Data Processing Addendum
Revision [2026-11] · Published at tresic.cloud/reseller-agreement/dpa/[2026-11]
This Addendum A forms part of the Tresic Reseller & White Label Agreement and is incorporated into each executed Order Form as provided in Section 13.1 of the Agreement. It may be updated only as provided in Section 13.3 of the Agreement.
This Data Processing Addendum ("DPA") is between Creo Solutions, Inc., a Delaware corporation, d/b/a Tresic ("Processor") and the entity identified as Reseller on the applicable Order Form ("Controller"). The parties enter into this DPA on behalf of themselves and, to the extent required under applicable Data Protection Laws, in the name and on behalf of their affiliates, and this DPA shall be effective on the Effective Date of the Agreement ("Effective Date").
1. Definitions
"Agreement" means the Tresic Reseller & White Label Agreement between Processor (as "Tresic") and Controller (as "Reseller"), in the Version that applies under Section 12.17 of that agreement, together with each Order Form executed thereunder.
"Business Purpose" has the meaning given in subdivision (e) of Cal. Civ. Code §1798.140 and "purpose" will be interpreted accordingly.
"Controller Data" means any information or other data (including Personal Data) provided by or on behalf of Controller to Processor for purposes of the Agreement and/or any related services.
"Controller Personal Data" means any Controller Data that is Personal Data.
"Consumer" has the meaning given in subdivision (i) of Cal. Civ. Code §1798.140.
"Contractor" has the meaning given in subdivision (j)(1) of Cal. Civ. Code §1798.140.
"Data Protection Laws" means all data protection and privacy laws applicable to the respective party in its role in the Processing of Personal Data under the Agreement, including, where applicable, in the EU, the GDPR and its implementing regulations; in the UK, the UK GDPR and the Data Protection Act 2018; in Switzerland, the Federal Act on Data Protection ("FADP"); and in the U.S., the California Consumer Privacy Act ("CCPA"), the California Privacy Rights Act ("CPRA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Delaware Personal Data Privacy Act ("DPDPA"), the Indiana Consumer Data Protection Act ("INCDPA"), the Iowa Consumer Data Protection Act ("ICDPA"), the Kentucky Consumer Data Protection Act ("KCDPA"), the Maryland Online Data Privacy Act ("MODPA"), the Minnesota Consumer Data Privacy Act ("MNCDPA"), the Montana Consumer Data Privacy Act ("MTCDPA"), the Nebraska Data Privacy Act ("NDPA"), the New Hampshire Privacy Act ("NHPA"), the New Jersey Data Protection Act ("NJDPA"), the Oregon Consumer Privacy Act ("OCPA"), the Rhode Island Data Transparency and Privacy Protection Act ("RIDTPPA"), the Tennessee Information Protection Act ("TIPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Utah Consumer Privacy Act ("UCPA"), and the Virginia Consumer Data Protection Act ("VCDPA"), and any other data protection laws applicable to the Processing.
"Data Controller" means an entity that determines the purposes and means of the Processing of Personal Data.
"Data Processor" means an entity that processes Personal Data on behalf of a Data Controller.
"Data Subject" means a living individual who is the subject of the Personal Data.
"EEA" means, for the purposes of this DPA, the European Economic Area and/or its member states, the United Kingdom and/or Switzerland.
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation).
"Personal Data" means information that: (i) identifies or can be used to identify an individual (including, without limitation, names, signatures, addresses, telephone numbers, e-mail addresses and other unique identifiers); (ii) can be used to authenticate an individual (including, without limitation, employee identification numbers, government-issued identification numbers, passwords or PINs, financial account numbers, credit report information, biometric or health data, answers to security questions and other personal identifiers); or (iii) relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual, including inferences about such individual. In the case of subclauses (i) through (iii), this information includes, without limitation, all Sensitive Personal Data. Further, the term "Personal Information" as defined in the CCPA shall have the same meaning as Personal Data used herein.
"Processing" has the meaning given to it under applicable Data Protection Laws and "process," "processes" and "processed" will be interpreted accordingly.
