special categories. None is required by the Services, and Customer should not supply special category data. TNX has no facility for biometric or geolocation data.

Annex 2 — Technical and organisational measures

• Segregation by jurisdiction. Each Regional Instance is a separate deployment in the country to which it relates. Data is not shared or synchronised between them.
• Encryption. Personal Information is encrypted in transit and at rest.
• Access control. Access to production requires single sign-on with multi-factor authentication, and is limited to personnel who need it.
• Tenant isolation. Every request for data is scoped to the account making it.
• Integrity of the record. Extracted facts are held in an append-only store. Corrections are recorded as new attributed entries rather than amendments in place.
• Logging and monitoring. Access and administrative activity are recorded in an audit trail held separately from the systems it records, and alerted on.
• Secure development and vulnerability management. Changes are reviewed before release, dependencies are monitored, and penetration testing is carried out against the platform with findings tracked to closure.
• Governance. TNX maintains approved information security policies and reviews them periodically.

Last updated 17 September 2026