Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Controller") and Nimavera Inc. (in formation) ("Processor", "we") and applies where and to the extent we process personal data on your behalf. Where you self-host Trusvo, we process no Customer Content and the processing terms below do not apply. In the event of a conflict on data protection, this DPA controls over the Terms.

1. Roles and scope

You are the Controller of the personal data contained in your Customer Content; we act as Processor and process it only to provide the Service and on your documented instructions — namely the Terms, your configuration, your in-product actions, and any further written instruction you give. We will tell you if, in our opinion, an instruction infringes data-protection law.

2. Nature and purpose of processing (Annex I)

• Subject matter — operating the Trusvo service: building your Evidence Graph, drafting questionnaire answers, running buyer/agent flows, and hosting your Trust Rooms.
• Duration — for the term of your account; then deleted per Section 8.
• Nature and purpose — storage, organization, analysis, generation, and display of security-review materials.
• Categories of data subjects — your personnel and collaborators, buyers/visitors to your Trust Rooms, and individuals named in documents you upload.
• Categories of personal data — names, work contact details, account identifiers, and any personal data incidentally contained in uploaded evidence. You must not upload special-category data.

3. Our obligations

We will: process only on your documented instructions; ensure personnel authorized to process are bound by confidentiality; implement and maintain the security measures in Section 6 (Annex II); assist you, taking into account the nature of processing, with data-subject requests and with your obligations under Articles 32–36 (security, breach notification, and DPIAs); and make available the information reasonably necessary to demonstrate compliance with Article 28.

4. Subprocessors

You grant general authorization for us to engage the subprocessors listed on the Subprocessors page. Each is engaged under a written contract imposing data-protection obligations no less protective than this DPA, and we remain liable for their performance. We will give notice before adding or replacing a subprocessor that processes personal data so you can object on reasonable grounds.

5. Data-subject requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise data-subject rights. If a data subject contacts us directly about Customer Content, we will refer them to you and not respond substantively except on your instruction or as required by law.

6. Security measures (Annex II)

We implement technical and organizational measures appropriate to the risk, including: encryption in transit (TLS) and at rest; secret detection and redaction before storage and before any model call; strict tenant isolation; least-privilege access controls and two-factor authentication for privileged accounts; SSRF protection on outbound fetches; audit logging of privileged and security-relevant actions; and — in config-only mode — exclusion of application source code from ingestion. We do not use Customer Content to train models. See the Security overview for detail.

7. International transfers

Where personal data is transferred out of the EEA or UK, the transfer is covered by the applicable EU Standard Contractual Clauses (and UK Addendum) or another lawful transfer mechanism, which are incorporated into this DPA by reference and available on request.

8. Return and deletion

On termination of the Service, or on your written request, we will delete or return Customer Content and delete existing copies within a reasonable period (target: within 30 days), except where retention is required by law. Backups are purged on a rolling schedule.

9. Personal-data breach

We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Content, and provide the information reasonably available to help you meet your notification obligations under Articles 33–34.

10. Audits

We will make available the information reasonably necessary to demonstrate compliance with Article 28 and, on reasonable prior notice, no more than once per year (unless required by a supervisory authority), and subject to confidentiality, allow for an audit — which we may satisfy by providing current third-party reports or a completed security questionnaire — of processing activities relevant to your data.

11. Contact

To put a countersigned copy in place or ask questions: privacy@trusvo.com.

Pre-launch template texts describing how Trusvo actually works. Not legal advice — have counsel review before relying on them.