"Purposes" shall mean the data Processing purposes described in Section 3.4(c) of this DPA.
"Security Incident" means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, acquisition, loss, alteration, unauthorized disclosure of or access to Controller Personal Data, but does not include any unsuccessful attempt or activity that does not compromise the security of Controller Personal Data, such as pings and other broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers).
"Services" means the services provided by Processor to Controller pursuant to the Agreement.
"Sensitive Personal Data" is a subset of Controller Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Further, the term "Sensitive Personal Information" as defined in applicable Data Protection Laws shall have the same meaning as Sensitive Personal Data used herein.
"Sell," "Selling," "Sale" or "Sold" has the meaning given in subdivision (ad)(1) of Cal. Civ. Code §1798.140.
"Service Provider" has the meaning given in subdivision (ag)(1) of Cal. Civ. Code §1798.140.
"Share" or "Sharing" has the meaning given in subdivision (ah)(1) of Cal. Civ. Code §1798.140.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.
"Sub-processor" means any Data Processor engaged by or on behalf of Processor to assist in fulfilling its obligations pursuant to the Agreement or this DPA.
"Third Party" has the meaning given in subdivision (ai) of Cal. Civ. Code §1798.140.
"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced from time to time.
"UK GDPR" means the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended.
"Verifiable Consumer Request" has the meaning given in subdivision (y) of Cal. Civ. Code §1798.140.
2. Scope and Applicability of this DPA
This DPA applies where and only to the extent that Processor Processes Controller Personal Data on behalf of Controller as Data Processor in the course of providing Services pursuant to the Agreement. Any other Processing of Personal Data with respect to Controller and its users conducted by Processor as a Data Controller, including business relationship administration and system security, will be carried out in accordance with Processor's then-current privacy policy. Notwithstanding expiry or termination of the Agreement, this DPA and the SCCs (if applicable) will remain in effect until, and will automatically expire upon, deletion of all Controller Personal Data processed by Processor as described in this DPA.
3. Roles of the Parties; Details of Processing
3.1 Role of the Parties. If and to the extent that the Services provided by Processor under the Agreement require Processor to Process Personal Data, then as between Processor and Controller, Processor shall process Controller Personal Data only as a Data Processor (and, for purposes of the CCPA, a Service Provider) acting on behalf of Controller. Controller is either the Data Controller of Controller Personal Data, or in the case that Controller is acting on behalf of a third-party Data Controller, then a Data Processor.
3.2 Controller Processing of Personal Data. Controller represents to Processor: (i) Controller will comply with its obligations under Data Protection Laws in respect of its Processing of Personal Data, including any obligations specific to its role as a Data Controller; and (ii) Controller has provided all notices and obtained all consents, assignments, licenses, authorizations, permissions and/or rights necessary under Data Protection Laws for Processor to lawfully Process Personal Data as contemplated under the Agreement for the Purposes. If Controller is itself a Data Processor acting on behalf of a third-party Data Controller, Controller further represents to Processor that Controller's instructions and actions with respect to that Controller Personal Data, including its appointment of Processor as another Data Processor, have been authorized by the relevant Data Controller.
3.3 Processor Processing of Personal Data. Processor represents and warrants it will process Controller Personal Data only to the extent, and in such a manner, as is necessary for the Purposes and in accordance with Controller's documented lawful instructions. Processor will not, and will ensure its Sub-processors do not, (i) combine Controller Personal Data with any Personal Data from other sources, or which Processor or its Sub-processor collected on its own behalf, except as permitted by Data Protection Laws; (ii) Sell or Share any Controller Personal Data within the meaning of the CCPA or otherwise; or (iii) retain, use, and/or disclose Personal Data for any purpose other than the Purposes set forth herein or outside of the direct business relationship between the Controller and Processor, unless expressly permitted by the CCPA. Additionally, Processor will comply with applicable obligations under the CCPA, including that Processor will provide the same level of privacy protection as required under the CCPA. The parties agree that the Agreement (including this DPA) sets out Controller's complete and final instructions to Processor in relation to the Processing of Controller Personal Data. Additional Processing outside the scope of such instructions will require prior written agreement between the parties.
