# Data Processing Addendum Controller–processor terms and customer-specific schedules for business processing. ## 1. Publication and application This V1 DPA is a contractual addendum that applies only when incorporated into an agreement between the actual parties with the required processing schedules completed. Publication does not execute a customer DPA or certify compliance. The applicable agreement and schedules must cover the processing before processor access to covered data. A completed DPA cannot cure processing that is unlawful in practice. “Customer” is the party instructing covered processing. “Tessen” is the provider identified in the completed agreement. “Customer Personal Data” means personal data processed by Tessen on Customer’s documented instructions to provide contracted Services. Data processed by Tessen for genuinely independent controller purposes must be separately identified and transparently governed. ## 2. Definitions and roles “Applicable Data Protection Law” means the law actually applicable to the covered processing. “Controller,” “processor,” “personal data,” “processing,” “data subject,” “subprocessor” and “personal data breach” have their relevant statutory meanings. A security event is not automatically a confirmed personal data breach. Customer may be a controller or a processor authorized by an upstream controller. If Customer is a processor, it warrants sufficient authority to appoint Tessen and issue the instructions in this DPA. Tessen acts as processor or subprocessor only within the documented scope. Customer and Tessen roles depend on who determines the purposes and means of the actual processing. Tessen acts as processor or subprocessor only within documented customer instructions and an applicable executed DPA; an upstream processor must have authority to appoint Tessen. ## 3. Subject matter, duration and instructions The subject matter is providing the contracted intelligence, storage, connected-tool and execution functions selected in the order and Schedule A. Processing continues for the contractual service period and any agreed return/deletion period, subject to lawful retention. Nature and purposes include receiving, storing, organizing, retrieving, transforming and transmitting Customer Personal Data to carry out authorized tasks. Documented instructions include the executed agreement, agreed configuration, authorized user actions and lawful written directions within scope. Tessen shall process covered data only on those instructions unless applicable law requires otherwise. Where legally permitted, Tessen shall inform Customer of that legal requirement before processing. If an instruction appears to infringe applicable data-protection law, Tessen shall inform Customer and address the issue before continuing the affected activity. ## 4. Customer responsibilities Customer shall establish a lawful basis, give required notices, obtain necessary consents or authority and minimize submitted data. It shall configure user access, connected-service permissions and retention options within available controls. It shall not instruct prohibited processing or submit data outside the agreed scope without assessment and agreement. Customer shall communicate relevant restrictions, rights requests and processing changes to Tessen. Customer remains responsible for its own systems and independent recipients. These responsibilities do not relieve Tessen of processor duties or obligations it accepts in this DPA. ## 5. Confidentiality and authorized personnel Tessen shall limit access to personnel who require it to perform authorized processing and are subject to confidentiality obligations or appropriate statutory duties. It shall maintain access governance appropriate to the risk and remove unnecessary access. Personnel shall be instructed on the applicable confidentiality and handling requirements. An authorization to process data is not permission to use it for an unrelated purpose or disclose it to another customer. Support and debugging access must be scoped and documented consistently with the agreed security measures. Confidentiality continues for retained covered data after termination. ## 6. Technical and organizational measures Tessen shall implement appropriate measures identified in completed Schedule B, taking account of risks, data sensitivity, processing context and the requirements of applicable law. Measures should address identity, access control, credential handling, segregation, transmission/storage protections where applicable, resilience, change management, incident response and deletion. The reviewed service uses scoped authenticated access, host-only Secure HttpOnly Web session cookies, separate session-credential encryption, encrypted secret bindings, and configured database backups/PITR. These evidenced controls do not establish a compliance certification, blanket zero-access architecture or a complete security schedule. Listing a control category does not establish that every measure in that category is implemented, certified or sufficient. Material changes must not reduce agreed protection in breach of applicable law or the agreement and should be disclosed where required. ## 7. Subprocessors Tessen may engage a subprocessor only under the agreed authorization mechanism. It shall conduct appropriate diligence and impose written obligations that provide the protection required by applicable law for the delegated processing. Tessen remains responsible for subprocessor obligations to the extent required by law and the executed agreement. The public provider disclosure records evidenced service use and expressly identifies unverified contractual roles and locations. It is not the completed subprocessor authorization list for a customer DPA. For covered processing under an executed DPA, the applicable customer-specific list must identify the authorized providers, legal names, functions, processing locations and other required information. Only the subprocessors authorized under that DPA may process its covered customer data. Proposed changes follow the agreed notice, objection and resolution procedure. A legitimate objection should be assessed in good faith, with a lawful solution agreed before disputed processing continues. User-selected independent services require separate role analysis. ## 8. Assistance with individual rights Taking account of the nature of processing, Tessen shall assist Customer through appropriate technical and organizational measures in responding to requests to exercise data-subject rights. If Tessen receives a request concerning Customer Personal Data directly, it shall promptly route it to Customer or direct the person appropriately unless law requires otherwise. Tessen shall not independently decide Customer’s response without authorization except where legally required. Customer must provide enough information for safe identification and scope. Verification should be proportionate and protect unrelated data. The assistance process