Data Processing Agreement

Parties

1. Customer name, a company registered under number company registration number, having its registered office at registered address, country, duly represented by name of representative, title of representative (the “Customer” or “Controller”); and

2. Trivle, registered with the Netherlands Chamber of Commerce (KvK) under number 92733689, having its registered office at Zwolsekanaal 35, 7681 EC Vroomshoop, the Netherlands, duly represented by name of representative (“Trivle” or “Processor”),

each a “Party” and together the “Parties”.

Recitals

A. The Parties have entered into title and date of the agreement, e.g. order confirmation / quotation dated … (together with its annexes and any amendments, the “Agreement”), under which Trivle provides the Customer with access to its software-as-a-service e-learning and training-management platform (the “Platform”) and related services, which may include implementation, support and custom integrations with the Customer’s systems (together, the “Services”).

B. In providing the Services, Trivle processes personal data on behalf of the Customer.

C. The Parties wish to set out their arrangements regarding that processing in writing, as required by Article 28(3) GDPR, in this data processing agreement (“DPA”).

D. This DPA forms an integral part of the Agreement. In the event of any conflict between this DPA and the Agreement, Trivle’s General Terms and Conditions (https://www.trivle.com/legal/terms-and-conditions) or any other agreement between the Parties, this DPA shall prevail insofar as the processing of personal data is concerned.

1. Definitions

1.1 Capitalised terms used but not defined in this DPA have the meaning given to them in the GDPR or the Agreement. In this DPA:

• Applicable Data Protection Law: the GDPR, the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and any other data protection legislation applicable to the Processing under this DPA.
• Data Subject: an identified or identifiable natural person to whom Personal Data relates.
• Environment: the Customer’s logically separated tenant within the Platform.
• GDPR: Regulation (EU) 2016/679 (General Data Protection Regulation).
• Personal Data: any information as referred to in Article 4(1) GDPR that Trivle processes on behalf of the Customer in connection with the Agreement.
• Personal Data Breach: a breach of security as referred to in Article 4(12) GDPR affecting Personal Data.
• Processing: any operation or set of operations as referred to in Article 4(2) GDPR performed on Personal Data; “Process” shall be construed accordingly.
• Standard Contractual Clauses or SCCs: the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914, or any successor thereto.
• Sub-processor: any third party engaged by Trivle to Process Personal Data on behalf of the Customer.
• Supervisory Authority: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or any other competent supervisory authority within the meaning of the GDPR.

2. Subject matter, nature and duration of the Processing

2.1 Trivle shall Process Personal Data only on behalf of and on the documented instructions of the Customer, and only for the purposes described in Annex 1 (Processing Register).

2.2 The nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are specified in Annex 1.

2.3 Trivle shall not Process Personal Data for its own purposes. In particular, Trivle shall not sell Personal Data and shall not use Personal Data to train its own algorithms or artificial intelligence models.

2.4 Where the Services include integrations (for example API connections) between the Platform and systems of the Customer or of third parties engaged by the Customer, Personal Data exchanged through those integrations is Processed by Trivle under this DPA. The Customer is responsible for the systems it controls, for the Personal Data it makes available through such integrations and for its own agreements with the providers of those systems.

2.5 This DPA enters into force on the date of signature by both Parties and remains in force for as long as Trivle Processes Personal Data on behalf of the Customer under the Agreement. Provisions which by their nature are intended to survive termination, including those on confidentiality, liability, retention and return and deletion, shall continue to apply after termination.

3. Roles of the Parties

3.1 The Customer is the Controller within the meaning of the GDPR and determines the purposes and means of the Processing.

3.2 Trivle is the Processor and Processes Personal Data solely on behalf of the Customer.

3.3 Where the Customer itself Processes Personal Data on behalf of third parties (for example affiliated companies or its own clients), the Customer warrants that it is authorised to engage Trivle as (sub-)processor and that this DPA is consistent with its arrangements with those third parties.

3.4 Trivle is not responsible for the lawfulness of the Processing. The Customer warrants that it has a valid legal basis under Article 6 GDPR for the Processing, that it has informed the Data Subjects (including its employees and other participants) in accordance with Articles 13 and 14 GDPR and that, where required, it has complied with any applicable employee participation requirements.

3.5 The Processing is not intended to cover special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR). The Customer shall not upload or otherwise make such data available through the Platform, including in free-text fields or uploaded documents, unless the Parties have agreed otherwise in writing.

4. Instructions and obligations of Trivle

4.1 The Agreement, this DPA and the Customer’s use and configuration of the Platform constitute the Customer’s documented instructions. Trivle shall Process Personal Data only on such instructions, unless required to do so by Union or Member State law to which Trivle is subject. In that case, Trivle shall inform the Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

4.2 Trivle shall inform the Customer without delay if, in its opinion, an instruction infringes the GDPR or other Applicable Data Protection Law.