3.4 Details of Processing. The following describes the details of the Processing to be provided by Processor to Controller under this DPA.
(a) Subject Matter. The subject matter of the Processing under this DPA is Controller Personal Data.
(b) Duration. The duration of the Processing under this DPA is the Agreement Term (as defined in the Agreement). Personal Data will only be retained for as long as required to provide the Services or as required under applicable Data Protection Laws.
(c) Business Purposes. The Purposes of the Processing under this DPA are the provision of the Services to Controller.
(d) Nature of Processing. The nature of the Processing under this DPA is the provision of computation, storage and other Services agreed to by Processor and Controller, including the capture, transcription, analysis, and summarization of conversations.
(e) Type of Data. The type of Controller Data to be Processed under this DPA includes Controller Personal Data uploaded to or captured by the Services through Controller's accounts.
(f) Categories of Data Subjects. The data subjects of the Processing under this DPA may include Controller's customers, End Users, End Users' employees and the individuals who communicate with them, suppliers, and Controller's employees.
(g) Frequency of Data Transfer. Personal Data will be transferred on a continuous basis during the Agreement Term, as conversations are captured and processed through the Services.
3.5 Notice of Processing Obligations. If, at any time, Processor determines that it cannot meet its obligations under this DPA and/or applicable Data Protection Laws: (i) Processor shall provide immediate notice to Controller; (ii) Controller may retrieve all Controller Personal Data provided under this DPA; and (iii) Processor shall properly dispose of Controller Personal Data in accordance with the retention requirements of this DPA.
3.6 De-identified and Aggregated Data. Notwithstanding anything to the contrary in this DPA, Processor may create de-identified, anonymized, and/or aggregated data from Controller Data, including Controller Personal Data ("De-identified Data"), and may use De-identified Data for its lawful business purposes, including to maintain, improve, enhance, and promote the Services and to develop and train artificial intelligence and machine learning models, in each case in accordance with Section 2.4 (Machine Learning and AI Rights) of the Agreement. De-identified Data is not Controller Personal Data for purposes of this DPA, provided that Processor: (i) takes reasonable measures to ensure that the De-identified Data cannot reasonably be associated with, or used to identify, a natural person or household; (ii) maintains and uses the De-identified Data only in de-identified form and does not attempt to re-identify it, except as permitted by applicable Data Protection Laws solely to test the effectiveness of its de-identification processes; and (iii) contractually obligates any recipients of the De-identified Data to comply with the requirements of this Section.
4. Subprocessing
4.1 Authorized Sub-processors. Controller agrees that Processor may engage Sub-processors to process Controller Personal Data on Controller's behalf. Processor shall (i) provide an up-to-date list of the Sub-processors it has appointed upon written request from Controller; and (ii) notify Controller if it adds or removes Sub-processors at least fourteen (14) days prior to allowing such Sub-processor to process Controller Personal Data. Controller may object in writing to Processor's appointment of a new Sub-processor within ten (10) calendar days of such notice. In such event, the parties will discuss such concerns in good faith with a view to achieving resolution. If Processor cannot provide an alternative Sub-processor, or the parties are not otherwise able to achieve resolution as provided in the preceding sentence, Controller may terminate the Agreement (including this DPA) upon written notice to Processor.
4.2 Sub-processor Obligations. Processor will: (i) enter into a written agreement with each Sub-processor imposing data protection terms that require the Sub-processor to Process the Controller Personal Data in a manner that is substantially similar to the standards set forth in this DPA, and, to the extent applicable to the Services provided by Processor, to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of each Sub-processor.
5. Security
5.1 Security Measures. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall implement and maintain appropriate technical and organizational security measures to protect Controller Personal Data from Security Incidents and to preserve the security and confidentiality of the Controller Personal Data Processed by Processor on behalf of Controller ("Security Measures"). Controller acknowledges that the Security Measures are subject to technical progress and development and that Processor may update or modify the Security Measures from time to time provided that such updates and modifications do not result in a material degradation of the overall security of the Services or Controller Data, including Controller Personal Data.
