Thorne Purchase Order Terms For Suppliers
THE THORNE PURCHASE ORDER (THE "PO"), OF WHICH THESE Thorne PURCHASE ORDER TERMS FOR SUPPLIERS AS WELL AS ANY ATTACHMENTS OR EXHIBITS FURNISHED BY BUYER (COLLECTIVELY, “Terms”) ARE INTEGRAL PARTS, IS THE SOLE AGREEMENT BETWEEN THORNE RESEARCH, INC., ITS SUBSIDIARIES, AND/OR OTHER AFFILIATES ISSUING THE PO ("Buyer" OR “Thorne”), ON THE ONE HAND, AND THE SELLER IDENTIFIED IN THAT DOCUMENT (“Seller”), ON THE OTHER HAND, REGARDING THE GOODS, SERVICES, OR OTHER ITEMS (“Products”) FURNISHED PURSUANT TO THE PO. Seller and Buyer are sometimes referred to herein collectively as the “parties,” and individually as a “party.” These Terms are hereby incorporated by reference into, and shall apply to, every statement of work, order form, work order, service order, invoice acceptance, master agreement, or other written purchasing or ordering document issued by or entered into with Thorne for Products (each, an "Ordering Document"), in each case as if these Terms were fully set forth therein. These Terms shall also apply to transactions that do not have a formal purchase order or other written Ordering Document issued by Thorne or a written agreement duly executed by Thorne and the Seller, in which case the term “PO” as used hereinbelow shall refer instead to an order, whether written or not, placed by Thorne with Seller. As used in these Terms, the term "PO" shall be deemed to include each such Ordering Document and order, and Seller's acceptance of, or performance under, any Ordering Document or order constitutes acceptance of these Terms. These Terms shall apply to, and govern, every PO and Ordering Document unless Thorne and Seller have entered into a separate written agreement that is duly executed by authorized representatives of both parties and that expressly references and overrides these Terms, in which case such separately executed agreement shall control solely to the extent of the express conflict.
-
1. Acceptance of Terms. The PO is an offer to purchase and may be accepted by Seller either in writing or by any conduct which recognizes the existence of a contract including, without limitation, the delivery of any Products to Buyer. Buyer shall not be bound by any additional or different terms proposed by Seller or any attempt by Seller to vary any of the Terms.
-
2. Pricing/Invoices/Payment. Unless otherwise specifically agreed in writing by Buyer, the prices shown in the PO include all applicable charges for packing, hauling, storage, insurance, and transportation as well as all federal, state, local, and other taxes, customs fees, duties, tariffs, and similar charges. Invoices will be paid net sixty (60) days after receipt of a correct invoice or acceptance of the Products by Buyer, whichever occurs later. Seller shall not invoice any goods shipped or services performed pursuant to the PO at a price higher than that shown in the PO. To the extent applicable, all invoices must itemize any freight, insurance, taxes, customs fees, duties, tariffs, and similar amounts separately. All claims by Seller for payment due or to become due from Buyer shall be subject to deduction or set-off by Buyer by reason of any claim arising out of this or any other transaction between Buyer and Seller.
-
3. Shipping/Delivery/Packing. Unless otherwise expressly agreed in writing by Buyer, Seller shall deliver goods DDP (Delivered Duty Paid) (Incoterms® 2020) Buyer’s named place of business. Time is of the essence regarding the delivery of Products, and if the goods are not delivered or the services not provided in the manner and at the times specified, Buyer reserves the right without liability and in addition to its other rights and remedies to take either or both of the following actions: (a) direct expedited delivery of the goods or performance of services, with any difference in cost caused by such change paid by Seller, and/or (b) purchase substitute goods and services and charge Seller with any loss or additional costs Buyer incurs. Seller will promptly advise Buyer of any delay in performance. All goods delivered shall be suitably packed, in accordance with the requirements of common carriers, and in a manner to secure the lowest transportation cost, and no additional amount shall be charged to the Buyer therefore unless specifically stated in the PO or otherwise expressly agreed by Buyer in writing. Goods will be packaged to secure safe and complete arrival to the delivery location without damage to the contents or others.
-
4. Samples and Proofs. If samples and/or proofs are required by the PO, Seller shall not forward quantity shipments until Buyer has approved in writing Seller's samples and/or proofs.
-
5. Inspection. Payment for any Products shall not constitute acceptance. All Products shall be received subject to Buyer’s rights to inspect them at a reasonable time and place and in a reasonable manner and to reject (including revocation of its earlier acceptance) any Products which are, in Buyer’s reasonable judgment, nonconforming. Buyer shall have no obligation to inspect any Product upon delivery, and any inspection or failure to inspect shall not constitute acceptance of the Product or waiver of any rights or remedies of Buyer under the PO, including Buyer’s right (whether or not it has canceled the PO) to recover that portion of the price that has been paid (if any) and charge Seller the reasonable expenses of inspection and return, including unpacking, examining, and re-packing. Without limiting the foregoing, if the quality of a Product is unsatisfactory in the reasonable judgment of Buyer, Buyer may reject the Product, recover that portion of the price that has been paid (if any), and charge Seller the reasonable expenses of inspection and return as applicable, including for unpacking, examining, and re-packing.
