Trilot LLC ("Processor") and [Client Name] ("Controller") enter into this Data Processing Addendum ("DPA") in connection with the Engagement Letter dated [date] between the parties (the "Engagement Letter").
This DPA forms part of the Engagement Letter. In case of conflict between this DPA and the Engagement Letter on a data-protection matter, this DPA controls.
1. Definitions
"Applicable Data Protection Law" means the GDPR, UK GDPR, EU member-state implementing laws, the Swiss Federal Act on Data Protection, and any other data-protection law applicable to the processing under this DPA.
2. Roles
Trilot acts as Processor only — it does not determine the purposes or essential means of processing Client Personal Data. Where Trilot processes personal data for its own purposes (for example, its own newsletter subscribers), it does so as a Controller and the Trilot Privacy Policy applies, not this DPA.
3. Trilot’s obligations
Clauses (a)–(j) of this section are set out in full in the downloadable DPA PDF.
4. Controller’s obligations
Clauses (a)–(c) of this section are set out in full in the downloadable DPA PDF.
5. Sub-processors
The clause text of this section is set out in full in the downloadable DPA PDF.
6. International transfers
Clauses (a)–(d) of this section are set out in full in the downloadable DPA PDF.
7. Liability
The clause text of this section is set out in full in the downloadable DPA PDF.
8. Term
The clause text of this section is set out in full in the downloadable DPA PDF.
9. Order of precedence
In the event of any conflict, the order of precedence is: (a) the SCCs and any other transfer mechanisms required by Applicable Data Protection Law; (b) this DPA; (c) the Engagement Letter; (d) the Trilot Terms of Service.
Annex A — Details of processing
The annex text is set out in full in the downloadable DPA PDF.
Annex B — Special category data and criminal-conviction data
The annex text is set out in full in the downloadable DPA PDF.
Annex C — Technical and organizational measures
The annex text is set out in full in the downloadable DPA PDF.
Annex D — Approved Sub-processors
| Sub-processor | Role | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, DNS, security | US, global edge | DPF + SCCs |
| GitHub, Inc. (Microsoft) | Source-code hosting | US | DPF + SCCs |
| Google LLC (Workspace) | Email and productivity | US | DPF + SCCs |
| Resend, Inc. | Transactional email | US | DPF + SCCs |
| MailerLite (UAB Mailerlite) | Newsletter sending | EU / US | SCCs |
| Cal.com, Inc. | Calendar booking | US | DPF + SCCs |
| AWS (via Resend / select integrations) | Underlying infrastructure for some Sub-processors | US, global | DPF + SCCs |
(Additional Sub-processors may be engaged as needed and notified to the Controller per clause 5.)
Need this DPA for an engagement?
Email legal@trilot.com or rami@trilot.com.