5.2 Confidentiality of Processing. Processor shall ensure that any person who is authorized by Processor to process Controller Personal Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality.
6. Security Reports and Audits
6.1 Reports. Processor acknowledges that Processor is regularly audited by independent third-party auditors and/or internal auditors against Processor's Security Measures. Upon request, Processor shall supply (on a confidential basis) a summary of its then-current audit report(s) and any other published materials made available by Processor, which further describe Processor's principles, programs, and practices regarding information security and privacy (collectively, "Report") to Controller, so that Controller can verify Processor's compliance with this DPA. Processor agrees to make available to Controller, upon Controller's reasonable request, any additional information necessary to verify Processor's obligations under this DPA, including via audits, with such audits to occur no more frequently than once per calendar year (except where based upon a reasonable belief that Processor has failed to comply with the terms of this DPA or applicable Data Protection Laws). Notwithstanding the foregoing, Controller may disclose a Report as allowed under the applicable confidentiality section of the Agreement, including where requested or required by data protection authorities having jurisdiction over Controller even if not legally required ("Data Protection Authority Request"), provided, however, that Controller, as permitted by law, shall give Processor prior written notice of the Data Protection Authority Request such that Processor can attempt to secure confidential treatment for the Report. If Controller is not legally permitted to give Processor prior notice, Controller agrees to use reasonable efforts to secure confidential treatment for the Report and further agrees to not remove or obscure any "confidential," "proprietary," or similar markings from the Report.
6.2 Information Requests. Processor shall also provide written responses (on a confidential basis) to all reasonable requests for information made by Controller related to its Processing of Controller Personal Data, including responses to information security and audit questionnaires that are necessary to confirm Processor's compliance with this DPA, provided that Controller shall not exercise this right more than once per year, except that this right may also be exercised in the event Controller is expressly requested or required to provide this information to a data protection authority, or Processor has experienced a Security Incident, or other reasonably similar basis.
7. Transfers
7.1 International Processing. Processor may process Controller Data anywhere in the world where Processor, its affiliates or its Sub-processors maintain data Processing operations. Processor will at all times provide appropriate safeguards for Controller Personal Data wherever it is processed, in accordance with the requirements of Data Protection Laws.
7.2 EEA, UK, and Swiss Transfers. To the extent Processor processes any Controller Personal Data protected by the Data Protection Laws of the EEA ("EEA Data") in a country that has not been recognized as providing an adequate level of protection, the parties agree that: (a) for EU and EEA data, the SCCs are incorporated by reference, with Module Two (controller to processor) applying where Controller is a Data Controller and Module Three (processor to processor) applying where Controller is a Data Processor; Controller is the "data exporter" and Processor is the "data importer" (notwithstanding that Controller may be located outside the EEA); the optional docking clause in Clause 7 does not apply; Option 2 (general written authorization) applies under Clause 9, with the notice period set out in Section 4.1 of this DPA; the optional language in Clause 11 does not apply; under Clause 17 the SCCs are governed by the law of [Ireland]; under Clause 18 disputes are resolved by the courts of [Ireland]; and Annexes I and II are completed with the information in Sections 3.4 and 5 of this DPA; (b) for UK data, the UK Addendum is incorporated by reference and completed with the information in clause (a); and (c) for Swiss data, the SCCs apply as described in clause (a), with references to the GDPR read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner acting as the competent supervisory authority.
8. Return or Deletion of Data
8.1 Deletion by Controller. Processor will enable Controller to delete Controller Data during the Agreement Term in a manner consistent with the functionality of the Services.
8.2 Deletion on Termination. For thirty (30) days following termination or expiration of the Agreement, Controller shall have the option to retrieve any remaining Controller Personal Data in accordance with the Agreement. Thereafter, Controller instructs Processor to automatically delete all remaining (if any) Controller Personal Data (including copies). Processor shall not be required to delete Controller Personal Data to the extent (i) Processor is required by applicable law or order of a governmental or regulatory body to retain some or all of the Controller Personal Data; and/or (ii) Controller Personal Data has been archived on back-up systems, which Controller Personal Data Processor shall securely isolate and protect from any further Processing, except to the extent required by applicable law.