-
6. Title and Risk of Loss. Title and risk of loss and damage to goods purchased under the PO shall vest in Buyer upon the completion of delivery (DDP, Buyer’s place of business) (Incoterms® 2020) and acceptance by Buyer. However, if Seller is specifically authorized in writing to invoice Buyer for goods prior to delivery and acceptance of the goods, or prior to or during the performance of services, title to such goods shall vest in Buyer upon payment of the invoice, but the risk of loss and damage shall pass to Buyer as provided in the preceding sentence.
-
7. Changes. Buyer shall have the right to make changes at any time in the scope, quantities, place/time for performance, delivery schedules, methods of packaging or shipment, and/or other requirements and specifications applicable to the Products. Buyer may also direct Seller for any reason to suspend in whole or in part the provision of goods or the performance of services permanently or for such period as may be determined by Buyer. If the changes described in this section result in an increase or decrease in Seller’s cost or time requirements, an equitable written adjustment shall be made upon Seller’s prompt notification to Buyer of Seller’s proposed adjustment. Any claim for an increase by Seller will be deemed irrevocably waived unless asserted in writing with detailed supporting documentation within ten (10) days from receipt by Seller of the notice of the change.
-
8. Warranty. Seller warrants that it shall deliver clear, unrestricted, and unencumbered title to all Products, and that all Products (1) will be of good quality and workmanship and free from all defects (latent and patent); (2) will be new (unless specifically agreed otherwise in a writing signed by Buyer); (3) will conform to all specifications and descriptions furnished or specified by Buyer; (4) will conform to any samples and to any statements made on the containers, labels, sales literature, or advertisements for such Products; (5) will be adequately contained, packaged, marked, and labeled; (6) will be merchantable and will be safe and appropriate for the purpose for which goods or services of that kind are normally used; (7) if Seller knows or has reason to know the particular purpose for which Buyer intends to use the Products, will be fit for such particular purpose; and (8) to the extent Products include software, technology, or digital services, such Products will perform materially in accordance with their documentation, will be free from viruses, malware, and disabling code, and will not infringe any third party's intellectual property rights. Seller's obligations under these warranties shall survive and be unaffected by any inspection, testing, acceptance, conveyance of title, and use. These warranties shall run to Buyer, its affiliates, its subsidiaries, and to its/their customers, users, successors, and assigns. Seller agrees to promptly replace or repair any Product not conforming to the PO or to the aforesaid warranties, without any expense (including, without limitation, transportation expense) to Buyer. In the event of Seller's failure promptly to repair or replace such nonconforming Product, Buyer, after reasonable notice to Seller, reserves the right without liability and in addition to its other rights and remedies to repair or replace such Product and charge Seller for the costs incurred by Buyer in doing so. Seller shall provide Buyer at least eighteen (18) months' advance written notice if any good covered by the PO will no longer be manufactured or produced, and Seller shall accept Buyer's orders for such goods during the term of the PO or such eighteen-month period, whichever is longer.
-
9. Compliance. Seller represents and warrants that all goods and services furnished pursuant to the PO shall have been manufactured, shipped, and performed in compliance with all applicable federal, state, local, and international laws and regulations, including but not limited to: (1) all environmental and health and safety laws and regulations, including but not limited to the U.S. Federal Occupational Safety and Health Act as applicable, the Directive 2002/95/EC of the European Parliament and of the Council of 27 January 2003 on the restriction of the use of certain hazardous substances in electrical and electronic equipment (ROHS) (or the latest version thereof), and the Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006 concerning the Registration, Evaluation, Authorization and Restriction of Chemicals (REACH) (or the latest version thereof); (2) all applicable laws and regulations governing fair hiring practices, the prevention of discrimination in employment, and the prevention of child and forced or compulsory labor; (3) with regard to sellers located in the United States, the U.S. Fair Labor Standards Act and the U.S. Americans with Disabilities Act; (4) all applicable laws and regulations requiring the Seller to secure permits, certificates, licenses, approvals, and inspections to provide the Seller’s goods and services; and (5) all applicable regulations of the U.S. Food and Drug Administration ("FDA"), including without limitation the Federal Food, Drug, and Cosmetic Act, current Good Manufacturing Practices (cGMP) under 21 CFR Part 111, and the Dietary Supplement Health and Education Act of 1994 ("DSHEA"), to the extent applicable to the goods or services furnished under the PO.
Buyer is an equal opportunity employer and federal contractor or subcontractor. Consequently, the parties agree that, as applicable, they will abide by the requirements of 41 CFR 60-1.4(a), 41 CFR 60-300.5(a) and 41 CFR 60-741.5(a) and that these laws are incorporated herein by reference. These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity or national origin. These regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status or disability. The parties also agree that, as applicable, they will abide by the requirements of Executive Order 13496 (29 CFR Part 471, Appendix A to Subpart A), relating to the notice of employee rights under federal labor laws.
Additionally, Seller represents and warrants that it shall conduct its business in accordance with all applicable laws and regulations relating to anti-bribery, anti-corruption, and anti-money laundering.
