GradeThread

Data Processing Addendum

Effective date: June 12, 2026

This Data Processing Addendum (“DPA”) supplements the Terms of Service between Pearson Media LLC (“GradeThread”, “Processor”) and the customer (“Controller”) and applies where GradeThread processes personal data on the Controller's behalf. It reflects obligations under the GDPR, UK GDPR, and CCPA/CPRA.

1. Roles & scope

For personal data a customer submits to the Service (e.g. end-user details in a workspace), the customer is the Controller and GradeThread is the Processor. GradeThread processes such data only on documented instructions, which include the Terms, this DPA, and use of the Service.

2. Processor obligations

  • Process personal data only for the purpose of providing the Service.
  • Ensure personnel are bound by confidentiality.
  • Implement appropriate technical and organizational security measures (encryption in transit/at rest, access controls, RLS tenant isolation, audited admin actions).
  • Limit internal human review of customer-submitted photos (quality assurance and grading-reliability studies) to trained, confidentiality-bound personnel; minimize what reviewers see (no account identity or customer free text alongside photos), grant access through short-lived expiring links, and log every per-item view in an audit trail. See the Privacy Policy, section 4.1.
  • Assist the Controller with data-subject requests, DPIAs, and breach notification.
  • Delete or return personal data at the end of the engagement, subject to the retention schedule in the Privacy Policy.

3. Subprocessors

GradeThread uses the subprocessors listed on our Subprocessors page. We impose data-protection terms on each and remain responsible for their performance. We provide notice of new subprocessors as described there.

4. International transfers

Where personal data is transferred out of the EEA/UK, the parties rely on an appropriate transfer mechanism (e.g. the EU Standard Contractual Clauses), incorporated by reference into this DPA.

5. Security incidents

GradeThread will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, and will provide information reasonably necessary for the Controller to meet its own notification obligations.

6. Requesting a signed DPA

To execute a countersigned copy of this DPA, email [email protected] with your legal entity name and signatory. Until countersigned, this published DPA governs GradeThread's processing of Controller personal data.