Scope & Parties
What this DPA covers, how it is incorporated, and how roles are defined.
Jump to section →LEGAL / DATA PROCESSING ADDENDUM
Data Processing
Addendum
The contractual framework that applies when Talvrin processes personal data on a customer's behalf — roles, instructions, security, subprocessors, transfers, assistance, deletion and audit rights, bound to approved schedules rather than marketing claims.
Version 1.0
Effective date, provider entity and service scope publish once Legal confirms governance records.
If your organization has a separately negotiated DPA, its precedence terms govern — see Term, precedence and amendments.
Download / version history — not yet available
DPA AT A GLANCE — CONVENIENCE SUMMARY ONLY
Six clause families. The sections below remain controlling.
This Data Processing Addendum explains the contractual framework that applies when Talvrin processes personal data on a customer's behalf. It does not assign controller, processor or subprocessor roles, state security measures, or name subprocessors and transfer mechanisms beyond what Legal, Privacy and Security have approved. This summary is a convenience orientation — the full sections below govern.
Instructions & Confidentiality
Processing only on customer instructions, and who may access personal data.
Jump to section →Transfers & Rights Assistance
Cross-border transfer mechanisms and assistance with data-subject and DPIA requests.
Jump to section →Annexes & Schedules
Processing details, security measures, subprocessors and regional transfer schedules bound to this DPA’s version.
Jump to section →Security & Subprocessors
How technical and organizational measures and subprocessor use are governed.
Jump to section →Incidents, Deletion & Audit
Security-incident notification, end-of-service deletion and audit/information rights.
Jump to section →
ON THIS PAGE
SCOPE & PARTIESNO APPROVED RULE PUBLISHED YET
1. Scope and incorporation
This Data Processing Addendum applies when Talvrin processes personal data on a customer’s behalf in the course of providing the product, and forms part of the governing agreement wherever it is incorporated by reference. It works together with, and does not replace, Talvrin’s Terms of Service and Privacy Notice.
The approved enterprise contract hierarchy that fixes exact incorporation language and precedence order has not been supplied. Until Legal approves that hierarchy, this page does not state which document controls in a conflict.
Related:Privacy Notice →
SCOPE & PARTIESNO APPROVED RULE PUBLISHED YET
2. Definitions
Defined terms used in this DPA — including personal data, processing, controller, processor and subprocessor — carry the meanings given in applicable data-protection law and in Talvrin’s counsel-approved definitions. A term is not redefined informally on this page.
An approved definitions schedule has not been supplied. Individual definitions are not drafted here ahead of Legal approval.
SCOPE & PARTIESNO APPROVED RULE PUBLISHED YET
3. Roles of the parties
Whether Talvrin acts as processor, subprocessor or independent controller for a given service depends on an approved role matrix, not a single platform-wide label. Role language is never inferred from product marketing or support content.
A public role matrix has not yet been supplied by Legal/Privacy. This page does not assign a controller, processor or subprocessor role to Talvrin or the customer until that matrix is approved.
ILLUSTRATIVE — NON-EXHAUSTIVE
- A service that processes workspace data strictly on customer instructions would typically be described as a processor role once approved.
- Any role statement beyond this is treated as a publication blocker, not a design choice.
INSTRUCTIONS & CONFIDENTIALITY
4. Documented instructions
Where Talvrin acts as processor, personal data is processed only on the customer’s documented instructions, including instructions reflected in the governing agreement and approved product configuration, except where applicable law requires otherwise.
Instruction handling is a contractual obligation, not a support-ticket workflow description — operational detail is owned by Legal/Privacy and Engineering.
INSTRUCTIONS & CONFIDENTIALITY
5. Confidentiality
Personnel authorized to process personal data are bound by confidentiality obligations, whether contractual or statutory. Access is limited to what is necessary to provide the product and meet documented instructions.
Related:Security →
SECURITY & SUBPROCESSORSNO APPROVED RULE PUBLISHED YET
6. Security measures
Technical and organizational measures protecting personal data are described only from an approved security schedule maintained by Security and Legal. This page distinguishes a public summary, where one exists, from confidential security detail.
An approved security measures schedule (Annex II) has not been supplied. No certification, control or technical-measure claim is published here until Security and Legal approve it.
Related:Security →
SECURITY & SUBPROCESSORSNO APPROVED RULE PUBLISHED YET
7. Subprocessors
Talvrin may engage subprocessors to assist in providing the product, authorized under the governing agreement and subject to equivalent data-protection obligations. The current subprocessor list, change-notice process and objection rights are governed by an approved subprocessor register.
A public subprocessor register has not been supplied. Names, functions, locations and the notice/objection process are not listed until Procurement/Vendor Management and Legal approve that register.
TRANSFERS & RIGHTS ASSISTANCENO APPROVED RULE PUBLISHED YET
8. International transfers
Where personal data is transferred across borders, Talvrin relies only on transfer mechanisms — such as standard contractual clauses or an adequacy basis — that are approved for the relevant regions. A transfer mechanism is never claimed without an approved package behind it.
An approved international-transfer package and regional schedules have not been supplied. No SCC, UK addendum, IDTA or adequacy claim is published until Legal/Privacy approves the applicable mechanism.