-
10. Audit. Buyer shall have the right (but not the obligation) to perform audits at Seller’s facilities used in connection with the Products delivered or services performed under the PO, during normal business hours upon reasonable advance notice of the date of such intended audit, in order to ensure compliance with the PO and applicable law. Furthermore, Buyer shall have the right (but not the obligation) to audit the relevant books and records of Seller to verify Seller’s compliance with the PO. Seller shall maintain its books and records relating to its provision of goods and services hereunder for a period of seven (7) years and make such books and records available to Buyer and its auditors, provide reasonable cooperation, and take such further action as Buyer may reasonably request at any time(s) within said seven (7) year period. Seller agrees to conduct and document corrective and preventive actions promptly based upon the results of Buyer’s audits.
-
11. Customs; Export Control. Seller hereby commits to comply with all applicable import and export regulations and certifies that it will obtain all necessary government approvals, licenses, permits, inspection certificates, customs clearances, or other documentation required by the laws of the originating country, the destination country, and any other country through which the any of Seller’s goods may transit. As part of this obligation, Seller agrees that all deliverables will be marked with their Country of Origin according to the standards set forth under U.S. Customs regulations and that an accurate Harmonized Tariff Schedule Classification, Country of Origin, Export Control Classification Number and Valuation will be provided at the time the product is shipped to Buyer. Seller also agrees to provide a true and correct Certificate of Origin, according to the format prescribed by Buyer, for each product/at the time of shipment, and to provide Buyer with any additional information necessary to substantiate any claim or defense related to the Classification, Country of Origin, and Valuation of the deliverables, as discussed above. Seller agrees to indemnify and hold Buyer harmless with respect to any claim related to the correctness of the certifications provided by Seller. Finally, Seller agrees to not source any deliverables under the PO from Cuba, Iran, Syria, North Korea, Russia, or from any other countries, regions, entities, or individuals subject to comprehensive sanctions or general restrictions under U.S. laws and regulations (including OFAC sanctions programs) and under other applicable laws and regulations.
-
12. Confidentiality; Data Protection; Publicity. Seller shall treat as confidential all information furnished by Buyer in connection with PO. Without the express written permission of Buyer, Seller shall not disclose to any third party or use for any purpose other than performance under the PO any such information, including, without limitation, any pricing, methods, specifications, instructions, processes, financial data, lists, apparatuses, tools, statistics, programs, research, developments, designs, drawings, customer lists, or marketing information of Buyer. Seller shall not disclose the fact that Buyer has contracted to purchase goods from Seller without Buyer's written permission. Furthermore, Seller shall comply with all applicable federal, state, local and international data protection laws such as the EU General Data Protection Regulation (Regulation EU 2016/679) as applicable. To the extent Seller Processes any Personal Data for or on behalf of Buyer in connection with the PO, the Data Processing Addendum attached as Exhibit A (the "DPA") is hereby incorporated into and made a part of these Terms and the PO by this reference, and Seller agrees to comply with the DPA. In the event of any conflict between these Terms and the DPA with respect to the privacy, security, confidentiality of Personal Data, or data Processing matters, the DPA shall control. Capitalized terms used in this sentence and not otherwise defined in these Terms have the meanings given in the DPA. Seller shall not, without Buyer’s prior written consent, in any manner advertise or publish the fact Seller has furnished, or contracted to furnish, to Buyer any goods or services, or that Buyer endorses Seller or its goods or services.
-
13. Work Product; Licenses.
-
A. Retained Intellectual Property. Each party retains all right, title, and interest (including all proprietary rights) in and to its Retained Intellectual Property. “Retained Intellectual Property” consists of each party’s concepts, data, designs, developments, documentation, drawings, hardware, improvements, information, inventions, processes, software, techniques, technology, tools, and any other intellectual property, and any third-party licenses or other rights to use any of the foregoing, that (a) exists prior to the date of the applicable PO; or (b) are developed entirely independently by a party, at any time, (i) without any use, knowledge of, or reference to, the other party’s confidential information or other information obtained in connection with the PO and (ii) do not constitute Work Product (as defined below).
-
B. Work Product. For purposes of this PO, "Work Product" includes, without limitation, all designs, discoveries, creations, works, devices, masks, models, work in progress, service deliverables, inventions, products, computer programs, procedures, improvements, developments, drawings, notes, documents, information and materials made, conceived, or developed by Seller, alone or with others, which result from or relate to the services performed pursuant to the PO, and all copies thereof. Standard goods manufactured by Seller and sold to Buyer without having been designed, customized, or modified for Buyer do not constitute Work Product. All Work Product shall at all times be and remain the sole and exclusive property of Buyer. Seller hereby agrees to irrevocably assign and transfer to Buyer and does hereby assign and transfer to Buyer all of its worldwide right, title, and interest in and to the Work Product including all associated intellectual property rights. Buyer will have the sole right to determine the treatment of any Work Product, including the right to keep it as trade secret, execute and file patent applications on it, to use and disclose it without prior patent application, to file registrations for copyright or trademark in its own name, or to follow any other procedure that Buyer deems appropriate.