8.3 Security Incident Response. Upon confirming a Security Incident, Processor shall: (i) notify Controller without undue delay, and in any event such notification shall occur no later than seventy-two (72) hours from Processor becoming aware of the Security Incident; (ii) provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by Controller; and (iii) promptly take reasonable steps to contain, investigate, and mitigate any Security Incident.
9. Compliance
9.1 Cooperation. In no event shall this DPA or any party restrict or limit the rights of any data subject or of any competent supervisory authority. If a law enforcement agency, government agency, or data protection authority sends Processor a demand for Controller Personal Data (e.g., a subpoena or court order), Processor will attempt to redirect the law enforcement agency, government agency, or data protection authority to request that data directly from Controller. As part of this effort, Processor may provide Controller's contact information to the law enforcement agency, government agency, or data protection authority. If compelled to disclose Controller Personal Data to a law enforcement agency, then Processor will give Controller reasonable notice of the demand to allow Controller to seek a protective order or other appropriate remedy to the extent Processor is legally permitted to do so.
9.2 Consumer Access Requests. Taking into account the nature of the Processing, Processor shall (at Controller's request and expense) provide reasonable cooperation to enable Controller to respond to any requests from applicable data protection authorities or a Verifiable Consumer Request to exercise rights (to the extent available to them under Data Protection Laws) of: access, rectification, restriction of Processing, erasure ("right to be forgotten"), data portability, objection to Processing, not to be subject to automated individual decision making, opt-out of the Sale or Sharing of Personal Data, or the right not to be discriminated against, in each case solely to the extent relating to the Processing of Controller Personal Data through the Services under the Agreement. In the event that any Verifiable Consumer Request is made directly to Processor where such request identifies Controller, Processor shall not respond to such communication directly without Controller's prior authorization, unless legally compelled to do so, and instead, after being notified by Processor, Controller shall respond to the Verifiable Consumer Request. If Processor is required to respond to such a Verifiable Consumer Request, Processor will promptly notify Controller and provide Controller with a copy of the Verifiable Consumer Request unless legally prohibited from doing so.
9.3 Records. Controller acknowledges that Processor may be required under applicable Data Protection Laws to: (a) collect and maintain records of certain information, including the name and contact details of each Data Processor and/or Data Controller on behalf of which Processor is acting and, where applicable, of such Data Processor's or Data Controller's local representative and data protection officer; and (b) make such information available to the supervisory authorities. Accordingly, if applicable Data Protection Laws apply to the Processing of Controller Personal Data, Controller will, where requested, provide such information to Processor via the Services or other means provided by Processor, and will ensure that all information provided is kept accurate and up-to-date.
9.4 Data Protection Impact Assessment. To the extent Processor is required under applicable Data Protection Laws, Processor shall (at Controller's request and expense) provide reasonably requested information regarding the Services to enable the Controller to carry out data protection impact assessments or prior consultations with data protection authorities as required by law.
10. Relationship with the Agreement
The parties agree that this DPA shall replace and supersede any existing data processing addendum, attachment or exhibit the parties may have previously entered into in connection with the Services. Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict in connection with the Processing of Controller Personal Data.
Controller's remedies and Processor's liability with respect to any breach of this DPA by Processor, its affiliates, or its Sub-processors will be subject to the aggregate limit of liability in the Agreement. Notwithstanding any other provision of this DPA, each party's aggregate liability for all claims arising out of or related to a data breach, unauthorized access to, or unauthorized disclosure of Controller Personal Data shall not exceed one million dollars ($1,000,000).
This DPA will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by applicable Data Protection Laws or the SCCs.
Processor certifies that it understands its obligations under this DPA and shall comply with them.
This DPA is executed by the parties upon execution of an Order Form referencing the Agreement, as provided in Section 13.1 of the Agreement, and is effective as of the Effective Date.