4.3 Taking into account the nature of the Processing and the information available to it, Trivle shall provide the Customer with reasonable assistance in fulfilling its obligations under the GDPR, including:

• responding to requests from Data Subjects to exercise their rights under Articles 15 to 22 GDPR; Trivle shall promptly forward any such request it receives directly to the Customer and shall not respond to it unless instructed by the Customer;
• carrying out data protection impact assessments (Article 35 GDPR) and prior consultations with the Supervisory Authority (Article 36 GDPR);
• notifying and communicating Personal Data Breaches (Articles 33 and 34 GDPR).

4.4 Trivle may charge a reasonable fee, at the rates applicable under the Agreement and after prior consultation with the Customer, for assistance that falls outside its standard services and reasonably requires significant effort, such as extensive Data Subject requests or cooperation in a data protection impact assessment.

5. Confidentiality

5.1 Trivle shall ensure that persons authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2 Trivle shall limit access to Personal Data to those staff members and engaged third parties for whom such access is necessary for the performance of the Agreement (least privilege).

6. Security of Processing

6.1 Trivle shall implement appropriate technical and organisational measures to protect Personal Data against loss and any form of unlawful Processing, as further described in Annex 2 (Technical and Organisational Measures).

6.2 In assessing the appropriate level of security, the Parties shall take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing and the risks of varying likelihood and severity for the rights and freedoms of Data Subjects.

6.3 Trivle may amend the security measures where it considers this necessary to maintain an appropriate level of security, provided that the overall level of protection is not reduced.

6.4 The Customer is responsible for:

• granting and managing user accounts, roles and access rights within its Environment;
• the proper use of the security features offered by the Platform, including two-factor authentication;
• the secure handling of any API keys, credentials or other secrets provided to it for integrations;
• informing Trivle without undue delay of any suspected misuse, unauthorised access or other security incident on the Customer’s side.

7. Data minimisation in error monitoring and AI features

7.1 Trivle shares Personal Data with error monitoring tools and AI services only to the extent necessary for the purpose concerned.

7.2 Application errors are reported to Sentry (see Annex 3) in order to detect, diagnose and resolve technical problems. Trivle limits the Personal Data included in error reports as far as reasonably possible and uses error report data solely for that purpose.

7.3 Certain features of the Platform, such as text generation and translation, make use of OpenAI (see Annex 3). For those features Trivle sends only the data required for the feature concerned. Under OpenAI’s API terms, data submitted through the API is not used to train OpenAI’s models. Trivle does not use Personal Data to train its own models.

7.4 The Customer may request in writing that AI features be disabled for its Environment. Trivle shall comply with such a request within a reasonable period. The Customer acknowledges that the functionality relying on those features will then no longer be available.

8. Sub-processors

8.1 The Customer grants Trivle general authorisation to engage Sub-processors. The Sub-processors engaged at the date of signing are listed in Annex 3. The current list is published at https://www.trivle.com/legal/sub-processors.

8.2 Trivle shall notify the Customer of any intended addition or replacement of a Sub-processor by e-mail to the contact address provided by the Customer and by publication on the web page referred to in clause 8.1, at least thirty (30) days before the change takes effect.

8.3 The Customer may object to an intended change in writing, stating its reasons, within thirty (30) days of the notification. The Parties shall then consult in good faith to find an appropriate solution. If no solution is reached within a reasonable period, the Customer may terminate the affected Service by written notice to Trivle.

8.4 Trivle shall impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those set out in this DPA. Trivle remains fully liable to the Customer for the performance of each Sub-processor’s obligations.

9. Personal Data Breaches

9.1 Trivle shall notify the Customer without undue delay, and in any case within twenty-four (24) hours of discovery, of any Personal Data Breach that (potentially) affects Personal Data Processed under this DPA. Notification shall be made to the contact person designated by the Customer: name and e-mail address of Customer’s privacy contact.

9.2 The notification shall, to the extent then available, contain at least the information referred to in Article 33(3) GDPR. Where not all information can be provided at once, Trivle shall provide it in phases without further undue delay.

9.3 The Customer, as Controller, is responsible for notifying the Supervisory Authority and/or Data Subjects. Trivle shall provide reasonable assistance and shall not notify the Supervisory Authority or Data Subjects on the Customer’s behalf without the Customer’s prior consent, unless required by law.

9.4 Trivle shall take all reasonably necessary measures to contain a Personal Data Breach, limit its consequences and prevent recurrence, and shall record the breach and the measures taken in its data breach register.