-
C. License to Seller’s Retained Intellectual Property. To the extent Seller’s Retained Intellectual Property is embodied or incorporated in any Work Product, Seller hereby grants Buyer and its affiliates a non-exclusive, worldwide, perpetual, irrevocable, transferable, royalty-free, fully paid-up license to such Retained Intellectual Property necessary to (a) use, make, have made, sell, offer to sell, reproduce, perform, display, distribute, and import such Work Product, (b) adapt, modify, and create derivative works of such Work Product, and (c) sublicense the foregoing rights. Seller will enter into agreements with its Personnel or any other party as necessary to fully effect such license grant.
-
14. Buyer's Property; Seller’s Tools, Equipment, and Materials. Unless otherwise agreed in writing, any and all designs, drawings, blueprints, molds, tools, equipment, and other materials of every description which Buyer furnishes to Seller or pays for, and any replacement thereof, or any materials affixed or attached thereto, shall be and remain the personal property of Buyer. Seller shall not substitute any property for Buyer's property and shall not use such property except in filling Buyer's orders. All tools, equipment, and other materials are to be maintained in good condition by Seller for as long as they remain active and returned to Buyer promptly upon request. Seller represents and warrants that all tools, equipment, and other materials furnished to Buyer are of a kind and type readily accepted by and transferable within an industry of like nature of Seller, with only limited, reasonable modification. Buyer reserves the right to enter Seller’s premises during normal business hours to retrieve any of the items above (e.g., in the event of Seller’s bankruptcy, etc.
-
15. IP Indemnity. Seller agrees to indemnify and hold Buyer, its affiliates, subsidiaries, and its/their respective successors, assigns, and each of their respective officers, directors, employees, agents, contractors, customers, and users harmless from all liabilities, claims, demands, judgments, decrees, other actions, damages, royalties, costs, losses, and expenses (including reasonable attorneys' fees) arising from any infringement or claimed infringement of any patent, copyright, trademark, trade secret, or other proprietary right occasioned by the use or sale by Buyer of Products covered by the PO. Seller agrees that it will, upon request of Buyer and at Seller's own expense, defend or assist in the defense of any action which may be brought against Buyer for such infringement or claimed infringement and that Buyer may be represented by and actively participate through its own counsel in any such action.
-
16. General Indemnity; Insurance. Seller agrees to defend, indemnify and hold Buyer, its affiliates and their respective successors, assigns, and each of their respective officers, directors, employees, agents, contractors, customers, and users harmless against all liabilities, claims, demands, other actions, judgments, decrees, damages, costs, losses and expenses (including reasonable attorneys' fees) arising from (1) any breach by Seller of any provision, covenant, representation, or warranty set forth or referenced in the PO, (2) the failure of any Product to meet the requirements of federal, state, local, or any other applicable law or regulation; (3) any act or omission, direct or indirect, negligence, or willful misconduct of Seller, its agents, representatives, employees, or subcontractors; (4) any actual or alleged defect or nonconformity in the services or in the design, manufacturer, material of the goods; (5) any personal injury or property damage arising out of or resulting from any defective or nonconforming Product or from any act or omission of Seller, its agents, representatives, employees, or subcontractors; and (6) any Product recalls. Seller shall obtain and keep in force for three years after the last delivery of goods or services under the PO insurance coverage, including at a minimum commercial general liability (including product liability and completed operations coverage), workers' compensation as required by law, and, where applicable to the services provided, professional liability/errors and omissions and cyber liability coverage, in each case with coverage limits that are reasonable and customary for providers of similar size in Seller's industry. Within five (5) days of receipt of a request from Buyer, Seller agrees to provide Buyer with a certificate of insurance evidencing Seller’s insurance coverages.
-
17. Remedies. If Seller breaches the PO or any of these Terms, Buyer, in addition to the remedies expressly set forth in this PO, shall have all other remedies available by law and at equity.
-
18. Limitation of Liability. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL BUYER’S OR ITS RELATED ENTITIES’ AGGREGATE liability arising out or related to this PO exceed the total amount actually paid or payable by Buyer to Seller for the applicable goods or services furnished under this PO that caused the liability, nor will Buyer or its related legal ENTITIES BE LIABLE FOR ANY LOST REVENUES, LOST PROFITS, INCIDENTAL, INDIRECT, CONSEQUENTIAL, SPECIAL, PUNITIVE OR OTHER SIMILAR LOSSES AND DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
-
19. Termination. Buyer may cancel or terminate this PO in whole or in part at any time and without cause. Upon notice of cancellation or termination, Seller will inform Buyer of the extent to which it has completed its performance under this PO as of the date of the notice and collect and deliver to Buyer any Products which then exists. If the PO is canceled or terminated in whole or in part by Buyer, Seller shall be compensated proportionately to the extent that items have been accepted by Buyer or services properly rendered in accordance with the PO prior to the date of cancellation or termination less any deductions or set-off. Buyer shall have no further liability.
