This DPA supplements the TrustXP Terms of Service and governs the processing of personal data on behalf of your organization.
Effective date: 24 August 2026
This Data Processing Addendum ("DPA") is entered into between the organization that has agreed to the TrustXP Terms of Service ("Controller", "Customer", "you") and TrustXP ("Processor", "we", "us"). It forms part of and supplements the Terms of Service ("Agreement").
This DPA reflects the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applies to all processing of personal data carried out by TrustXP on behalf of Customer in connection with the Service.
"Personal Data" means any information relating to an identified or identifiable natural person that TrustXP processes on behalf of Customer under the Agreement.
"Processing" has the meaning given in Article 4(2) GDPR.
"Subprocessor" means a third party engaged by TrustXP to process Personal Data on behalf of Customer.
All other capitalized terms have the meaning given in the Agreement or the GDPR.
Customer is the Controller of the Personal Data processed through the Service. TrustXP is the Processor, acting on Customer's documented instructions. The subject matter, duration, nature, purpose, and categories of data and data subjects are described in Annex 1.
TrustXP will process Personal Data only on documented instructions from Customer, including with respect to transfers of Personal Data outside the European Economic Area, unless required to do so by European Union or Member State law. The Agreement (including this DPA) constitutes Customer's initial documented instructions. Customer may issue additional instructions consistent with the Agreement.
If TrustXP believes an instruction infringes the GDPR or other applicable data protection law, we will inform Customer without delay.
TrustXP ensures that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
TrustXP implements and maintains appropriate technical and organizational measures to protect Personal Data, as described on our Trust, Security & Data Locations page. These measures include:
TrustXP will not materially reduce the overall level of security during the term of the Agreement.
Customer provides general authorization for TrustXP to engage Subprocessors. The current list of Subprocessors is published on our Trust, Security & Data Locations page and includes:
TrustXP will notify Customer at least 30 days before adding or replacing a Subprocessor that processes Personal Data, by updating the Subprocessor list and emailing the account contact. If Customer objects to a new Subprocessor on reasonable data protection grounds, Customer may notify us within 30 days of the notification. We will work in good faith to address the objection. If no resolution is reached, Customer may terminate the affected portion of the Service.
TrustXP imposes data protection obligations on each Subprocessor by written contract, requiring at least the same level of data protection as this DPA. TrustXP remains liable for the acts and omissions of its Subprocessors.
TrustXP will assist Customer in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, and objection). Where a data subject contacts TrustXP directly, we will redirect the request to Customer without undue delay.
TrustXP will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, to the extent required under Articles 35 and 36 of the GDPR and to the extent the information is available to us.
TrustXP will notify Customer without undue delay after becoming aware of a personal data breach affecting Personal Data processed under this DPA. The notification will include, to the extent available:
TrustXP will cooperate with Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.
All Personal Data is stored and processed in the European Union (Netherlands). Where Subprocessors process limited data outside the EEA (as described in our Trust, Security & Data Locations page, section 6), such transfers rely on Standard Contractual Clauses adopted by the European Commission.
TrustXP will make available to Customer the information necessary to demonstrate compliance with Article 28 GDPR and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer.
Audit requests must be made in writing with at least 30 days' notice. Audits will be conducted during normal business hours, with reasonable scope, and will not unreasonably interfere with TrustXP's operations. Customer bears the cost of the audit unless the audit reveals material non-compliance by TrustXP.
Upon termination of the Agreement or upon Customer's request, TrustXP will delete or return all Personal Data processed under this DPA, and delete existing copies, unless European Union or Member State law requires retention. Deletion will be completed within 30 days of the request or termination.
Where data has been passed to a Subprocessor (for example, billing records at Stripe), deletion follows that provider's retention rules and any applicable legal obligation.
This DPA takes effect when Customer agrees to the Terms of Service and remains in effect for as long as TrustXP processes Personal Data on behalf of Customer.
Processing of Personal Data as necessary to provide the TrustXP employee trust measurement platform for the duration of the Agreement.
Collection, storage, aggregation, analysis, and display of employee trust measurement data. Delivery of pulse invitations via email. Authentication and access management. Subscription billing.
| Category | Data elements |
|---|---|
| Administrator data | Name, work email, identity-provider user ID, last sign-in timestamp |
| Pulse recipient data | Name, work email, role, team, start date, active status |
| Pulse response data | Numerical score (1-5), optional comment, trust dimension, timestamp (stored without link to individual) |
| Email delivery data | Recipient email address, delivery outcome |
| Billing data | Stripe customer ID, subscription ID, plan, billing period (no card numbers) |
| Audit data | Action performed, actor, timestamp, organization |
TrustXP does not intentionally collect or process special categories of data as defined in Article 9 GDPR. Pulse responses measure organizational trust perceptions and are not designed to elicit health, political, religious, or other special-category data.
European Union (Netherlands). See Trust, Security & Data Locations for details.