9.5 The Customer shall report security incidents and suspected Personal Data Breaches on its side to Trivle at privacy@trivle.com.

10. Location of Processing and international transfers

10.1 The Platform’s application servers and database are hosted in the Netherlands; uploaded files are stored with Google Cloud in the European Union. Trivle Processes Personal Data within the European Economic Area (EEA), unless agreed otherwise in writing or to the extent that this follows from the engagement of a Sub-processor listed in Annex 3.

10.2 Where Personal Data is transferred to a country outside the EEA, Trivle shall ensure that appropriate safeguards are in place as required by Chapter V GDPR. For transfers to the United States, Trivle relies on the EU-US Data Privacy Framework (where the recipient is certified) and/or the Standard Contractual Clauses.

11. Audits and demonstrating compliance

11.1 Trivle shall make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA.

11.2 On request, Trivle shall provide the Customer once a year with a security statement describing in general terms the technical and organisational measures in place, any material security incidents and the measures taken in response, and any changes in the Sub-processors engaged.

11.3 In addition, the Customer may have an audit carried out of Trivle’s compliance with this DPA once per calendar year, and at any time where there is a justified suspicion of non-compliance or following a Personal Data Breach with material impact.

11.4 The following conditions apply to any audit:

• the audit is carried out by an independent auditor who is not a competitor of Trivle;
• the auditor and the Customer are bound by appropriate confidentiality obligations;
• the audit is announced in writing at least thirty (30) days in advance and is carried out during normal business hours, with minimal disruption to Trivle’s operations;
• the scope of the audit is limited to the Processing on behalf of the Customer and does not extend to data of other customers or to systems unrelated to that Processing; Sub-processors are assessed on the basis of their own certifications, reports and audit information;
• the Customer bears the costs of the audit. Trivle may charge reasonable costs, at the rates applicable under the Agreement, for cooperation that goes beyond reasonable and limited assistance.

11.5 The Customer shall provide Trivle with a copy of the audit report. The Parties shall consult on any findings, and Trivle shall remedy any established non-compliance with this DPA within a reasonable period.

12. Retention

12.1 Trivle shall not retain Personal Data longer than necessary for the purposes described in Annex 1 and, in any case, no longer than the term of the Agreement, subject to clause 13 and any longer retention required by Union or Member State law.

12.2 The Customer determines the retention periods for training records within its Environment (such as attendance, results and certificates) and may delete such data or instruct Trivle to do so.

12.3 Backups are retained for thirty (30) days on a rolling basis. Logs and error reports are retained no longer than necessary for security, troubleshooting and incident investigation, as further specified in Annex 1.

13. Return and deletion upon termination

13.1 Upon termination of the Agreement, or earlier at the Customer’s written request, Trivle shall, at the Customer’s choice, return or delete all Personal Data and delete existing copies, unless Union or Member State law requires storage of the Personal Data.

13.2 At the Customer’s request made within thirty (30) days after termination, Trivle shall provide one standard export of the Customer’s data free of charge, in a common machine-readable format (CSV and/or JSON) together with the uploaded files. Additional exports or tailored migration assistance are provided at the rates applicable under the Agreement.

13.3 Trivle shall delete the Personal Data within two (2) months after termination. Personal Data contained in backups is overwritten in the normal backup cycle (30-day retention).

13.4 On the Customer’s request, Trivle shall confirm the deletion in writing.

14. Liability

14.1 Each Party is liable for damage to the extent resulting from its attributable failure to perform its obligations under this DPA and/or the GDPR, subject to the provisions on liability and limitation of liability in the Agreement and Trivle’s General Terms and Conditions.

14.2 Administrative fines imposed by a Supervisory Authority shall be borne by the Party to whom the infringement giving rise to the fine is attributable. Where both Parties are responsible, the fine shall be borne in proportion to each Party’s share in the infringement.

14.3 Nothing in this DPA limits the rights of Data Subjects against either Party under the GDPR.

15. Final provisions

15.1 Amendments to this DPA are valid only if agreed in writing and signed by both Parties. Updates to Annex 3 in accordance with clause 8 and to Annex 2 in accordance with clause 6.3 do not require an amendment of this DPA.

15.2 This DPA is governed by the laws of the Netherlands. Any dispute arising out of or in connection with this DPA shall be submitted exclusively to the District Court of Overijssel (Rechtbank Overijssel), the Netherlands, without prejudice to the Parties’ right to resolve a dispute by mutual consultation or mediation.

15.3 If any provision of this DPA is held to be void or voidable, the remaining provisions shall remain in full force and effect. The Parties shall then replace the provision concerned with a valid provision that approximates the purpose of the original provision as closely as possible.