-
20. Force Majeure. Either party shall be excused from its obligations hereunder if it is unable to perform by reason of an unforeseeable occurrence beyond its reasonable control, including but not limited to, fires, floods, accidents, civil unrest, acts of God, war, and governmental embargoes; provided, however, that strikes, industrial disputes, and unanticipated market shortages of labor, materials, or supplies shall not constitute force majeure events. Notwithstanding the foregoing, obligations may only be excused if the party affected by such circumstance or event (i) gives the other party prompt written notice of such circumstance or event promptly after its occurrence; (ii) has fully complied with Section 21 (Business Continuity); and (iii) has used its commercially reasonable efforts to minimize the effect of such circumstance or event. Buyer may terminate the PO immediately upon written notice if such circumstance or condition continues for more than fifteen (15) days, and Seller shall have no claim for damages or compensation as a result of such termination.
-
21. Business Continuity. Seller acknowledges its performance under the PO may play a crucial role in Buyer’s product supply and/or customer service commitment, and that Seller’s business operations must be resilient and capable of withstanding the effects of disruptions in service. Seller represents and warrants that it has and updates a business continuity plan (“BCP”) to ensure the timely delivery of goods and services. Seller agrees to deliver a copy of its BCP to Buyer upon Buyer’s request, to notify Buyer in a timely manner of any actual or anticipated business continuity events, and to use its commercially reasonable efforts to cure any such non-compliance with its BCP as soon as practicable.
-
22. Relationship of the Parties. Seller is an independent contractor, and nothing contained in this PO will be deemed or construed to create a partnership, joint venture, agency, or other relationship between the parties other than that of seller and buyer.
-
23. Assignment; Subcontracting. Seller may not assign, transfer, or subcontract this PO without Buyer’s prior written consent. Buyer may assign this PO to any affiliate or subsidiary or to a successor in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets without Seller's consent. The terms and conditions of this PO will inure to the benefit of and be binding upon the respective successors and assigns of the parties.
-
24. Severability. In the event that any one or more of the provisions contained in the PO, or the application thereof in any circumstances, is held invalid or unenforceable in any respect under applicable law, (1) a suitable and equitable provision shall be substituted therefor in order to carry out, so far as may be valid and enforceable, the intent and purpose of such invalid and unenforceable provision and (2) such invalidity or unenforceability shall not affect any other provision of the PO.
-
25. Headings. The captions in the PO are not part of the PO but are instead included merely for the convenience of reference only and shall not affect meaning or interpretation.
-
26. Survival. Any provision of these Terms relating to confidentiality, intellectual property rights, warranties, indemnification, limitations of liability, governing law, and any other provision that expressly or by implication is intended to continue after termination or expiry of the PO shall remain in full force and effect.
-
27. Waiver. No waiver by Buyer of any terms and conditions hereof shall be effective unless explicitly stated in writing and signed by an authorized representative of Buyer, and then such waiver shall only be effective for the specific instance and the specific purpose for which it is given. Buyer’s failure to assert a right hereunder or to insist upon compliance with any term or condition of these PO terms shall not constitute a waiver of that right or excuse a similar subsequent failure to perform any such term or condition.
-
28. Entire Agreement. The PO, including all descriptions and attachments furnished by Buyer (including Exhibit A (the Data Processing Addendum)), constitutes the entire agreement and understanding between the parties and supersedes and replaces any and all prior or contemporaneous representations, agreements, or understandings of any kind, whether written or oral, relating to the subject matter hereof. No change, modification, or revision of the PO is valid unless in writing and signed by authorized representatives of both parties, provided that Buyer may make changes to specifications, shipping instructions, quantities, and delivery schedules upon written notice to Seller.
-
29. Governing Law. The construction, interpretation, and performance of the PO, including without limitation these Terms, and all transactions thereunder shall be governed by the laws of the State of South Carolina, USA and the laws of the United States applicable therein, without regard to any conflicts of law provisions that would otherwise require the application of the law of any other jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods (CISG) shall not apply. Any action brought in relation to the PO shall be brought exclusively in the state and/or federal courts in the State of South Carolina, USA, and each party hereby irrevocably submits to the personal jurisdiction of such courts and waives any objection to venue or forum non conveniens.
EXHIBIT A
DATA PROCESSING ADDENDUM
This Data Processing Addendum ("DPA") is incorporated into each purchase order, statement of work, order form, work order, invoice acceptance, master agreement, or other written purchasing or governing document issued by or entered into with Thorne Research, Inc. ("Thorne") for goods or services from the vendor identified in that document ("Vendor" or "Seller," as used in the Terms) (each, an "Agreement"). Vendor accepts this DPA by accepting or performing under an Agreement. This DPA applies whenever Vendor Processes Personal Data for or on behalf of Thorne. If this DPA conflicts with an Agreement, this DPA controls for privacy, security, confidentiality of Personal Data, and data Processing matters.
1. Definitions
"Applicable Data Protection Laws" means all privacy, data protection, data security, breach notification, consumer protection, and similar laws applicable to the Processing of Personal Data, including as applicable the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), other U.S. state privacy laws, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection ("FADP"), and the Personal Information Protection and Electronic Documents Act ("PIPEDA").
"Authorized Purpose" means Vendor's provision of the goods or services described in the applicable Agreement and any other written instructions issued by Thorne.
"Personal Data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual, household, device, or other person, including information defined as personal data, personal information, personally identifiable information, protected health information, or similar terms under Applicable Data Protection Laws.
"Process" or "Processing" means any operation performed on Personal Data, including collection, access, use, storage, disclosure, transfer, retention, deletion, sale, sharing, or other handling.
