Data Processing Agreement
Effective date not set.
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between {{COMPANY_LEGAL_NAME}} (“Processor”) and the customer (“Controller”) and applies where Processor processes personal data contained in Customer Data on Controller’s behalf.
1. Subject matter and duration
Processor hosts and processes Customer Data to provide Traza Cloud for the term of the Terms and until Customer Data is deleted under section 8.
2. Nature and purpose
Storage, indexing, querying, export, replay, alert delivery and erasure of traces and related content that Controller’s systems send to the Service, and the generation of evidence packs and attestations Controller requests.
3. Categories of data and data subjects
Determined by Controller. Typically: identifiers, prompts, model outputs, tool inputs and outputs, and metadata about Controller’s end users, employees or agents as included in traces. Controller should not send special categories of personal data unless it has a lawful basis and appropriate safeguards.
4. Processor obligations
Processor will:
- process personal data only on Controller’s documented instructions, including the configuration of the Service, unless required by law;
- ensure that personnel authorized to process it are bound by confidentiality;
- implement the technical and organizational measures described at https://www.trazadb.com/security/, including encryption in transit, hashing or encryption of credentials at rest, and tenant-bound access to each project’s data;
- assist Controller, taking into account the nature of processing, with data subject requests, including through self-service export and erasure;
- notify Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data;
- make available information reasonably necessary to demonstrate compliance and allow for audits as set out in section 7.
5. Subprocessors
Controller authorizes the subprocessors listed at Subprocessors. Processor will give at least thirty days’ notice of a new subprocessor by updating that page and notifying account owners, and Controller may object on reasonable data-protection grounds. Processor imposes data-protection obligations on each subprocessor no less protective than this DPA and remains responsible for their performance.
6. International transfers
Customer Data is hosted in {{HOSTING_REGION}}. Transfers outside it rely on an approved transfer mechanism, such as standard contractual clauses, incorporated by reference where required.
7. Audits
Processor will respond to reasonable written questions about its security practices. Where the law requires more, Controller may audit once a year on thirty days’ notice, at its own cost, subject to confidentiality.
8. Deletion and return
Controller may export Customer Data at any time. On termination, Processor deletes Customer Data within thirty days after the export period in the Terms, unless the law requires retention. Deletion of a project erases its tenant on the engine; the engine’s erasure receipt records what was checked.
9. Contact
Data protection enquiries: privacy@trazadb.com. {{COMPANY_LEGAL_NAME}}, {{COMPANY_ADDRESS}}.