Data Processing Addendum.

This Data Processing Addendum applies when Truvern processes personal data on behalf of a customer in connection with the services and applicable data protection law requires processor terms.

This DPA supplements the Terms of Service and any applicable order form or written agreement. If the parties have executed a separate data processing agreement, the signed agreement controls to the extent of any conflict.

For personal data that a customer submits to Truvern for vendor governance workflows, the customer generally determines the purposes and means of the processing and Truvern processes that information on the customer's documented instructions.

Truvern may separately act as an independent controller for limited business information it processes for its own legitimate operational purposes, such as account administration, security, billing, legal compliance, and business communications.

Customer instructs Truvern to process covered personal data as necessary to provide, secure, support, and maintain the services; perform requested Truvern Reviews; operate assessment and evidence workflows; generate governance outputs; and comply with the applicable agreement.

Truvern will not materially process covered personal data for unrelated purposes except where required by applicable law.

Processing may include collection, storage, organization, retrieval, transmission, review, analysis, communication, restriction, deletion, and other operations necessary to provide the services.

• Data subjects may include customer users, vendor contacts, vendor personnel, reviewers, approvers, and other individuals whose information is included in customer-directed governance workflows.
• Data may include identity and contact information, professional information, assessment responses, evidence, communications, workflow metadata, remediation information, attestations, and audit records.
• The duration of processing generally follows the customer's use of the service plus retention reasonably required for contractual, security, backup, audit, and legal purposes.

Truvern will ensure that personnel authorized to process covered personal data are subject to appropriate confidentiality obligations and receive access only as necessary for their responsibilities.

Truvern maintains technical and organizational measures designed to protect covered personal data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

• Identity, authentication, and access controls.
• Organization and role-based access restrictions.
• Protected evidence storage and controlled retrieval workflows.
• Operational logging and governance audit records.
• Security-oriented deployment and infrastructure controls.
• Procedures intended to identify, investigate, and respond to security events.

Customer authorizes Truvern to use subprocessors reasonably necessary to provide the services. Truvern will impose data protection obligations appropriate to the services performed by those subprocessors.

Truvern maintains a current list of material infrastructure and service providers on the Subprocessors page. Truvern may update that list as its service architecture changes.

If Truvern becomes aware of a confirmed personal data breach affecting covered personal data processed on behalf of a customer, Truvern will notify the affected customer without undue delay as required by applicable law and the applicable agreement.

Truvern will provide information reasonably available to support the customer's assessment and response and may provide information in phases as an investigation develops.

Taking into account the nature of the processing, Truvern will provide reasonable assistance to customers responding to verified requests from individuals exercising applicable data protection rights where the relevant information is processed by Truvern on the customer's behalf.

If Truvern receives a request relating primarily to customer-controlled data, Truvern may direct the requester to the applicable customer unless prohibited by law.

Taking into account the nature of the processing and information available to Truvern, Truvern will provide reasonable assistance with legally required data protection impact assessments, consultations, or regulator inquiries relating to Truvern's processing of covered personal data.

Following termination of the applicable services, Truvern will delete or return covered personal data as required by the applicable agreement and law, subject to technically necessary backup cycles, immutable governance records, security records, legal holds, or other lawful retention requirements.

Truvern will make available information reasonably necessary to demonstrate compliance with applicable processor obligations, subject to appropriate confidentiality, security, and proportionality protections.

Any on-site or additional audit rights are subject to the applicable written agreement and reasonable measures designed to avoid unnecessary disruption or exposure of information belonging to other customers.

Where processing involves an international transfer subject to transfer restrictions, the parties will use an applicable lawful transfer mechanism and any supplementary safeguards required by applicable law.

Customer is responsible for the lawfulness of its instructions, the information it submits, required notices or consents, and its independent obligations as controller or business under applicable data protection law.

Questions about this DPA or Truvern's data processing practices may be submitted through the Truvern contact page.