"Security Incident" means any actual or reasonably suspected unauthorized access to, acquisition of, disclosure of, loss of, compromise of, or inability to access Personal Data or Thorne Confidential Information in Vendor's or its Subprocessor's possession or control.
"Subprocessor" means any third party that Processes Personal Data for Vendor in connection with the Authorized Purpose. Vendor personnel are not Subprocessors.
"Thorne Confidential Information" means all non-public information disclosed or made available by Thorne, including Personal Data, business, technical, financial, pricing, customer, employee, product, supplier, security, and Agreement-related information.
Capitalized terms not defined in this DPA have the meanings given in the applicable Agreement or Applicable Data Protection Laws.
2. Roles and Processing Instructions
2.1 Roles. For Personal Data Processed under this DPA, Thorne is the controller, business, data exporter, or equivalent role, and Vendor is the processor, service provider, contractor, data importer, or equivalent role, as those terms are used under Applicable Data Protection Laws. If Vendor believes it is an independent controller for any Processing, Vendor must notify Thorne before that Processing begins and may proceed only under separate written terms approved by Thorne.
2.2 Instructions. Vendor shall Process Personal Data only for the Authorized Purpose, only on Thorne's documented instructions, and only as necessary to perform the Agreement. This DPA, the Agreement, and Thorne's written directions constitute Thorne's instructions. Vendor shall promptly notify Thorne if Vendor believes an instruction violates Applicable Data Protection Laws, unless legally prohibited from doing so.
2.3 Use restrictions. Vendor shall not: (a) sell, share, rent, release, disclose, make available, or otherwise monetize Personal Data; (b) retain, use, or disclose Personal Data outside the direct business relationship with Thorne or outside the Authorized Purpose; (c) combine Personal Data with data from other sources except as permitted by Applicable Data Protection Laws for service providers or as Thorne expressly authorizes in writing; (d) use Personal Data for targeted advertising, cross-context behavioral advertising, analytics unrelated to the services, profiling, or product improvement; (e) use Personal Data or Thorne Confidential Information to train, fine-tune, test, prompt, improve, or develop artificial intelligence or machine learning models, including generative AI systems, unless the Agreement expressly allows it or Thorne gives prior written approval; or (f) attempt to re-identify deidentified, anonymized, pseudonymized, or aggregated data derived from Personal Data. Vendor certifies that it understands and will comply with these restrictions.
2.4 Sensitive data. Vendor shall not Process sensitive Personal Data, including health, genetic, biometric, precise geolocation, payment card, government ID, children's data, or account credential data, unless Thorne expressly authorizes it in writing or the applicable Agreement specifically contemplates such Processing. Vendor shall apply safeguards appropriate to the sensitivity and risk of that data.
3. Vendor Compliance and Assistance
Vendor shall: (a) comply with Applicable Data Protection Laws and this DPA; (b) ensure that persons who Process Personal Data are bound by written confidentiality obligations, trained on appropriate handling of Personal Data, and granted access only on a need-to-know basis; (c) keep Personal Data accurate, complete, and current to the extent Vendor has control over it; (d) promptly comply with Thorne's instructions to correct, delete, restrict, or return Personal Data; (e) reasonably assist Thorne with data subject requests, privacy notices, consent or opt-out obligations, data protection impact assessments, transfer impact assessments, regulatory inquiries, and consultations with supervisory authorities; and (f) maintain records sufficient to demonstrate compliance with this DPA.
Vendor shall not respond on the merits to any request, complaint, subpoena, regulator inquiry, or other communication relating to Personal Data unless Thorne authorizes the response or Applicable Law requires Vendor to respond. Vendor shall forward data subject requests and privacy-related complaints to privacy@thorne.com within two business days of receipt.
4. Confidentiality
Vendor shall protect Thorne Confidential Information with at least the same degree of care it uses for its own sensitive confidential information, and no less than reasonable care. Vendor may use or disclose Thorne Confidential Information only as necessary for the Authorized Purpose, as permitted by this DPA, or as required by law after providing Thorne prompt prior notice to the extent legally permitted. Vendor is responsible for any breach of this Section by its personnel, affiliates, contractors, or Subprocessors.
5. Security Measures
Vendor shall maintain a written information security program with administrative, technical, and physical safeguards appropriate to the nature, scope, context, sensitivity, and risk of the Processing. Vendor shall not materially reduce its safeguards during the term of the Agreement without Thorne's prior written approval. At a minimum, Vendor shall maintain the following controls for systems and personnel that Process Personal Data:
(1) access controls based on least privilege, unique user IDs, timely access removal, and multi-factor authentication for administrative, remote, and cloud access;
(2) encryption of Personal Data in transit and at rest using industry-standard protocols, or equivalent compensating controls approved by Thorne in writing;
(3) secure configuration, patch management, vulnerability management, malware protection, logging, monitoring, backup, and disaster recovery controls;
(4) segmentation and tenant separation sufficient to prevent unauthorized access to Thorne data by other customers or unauthorized users;
(5) secure development, change management, and testing practices for software or platforms used to Process Personal Data;
(6) documented incident response procedures, security awareness training, personnel screening appropriate to role, and physical security controls;
(7) periodic risk assessments and independent security assessments appropriate to Vendor's services, such as SOC 2, ISO 27001, penetration testing, or equivalent assessments; and
(8) secure disposal procedures for Personal Data and media containing Personal Data.
