Data Processing Agreement

Data Controller

The customer that determines why and how personal data is processed.

Data Processor

Triven, which processes personal data on the documented instructions of the Data Controller.

Personal Data

Information relating to an identified or identifiable person.

Processing

Collecting, storing, using, transmitting, or deleting personal data.

Sub-processor

A third party engaged by Triven to process personal data.

Data Subject

The person whose personal data is processed.

Triven processes the minimum data required to provide the AI agents and related services configured by the Data Controller.

This may include caller phone numbers, call metadata, message content, appointment details, business configuration, and execution logs. Triven does not sell personal data.

Each data category is tied to a service purpose and a defined retention window.

• Executing AI-agent workflows on behalf of the Data Controller.
• Delivering calls, messages, and appointment communications.
• Generating analytics and performance reports.
• Improving service quality using aggregated or anonymized data.
• Preventing fraud and maintaining platform security.

• Encryption in transit and at rest.
• Role-based access controls and least-privilege practices.
• Security monitoring, encrypted backups, and incident response procedures.
• Workforce confidentiality obligations and security training.

Triven uses vetted infrastructure, communications, payment, and AI providers. Each provider is contractually required to protect personal data consistently with this agreement.

Triven will reasonably assist with requests for access, rectification, erasure, portability, restriction, and objection, taking into account the nature of processing and applicable law.

Triven will notify the Data Controller without undue delay after becoming aware of a personal data breach and will provide available details about affected data, likely consequences, and remediation.

• Production personal data is targeted for deletion within 30 days after termination or a valid deletion request.
• Residual backup copies are targeted for deletion within 90 days.
• Data may be retained longer only when required by applicable law.

Where personal data is transferred across borders, Triven uses a lawful transfer mechanism, including applicable Standard Contractual Clauses and supplementary safeguards.

Triven will provide information reasonably necessary to demonstrate compliance and support one reasonable audit per calendar year with advance written notice, subject to confidentiality and security requirements.

This DPA remains effective while Triven processes personal data for the Data Controller. Confidentiality, security, deletion, and audit obligations survive termination where applicable.