Pantheon
Join the Waitlist

Data Processing Addendum

Last updated: October 13, 2026

Important: This Data Processing Addendum forms part of our Terms of Service. It applies when you use the Services to process personal data about other people in a business or professional capacity, and it governs that processing. Where this Addendum and the Terms of Service conflict on the processing of Workspace Data, this Addendum governs.

1. Scope

This Data Processing Addendum ("Addendum") is between you and Pantheon and is incorporated into our Terms of Service ("Terms"). By accepting the Terms, you accept this Addendum.
This Addendum applies where you use the Services to process personal data about other people (for example, your contacts and the people in your conversations) in a business or professional capacity, and a data protection law applies to that processing. It does not apply to purely personal or household use, which is governed by our Privacy Policy.
Data protection laws covered by this Addendum include, where they apply: the EU General Data Protection Regulation and the UK GDPR; Canada's Personal Information Protection and Electronic Documents Act and provincial private-sector privacy laws, including Quebec's Act respecting the protection of personal information in the private sector; and the California Consumer Privacy Act and other US state privacy laws (together, "Data Protection Laws").

2. Definitions

  • Workspace Data means personal data in your workspace that the Services process on your behalf: the messages, contacts, files, notes, meetings, and other content you connect or add, and the outputs the Services generate from them for your workspace (such as summaries, enrichments, relationship graphs, scores, extractions, and timelines).
  • Account Data means information about you as our customer, such as your login, billing, and support details.
  • Usage Data means information about how the Services are used, such as feature usage, performance, and security events.
  • Pantheon Records means the shared profile and company records Pantheon maintains across the Services and from public sources.
  • Subprocessor means a third party we engage to process Workspace Data on your behalf.
  • Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Workspace Data.
  • Terms such as "controller", "processor", "personal data", "processing", and "data subject" have the meanings given in the applicable Data Protection Laws.

3. Roles

For Workspace Data, you are the controller (or a processor acting for your own controller) and Pantheon is your processor.
For Account Data, Usage Data, and Pantheon Records, Pantheon is an independent controller and processes them as described in our Privacy Policy.

4. Your Obligations

  • You are responsible for having a lawful basis for the Workspace Data you bring into the Services, and for giving any notices or obtaining any consents the Data Protection Laws require, including to the people whose messages and details you connect.
  • You are responsible for complying with laws on recording and transcribing calls and meetings where you use those features.
  • You will not use the Services to process special categories of personal data (such as health data) unless it is necessary for your use and permitted by the Data Protection Laws.
  • Your instructions to us must comply with the Data Protection Laws.

5. Our Obligations

  • We process Workspace Data only on your documented instructions. Your instructions are the Terms, this Addendum, and the way you configure and use the Services. We may also process Workspace Data where the law requires it, in which case we will tell you first unless the law prohibits it.
  • We will tell you if we believe an instruction infringes the Data Protection Laws.
  • We ensure that the people we authorise to process Workspace Data are bound by confidentiality obligations and access it only as needed to provide, secure, and support the Services.
  • We do not sell or share Workspace Data, do not retain, use, or disclose it for any purpose other than providing the Services to you, and do not combine it with personal data we receive from others except as the Data Protection Laws permit for a service provider or processor.

6. Security

We maintain technical and organisational measures appropriate to the risk to protect Workspace Data, including encryption in transit and at rest, workspace isolation, access controls, and logging. Our current measures are described on our Security & Trust page. We may update them, provided the overall level of protection is not reduced.

7. Subprocessors

  • You authorise us to engage Subprocessors, including hosting, infrastructure, payment, and AI providers, to deliver the Services.
  • We bind each Subprocessor to data protection terms that protect Workspace Data at least as well as this Addendum does, and we remain responsible for their processing of it.
  • You can ask for the current list of Subprocessors at legal@pantheon.run.
  • If you object to a Subprocessor on reasonable data protection grounds, you may stop using the affected feature or delete your workspace.

8. AI Processing

  • We do not use Workspace Data to train or fine-tune machine learning or artificial intelligence models.
  • AI providers that process Workspace Data as our Subprocessors are contractually prohibited from training their models on it.
  • Outputs the Services generate from your Workspace Data are Workspace Data.

9. Requests from Individuals

  • If a person contacts us directly to exercise their rights over Workspace Data, we will direct them to you and will not otherwise respond, unless the law requires us to.
  • Taking into account the nature of the processing, we will provide reasonable assistance, including through the features of the Services, so you can respond to requests to access, correct, export, or delete personal data in your workspace.
  • Requests about Account Data, Usage Data, or Pantheon Records are handled by us directly, as described in our Privacy Policy.

10. Personal Data Breaches

We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a Personal Data Breach affecting your Workspace Data. Our notice will describe the breach, the data and people likely affected, its likely consequences, and the measures taken or proposed, as that information becomes available.
We will take reasonable steps to contain the breach and will provide reasonable assistance with any notices you must give under the Data Protection Laws. Our notice is not an acknowledgement of fault or liability.

11. Assessments and Compliance Information

On request, we will provide information reasonably necessary to demonstrate our compliance with this Addendum and to support your data protection impact assessments, such as responses to a reasonable security questionnaire. Any on-site audit is limited to what a supervisory authority or the Data Protection Laws require, with reasonable advance notice, during business hours, at your cost, and no more than once in any 12-month period.

12. Deletion

Workspace Data stays in your workspace until you delete the workspace. Before you do, you can export your data using the export features of the Services.
When your workspace is deleted, we delete its Workspace Data from our active systems. Copies in our backups expire in the ordinary course of our backup cycle.
We may keep Workspace Data where the law requires us to. Anything we keep remains protected under this Addendum and is not otherwise processed.

13. International Transfers

Pantheon is a Canadian company, and Workspace Data may be processed in Canada, the United States, and other countries where we or our Subprocessors operate.
Where the Data Protection Laws restrict a transfer, we rely on a recognised safeguard: an adequacy decision covering the destination (including the European Commission's decision for Canada), or the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated into this Addendum to the extent such a transfer requires them.

14. Government Access Requests

If a public authority asks us for Workspace Data, we will redirect it to you where we can. If we are compelled to disclose Workspace Data, we will notify you first unless the law prohibits it, and we will disclose only the minimum required.

15. Aggregated Data

We may create de-identified, aggregated statistics from Usage Data and the processing of Workspace Data to operate and improve the Services. These statistics never include message content, names, or contact identifiers; we take reasonable measures to prevent their re-identification; and they are not Workspace Data.

16. Liability

Each party's liability under or in connection with this Addendum is subject to the exclusions and limitations of liability in the Terms.

17. Term and Changes

This Addendum applies for as long as we process Workspace Data on your behalf.
We may update this Addendum in the same way we update the Terms, including to reflect changes in the Data Protection Laws. The current version is always available at this page.

18. Contact

Questions about this Addendum, requests for compliance information, and Subprocessor list requests go to legal@pantheon.run.