6. Security Incidents
Vendor shall notify Thorne at privacy@thorne.com without undue delay, and in any event within 24 hours after becoming aware of a Security Incident. Notice must include the information then available about the nature of the incident, affected systems, categories and approximate volume of Personal Data, affected individuals, likely consequences, mitigation steps, and Vendor's incident contact. Vendor shall provide updates as information becomes available.
Vendor shall promptly investigate, contain, remediate, and preserve evidence regarding each Security Incident. Vendor shall cooperate with Thorne and provide information Thorne reasonably requests for legal, regulatory, customer, employee, insurer, auditor, or business continuity purposes. Vendor shall not notify any regulator, individual, customer, media outlet, or other third party about a Security Incident involving Thorne without Thorne's prior written approval, unless legally required. If notice is legally required, Vendor shall give Thorne advance notice and a reasonable opportunity to comment to the extent legally permitted.
7. Subprocessors
Vendor may use Subprocessors only if Vendor: (a) conducts appropriate diligence; (b) enters into a written agreement requiring protections at least as protective as this DPA; (c) remains fully responsible for each Subprocessor's acts and omissions; (d) maintains a current list of Subprocessors used for the services and provides it to Thorne upon request; and (e) gives Thorne at least 30 days' prior notice of any new or replacement Subprocessor that will Process Personal Data, unless emergency replacement is necessary for security or continuity, in which case notice must be given as soon as reasonably practicable.
Thorne may object to a new or replacement Subprocessor on reasonable privacy, security, legal, or business grounds. If the parties cannot resolve the objection, Vendor shall not use the Subprocessor for Personal Data, or Thorne may suspend the affected Processing or terminate the affected Agreement without penalty.
8. Return, Deletion, and Retention
Vendor shall retain Personal Data only as long as necessary for the Authorized Purpose or as required by law. Upon Thorne's request or upon expiration or termination of the applicable Agreement, Vendor shall promptly return or securely delete Personal Data, including copies held by Vendor or Subprocessors, and certify completion upon request. Unless the Agreement or Applicable Law requires a shorter period, deletion or return must be completed within 30 days after Thorne's request or termination. Vendor may retain Personal Data only to the extent required by law, and only for the required period, subject to this DPA.
9. Audits and Information Rights
Upon request, Vendor shall provide information reasonably necessary for Thorne to verify Vendor's compliance with this DPA, including security policies, privacy policies, subprocessor information, data flow descriptions, audit reports, certifications, penetration test summaries, remediation status, and incident response documentation, subject to reasonable confidentiality protections. Vendor may satisfy routine requests by providing current third-party reports or certifications if they reasonably address Thorne's request.
No more than once per calendar year, and additionally after a Security Incident, material change in Processing, regulatory request, or reasonable evidence of noncompliance, Thorne or its designated auditor may audit Vendor's compliance with this DPA on reasonable notice. Routine audit costs are Thorne's responsibility, but Vendor shall bear any audit costs if the audit reveals material noncompliance with this DPA. The parties shall cooperate to set a scope and timing that minimizes business disruption while allowing Thorne to verify compliance.
10. Government and Third-Party Requests
If Vendor receives any subpoena, warrant, regulator inquiry, government request, law enforcement request, or other demand seeking access to Personal Data, Vendor shall, to the extent legally permitted: (a) promptly notify Thorne; (b) redirect the requester to Thorne where appropriate; (c) disclose only the minimum information legally required; (d) use reasonable lawful efforts to challenge or narrow the request; and (e) provide Thorne with information reasonably necessary to evaluate and respond to the request.
11. International Transfers
Vendor shall not transfer Personal Data to, or allow access from, any jurisdiction outside the United States without Thorne's prior written consent, unless the applicable Agreement expressly authorizes the transfer. All transfers must comply with Applicable Data Protection Laws and this DPA. Vendor shall implement and maintain any required transfer mechanism and supplementary measures, and shall promptly provide information Thorne reasonably requests to evaluate cross-border transfer risk.
For any transfer of Personal Data subject to the GDPR from the European Economic Area to a country not covered by an adequacy decision, the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated by reference and apply as follows: Module Two applies to controller-to-processor transfers between Thorne and Vendor; Module Three applies to processor-to-processor transfers between Vendor and Subprocessors where required; Clause 7 optional docking is omitted; Clause 9 Option 2 applies with 15 days' prior notice for Subprocessors; Clause 11 optional redress language is omitted; Clause 17 is governed by the laws of Ireland; and Clause 18 specifies the courts of Ireland. The SCC Annex information is deemed completed by this DPA, Schedule 1, and the applicable Agreement.
For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office is incorporated by reference. Its tables are completed by this DPA, Schedule 1, and the applicable Agreement, and Table 4 is completed by selecting "neither party." For transfers subject to the FADP, the SCCs apply with references to the GDPR, EU Member States, supervisory authorities, and courts interpreted as references to the FADP, Switzerland, the Swiss Federal Data Protection and Information Commissioner, and Swiss courts, as applicable.