TRANSFERS & RIGHTS ASSISTANCE
9. Assistance with data-subject rights
Talvrin provides reasonable assistance to the customer in responding to verified data-subject requests consistent with applicable law and the governing agreement, taking into account the nature of the processing.
Related:Privacy →
INCIDENTS, DELETION & AUDITNO APPROVED RULE PUBLISHED YET
10. Security incidents
Talvrin notifies the customer of a confirmed security incident affecting their personal data without undue delay and cooperates on investigation, consistent with the governing agreement and applicable law.
Exact notification timeframes and incident-cooperation procedures are counsel-approved contract terms. A specific deadline is not published here until that approval exists.
INCIDENTS, DELETION & AUDIT
11. DPIAs and prior consultation
Where legally applicable, Talvrin provides reasonably requested information to support the customer’s data protection impact assessments and any required prior consultation with a supervisory authority.
INCIDENTS, DELETION & AUDITNO APPROVED RULE PUBLISHED YET
12. Return and deletion
At the end of the relevant service, Talvrin returns or deletes personal data in accordance with the customer’s choice and the governing agreement, subject to any legally required retention.
The approved deletion timetable and retention exceptions have not been supplied. A specific deletion period is not stated until Legal/Privacy approves it.
INCIDENTS, DELETION & AUDITNO APPROVED RULE PUBLISHED YET
13. Audit and information rights
Talvrin makes available information reasonably necessary to demonstrate compliance with this DPA and permits audits consistent with an approved evidence and audit framework, distinguishing report-based evidence from any on-site audit right.
An approved audit/evidence framework has not been supplied. This page does not promise a specific audit mechanism or frequency until Legal and Security approve one.
INCIDENTS, DELETION & AUDITNO APPROVED RULE PUBLISHED YET
14. Government and legal requests
Where legally permitted, Talvrin notifies the customer of a government or legal request for their personal data and may challenge an overbroad or unlawful request, consistent with approved policy.
Approved notification and challenge procedures for government requests have not been supplied.
AI, LOCATION & TERMS
15. AI / automated processing
Where AI-enabled features process customer personal data, that processing is described only from approved product facts and remains subject to this DPA and Talvrin’s AI Terms. AI-assisted interpretation does not expand Talvrin’s processing authorization beyond documented instructions.
AI, LOCATION & TERMSNO APPROVED RULE PUBLISHED YET
16. Data location / residency
Processing locations and any residency commitment are stated only from an approved systems and vendor map, reflecting where personal data is actually processed and stored.
An approved processing-location map has not been supplied. No region-specific residency commitment is published until Product/Data Governance approves it.
AI, LOCATION & TERMS
17. Term, precedence and amendments
This DPA remains in effect for as long as Talvrin processes personal data under the governing agreement. Where a customer has a separately negotiated DPA, that agreement’s precedence terms govern and this public DPA does not by itself override it. Material amendments are reflected with an updated version and effective date.
If a negotiated DPA applies to your account, confirm with your Talvrin contract owner which document controls.
ANNEXES & SCHEDULESNO APPROVED RULE PUBLISHED YET
18. Annex I — Processing details
Annex I describes the categories of data subjects, personal data, processing nature, purpose and duration for in-scope services, drawn from an approved customer-processing data map.
An approved processing data map (RoPA) has not been supplied. Annex I is not populated with invented subject, data or purpose categories until Product/Data Governance and Privacy approve the source map.
ANNEXES & SCHEDULESNO APPROVED RULE PUBLISHED YET
19. Annex II — Security measures
Annex II sets out the technical and organizational measures applicable to the service, maintained as a versioned schedule owned by Security and Legal.
The approved security measures schedule referenced in Section 6 has not been supplied; Annex II is not published until it is.
ANNEXES & SCHEDULESNO APPROVED RULE PUBLISHED YET
20. Annex III — Subprocessors
Annex III lists current subprocessors, or links to the canonical subprocessor register, with the exact version and effective date incorporated by this DPA.
The subprocessor register referenced in Section 7 has not been supplied; Annex III is not published until it is.
ANNEXES & SCHEDULESNO APPROVED RULE PUBLISHED YET
21. Regional transfer schedules
Where applicable, region-specific transfer schedules — such as EU/UK or other jurisdictional modules — are incorporated by exact version and linked here once approved.
No regional transfer schedule has been approved for publication yet.
ANNEXES & SCHEDULES
22. Contact / privacy operations
Questions about this DPA, its annexes or a negotiated agreement’s precedence route to Talvrin’s privacy/contractual contact channel below.
RELATED LEGAL / TRUST / PROCUREMENT
Data Processing Addendum is item six of nine in the Talvrin Legal sequence.
Each Legal destination is approved individually and in order. AI Terms remains blocked until Data Processing Addendum is approved.
A versioned contract, not a compliance
badge.
Questions about this DPA, a negotiated agreement's precedence, or its annexes and schedules route to Support or Privacy below. This page is not a substitute for your organization's signed agreement with Talvrin.
Research and intelligence platform. No trade execution. No manufactured investment recommendations.