.5f521cec.png "Trivas.ai")
Data Processing Addendum
Privacy and Data Processing Terms
This DPA forms part of the MSPSA and applies where Provider processes Personal Data on Customer’s behalf.
1. Definitions
“Controller,” “Processor,” “Personal Data,” “Processing,” “Data Subject,” and “Security Incident” have the meanings assigned by applicable Data Protection Laws.
2. Roles
Customer is the Controller or other determining party for Customer Personal Data, and Provider is the Processor/service provider, except where applicable law requires otherwise.
3. Processing Instructions
Provider will process Customer Personal Data only to provide the Services, follow Customer’s documented instructions, maintain security, prevent fraud and abuse, and comply with applicable law.
4. Data Categories
Data may include business contact details, identifiers, account information, usage data, content, and support information. Data Subjects may include personnel, customers, prospects, suppliers, and users.
5. Confidentiality
Authorized Provider personnel will be subject to confidentiality obligations.
6. Security
Provider will maintain appropriate technical and organizational measures, including access controls, encryption where appropriate, logging, monitoring, vulnerability management, backups, incident response, personnel controls, and continuity measures.
7. Subprocessors
Customer authorizes Provider to use subprocessors. Provider will maintain a list of material subprocessors and provide notice of material changes as required by applicable law. See the current list at trivas.ai/trust/subprocessors.
8. Data Subject Requests
Provider will reasonably assist Customer with access, correction, deletion, restriction, portability, and similar requests to the extent required by applicable law.
9. Security Incidents
Provider will notify Customer without undue delay after confirming a Security Incident involving Customer Personal Data and provide reasonably available information to assist investigation and mitigation.
10. International Transfers
Cross-border transfers will use a lawful transfer mechanism required by applicable Data Protection Laws, including standard contractual clauses or other recognized safeguards where applicable.
11. Retention and Deletion
Upon termination, Provider will delete or return Customer Personal Data within 90 days unless retention is legally required or reasonably necessary for security, backups, or legal claims.
12. Audits
Provider will make available reasonable information necessary to demonstrate compliance, including relevant security reports or certifications where available. Audits are subject to reasonable notice, confidentiality, security, and scope limitations.
13. Customer Responsibilities
Customer is responsible for lawful bases, notices, consents, Data Subject responses, and ensuring its instructions comply with applicable law.
14. AI Processing
Unless expressly agreed otherwise, Provider will not use Customer Personal Data to train generally available AI models for unrelated customers. Provider may process such data as necessary to provide, secure, maintain, troubleshoot, and improve the Services consistent with the MSPSA and this DPA.
15. Conflict
This DPA controls over the MSPSA to the extent of a conflict concerning data protection.