If a transfer mechanism is invalidated, restricted, or no longer sufficient, Vendor shall promptly notify Thorne and cooperate to implement a lawful alternative. Vendor shall suspend any transfer that cannot be made lawfully.
12. Indemnity, Costs, and Liability
Vendor shall defend, indemnify, and hold harmless Thorne, its affiliates, and their officers, directors, employees, agents, successors, and assigns from all claims, damages (including consequential, incidental, and indirect damages), fines, penalties, settlements, losses, liabilities, costs, and expenses, including reasonable outside attorneys' fees, arising out of or relating to: (a) Vendor's breach of this DPA; (b) Processing outside Thorne's instructions or the Authorized Purpose; (c) violation of Applicable Data Protection Laws by Vendor or its Subprocessors; (d) a Security Incident caused by Vendor or its Subprocessors; or (e) unauthorized sale, sharing, disclosure, use, retention, or combination of Personal Data by Vendor or its Subprocessors.
Vendor's indemnity includes reasonable costs of investigation, containment, remediation, restoration, notification, call centers, credit or identity monitoring where legally required or reasonably appropriate, regulatory response, and other mitigation measures arising from a Security Incident caused by Vendor or its Subprocessors. Any limitation of liability or exclusion of damages in an Agreement, including any exclusion of consequential, indirect, incidental, or special damages, does not apply to Vendor's confidentiality, privacy, security, Security Incident, or indemnity obligations under this DPA unless the Agreement expressly states that it applies to this DPA.
13. General Terms
This DPA remains in effect while Vendor Processes Personal Data and for so long as Vendor retains Personal Data. Notices under this DPA must be provided under the notice provisions in the Agreement, except Security Incident notices and privacy request escalations must also be sent to privacy@thorne.com. This DPA is governed by the laws of the State of South Carolina without regard to conflicts of law principles, and any disputes arising under this DPA shall be subject to the exclusive jurisdiction of the state and federal courts located in South Carolina. The Agreement's assignment, amendment, severability, and counterparts provisions apply to this DPA unless they conflict with this DPA.
If any provision of this DPA is invalid or unenforceable, the remaining provisions remain effective, and the invalid or unenforceable provision will be interpreted to best accomplish its intended purpose. The obligations that by their nature should survive termination survive, including confidentiality, return or deletion, audit rights relating to prior Processing, indemnity, and all obligations regarding retained Personal Data.
SCHEDULE 1
PROCESSING DETAILS AND SCC ANNEX INFORMATION
This Schedule is intentionally generic so this DPA can be attached to any Agreement without transaction-specific blanks. The specific services, systems, volumes, and data elements are determined by the applicable Agreement, Thorne's written instructions, and the Personal Data actually made available to Vendor.
|
Item |
Generic Detail |
|
Subject Matter |
Vendor's Processing of Personal Data as necessary to provide goods or services to Thorne under the applicable Agreement. |
|
Duration |
The term of the applicable Agreement and any additional period during which Vendor retains Personal Data as permitted by this DPA or required by law. |
|
Frequency |
Continuous, recurring, or as otherwise necessary to provide the goods or services under the applicable Agreement. |
|
Nature and Purpose |
Collection, receipt, access, hosting, storage, organization, retrieval, use, analysis, transmission, disclosure to approved Subprocessors, support, maintenance, deletion, return, and other Processing necessary for the Authorized Purpose. |
|
Data Subjects |
Individuals whose Personal Data is provided to or accessed by Vendor for the Authorized Purpose, which may include Thorne employees, contractors, applicants, customers, prospective customers, end users, website or platform users, healthcare professionals, business contacts, vendor or supplier personnel, and other individuals relevant to the applicable Agreement. |
|
Categories of Personal Data |
Personal Data made available to Vendor for the Authorized Purpose, which may include identifiers and contact data; account and login data; commercial, order, transaction, and billing data; professional or employment data; communications and support data; technical, usage, device, and log data; payment-related data where necessary; health, wellness, or other sensitive data only where necessary for the Authorized Purpose or authorized by Thorne; and any other Personal Data provided under the applicable Agreement or written instructions. |
|
Sensitive Data |
Vendor may Process sensitive Personal Data only where necessary for the Authorized Purpose or expressly authorized by Thorne. Vendor must apply safeguards appropriate to the sensitivity and risk of the data. |
|
Retention |
Vendor may retain Personal Data only as long as necessary for the Authorized Purpose or as required by law, and must return or delete it as required by Section 8. |
|
Data Exporter |
Thorne Research, Inc., 620 Omni Industrial Blvd., Summerville, South Carolina 29486, United States. Privacy contact: privacy@thorne.com. |
|
Data Importer |
The Vendor identified in the applicable Agreement. Vendor's contact information is the notice or contact information in the applicable Agreement or otherwise provided by Vendor in writing. |
|
Subprocessors |
The Subprocessors Vendor uses for the applicable services, as disclosed by Vendor under Section 7. |
|
Security Measures |
The safeguards described in Section 5 of this DPA and any additional measures in the applicable Agreement or written instructions. |