Annex 1 – Processing Register

This Annex specifies the subject matter, nature, purpose, types of Personal Data, categories of Data Subjects and retention periods, in accordance with Article 28(3) GDPR.

Purpose of the Processing

Providing, hosting, securing, maintaining and supporting the Platform and related Services for the Customer, including:

• user and account management;
• enrolling participants in trainings and sessions and delivering e-learning content;
• recording attendance, progress, answers and results;
• issuing certificates and tracking their expiry dates, and compliance reporting;
• service communications to users by e-mail and, where used, SMS or post;
• support, and integrations with the Customer’s systems as agreed in the Agreement.

Nature of the Processing

Collection (from the Customer, its users and agreed integrations), recording, organisation, storage, retrieval, consultation, use, transmission, restriction and erasure, all on the instructions of the Customer.

Categories of Data Subjects

• the Customer’s employees and learners;
• trainers;
• administrators and business managers of the Customer;
• external participants invited by the Customer (for example contractors or temporary staff), where applicable.

Types of Personal Data

• Identification and contact data: name, e-mail address(es), phone number, language preference; date of birth if used by the Customer; mobile number for SMS if used.
• Organisational data: organisation, department and role.
• Training data: training enrolments, attendance, progress, answers and results.
• Certificates: certificates issued and their expiry dates.
• Documents: documents uploaded by or on behalf of the Customer or its users.
• Technical data: login and usage data, and IP addresses for security purposes.

Special categories

None intended. The Customer shall not upload special categories of personal data unless agreed in writing (clause 3.5).

Retention

• Production data: for the term of the Agreement, subject to the Customer’s instructions; deleted within two (2) months after termination (clause 13).
• Backups: thirty (30) days on a rolling basis.
• Logs and error reports: no longer than necessary for security, troubleshooting and incident investigation.

Location

Application servers and database: the Netherlands (TransIP). File storage: Google Cloud, European Union. Other Sub-processors as listed in Annex 3, including transfers to the United States under the safeguards in clause 10.2.

Frequency

Continuous, for the term of the Agreement.

Annex 2 – Technical and Organisational Measures

This Annex describes the technical and organisational measures implemented by Trivle pursuant to Article 32 GDPR and clause 6 of this DPA.

Hosting and location

• Application servers and database are hosted in the Netherlands by TransIP, in ISO 27001-certified data centres.
• Uploaded files are stored at rest in Google Cloud in the European Union.

Encryption

• All traffic is encrypted in transit (TLS/HTTPS).
• Passwords are hashed with bcrypt; API tokens are stored as hashes.
• Two-factor authentication secrets and recovery codes, and webhook secrets, are encrypted at rest at application level.

Authentication

• Personal user accounts; password complexity rules.
• Two-factor authentication (TOTP) is mandatory for administrators and business managers.
• Rate limiting on login and two-factor authentication attempts.
• Expiring API tokens: 7 days (web), 30 days (mobile); OAuth2 access tokens expire after 1 hour.

Authorisation and tenant isolation

• Role-based access control (roles: student, trainer, admin, business manager), enforced by server-side authorisation policies.
• Strict tenant isolation: every query on tenant data is automatically scoped to the Customer’s Environment.

Audit trail

• Changes to key records (people, organisations, trainings, modules, invitations, settings and e-mail addresses) are logged, recording who changed what and when.
• Learning progress is stored as an immutable event stream.
• Support access to customer accounts (impersonation) is restricted to a limited set of named Trivle administrators using TOTP; each session is logged with its reason, IP address and time.

Development and change management

• All changes are made through version control and code review.
• An automated CI pipeline runs code-style checks and more than 4,000 automated tests, which must pass before deployment.
• Weekly automated dependency updates (Dependabot) and package vulnerability audits.
• Separate staging and production environments; test and demo data are anonymised.

Operations and continuity

• Automated daily offsite database backups with 30-day retention; restores are tested at least monthly.
• Monitoring and error tracking.
• Security patches are applied in accordance with the patch policy set out in the SLA.

Organisational measures

• Confidentiality obligations for all staff.
• Least-privilege access to systems and data.
• Security awareness among staff.
• Documented data breach procedure and data breach register.
• Data processing agreements with all Sub-processors.

Annex 3 – Sub-processors

The Sub-processors listed below are engaged as at the date of signing of this DPA. The current list is published at https://www.trivle.com/legal/sub-processors; changes follow the procedure in clause 8.

Transfers outside the EEA. Transfers to Sub-processors in the United States take place on the basis of the EU-US Data Privacy Framework and/or the Standard Contractual Clauses, in accordance with clause 10.2.