and any reasonable separately agreed charges must not obstruct statutory rights. ## 9. Personal data breaches Tessen shall notify Customer without undue delay after becoming aware of a personal data breach affecting covered data, as required by applicable law. Notice shall provide available information about the nature of the breach, affected categories and approximate scope, likely consequences, measures taken/proposed and a suitable contact. Information may be provided in stages where it is not immediately available. Tessen shall take reasonable steps within its control to contain and address the breach and assist Customer with applicable notification duties. Customer determines its regulatory and individual notices as controller unless law or a separate allocation requires otherwise. Security incidents concerning covered customer data are routed through the monitored operational incident channel designated in the applicable agreement. Notifications describe the known incident and are updated as information becomes available, subject to applicable law. No shorter numerical SLA, reimbursement commitment or insurance coverage is assumed. ## 10. Assessments and regulator cooperation Tessen shall provide reasonable assistance with legally required impact assessments and prior consultation, considering its processing role and available information. It shall cooperate with competent authorities to the extent required by applicable law and notify Customer of relevant requests where legally permitted. Customer should identify the use case, risks and required evidence, and must not represent that Tessen has approved a regulated deployment merely by providing documentation. Assistance is limited to matters within Tessen’s knowledge and control without diminishing statutory processor duties. ## 11. Demonstration, information and audit Tessen shall make available information necessary to demonstrate compliance with applicable processor obligations and allow/contribute to audits, including inspections, as legally required. The parties should agree practical arrangements to protect confidentiality, security and other customers while preserving effective verification. Existing independent evidence may be used where suitable but cannot replace an audit right that law requires. Audits use proportionate evidence and access controls while preserving legally required regulator and customer rights. Confidentiality arrangements do not remove mandatory access. No certification or report is asserted to exist, and no procedure may exclude legally mandated access. ## 12. Transfers and location restrictions Covered international transfers shall occur only with a lawful mechanism and required safeguards. The applicable instrument must match the real parties, roles, data flows and countries. Onward transfers and remote access should be considered, not just the primary storage location. Transfers of covered customer data require the appropriate instrument for the actual parties, roles, destinations and law, with completed annexes and necessary supplementary measures. An incomplete DPA does not execute SCCs or promise residency. This DPA does not purport to execute standard contractual clauses by reference to an incomplete schedule or guarantee data residency. A binding location restriction must be explicitly agreed and operationally supportable. ## 13. Return, deletion and end of processing On termination of covered Services, Customer shall choose return or deletion as provided by applicable law and the agreed process. Tessen shall delete existing copies unless law requires retention, explaining the legal basis and protecting retained data against unrelated processing. Backup deletion must follow a completed, disclosed process consistent with the obligation. At the end of covered processing, the customer’s agreed return/deletion instructions apply subject to mandatory retention. Backup and vendor deletion are handled under the approved schedule; deletion confirmation describes its verified scope and exceptions. No invented retention period applies. A legal hold must be scoped and reassessed; it does not justify unrestricted retention of all customer data. Tessen shall continue required confidentiality and security duties for retained covered data. ## 14. Liability, precedence and completion Liability follows the executed underlying agreement except to the extent mandatory law or a valid transfer instrument provides otherwise. Any contractual restriction must not impair rights of data subjects or regulators. The DPA controls conflicts concerning its processing subject matter; mandatory transfer clauses take precedence where required. The DPA supplements the applicable customer agreement and takes precedence for its stated data-protection subject matter, subject to mandatory law. It becomes operative only through the applicable execution process with completed schedules. Completion requires the actual parties and contacts, Schedule A, Schedule B, authorized subprocessors and necessary transfer documentation. Publication of these standard terms does not replace that customer-specific agreement process. ## Schedule A. Processing particulars Products: the contracted features identified in the order, rather than every planned Tessen capability. Data subjects: authorized users and individuals whose information Customer lawfully submits, which may include personnel, customers, contacts and collaborators. Data categories: account-linked content, conversations, documents, repository context, files, connected-source data and authorized task results, as actually enabled. Sensitive or special-category data is not automatically within scope. The deployment’s processing schedule identifies the actual data subjects, data categories, purposes, operations, frequency, duration, controller contacts and any restrictions on sensitive or special-category data. General product capability does not by itself authorize those categories. Describe these particulars before processing, including customer-side restrictions and any shared-controller scenario requiring another arrangement. ## Schedule B. Security and service responsibility record The completed record must identify measures, responsible party, evidence and limitations for access control, confidentiality, encryption where used, tenancy separation, logging, resilience, restoration, vulnerability handling, incident response, personnel safeguards, physical/provider protections and deletion. It should distinguish customer configuration from Tessen and provider duties. The deployment security schedule identifies implemented controls, responsible parties, evidence and exceptions for the contracted environment. It is approved by the technical owner and incorporated into the executed agreement. Aspirational control names are not contractual evidence. Consult the [Subprocessor Register](/legal/subprocessors), [Privacy Notice](/legal/privacy) and [Business Terms](/legal/business-terms) when completing this schedule.