Data Processing Agreement
The processor terms that apply when we handle your customers’ data.
Effective September 7, 2026 · Amended September 11, 2026
This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Terms of Service between TechMaven LLC ("TechMaven," "Processor," "we," "us," or "our") and the customer identified in the applicable Order ("Customer," "Controller," or "you"), and applies to the extent TechMaven processes Customer Data on Customer's behalf in connection with the TechMaven AI platform (the "Services"). Capitalized terms not defined in this DPA have the meaning given in the Terms of Service or, where applicable, in the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the UK GDPR, or the California Consumer Privacy Act, as amended ("CCPA"), as the context requires.
1. Roles of the Parties
As between the parties, Customer is the controller (or "business" under the CCPA) of Customer Data, and TechMaven is the processor (or "service provider" or "processor" under applicable state law) acting on Customer's documented instructions. This DPA does not apply to Account Data, for which TechMaven acts as an independent controller under the Privacy Policy.
2. Subject Matter and Duration
The subject matter of this DPA is TechMaven's processing of Customer Data to provide the Services. This DPA takes effect on the effective date of the Terms of Service and continues for as long as TechMaven processes Customer Data on Customer's behalf, notwithstanding termination of the Terms of Service, until such Customer Data is deleted or returned in accordance with Section 10.
3. Nature and Purpose of Processing; Categories of Data and Data Subjects
TechMaven processes Customer Data to operate the AI Employee(s) Customer configures, including receiving and responding to End User communications, scheduling appointments, updating connected records, and providing related hosting, storage, and support functions. The categories of data subjects are Customer's End Users and, where applicable, Customer's own personnel who interact with the Services. The categories of personal data processed depend on Customer's configuration and may include an End User's name, contact details, appointment and scheduling information, conversation content, and documents uploaded during a conversation. Customer is responsible for ensuring that the categories of personal data it configures an AI Employee to collect are proportionate to its stated purpose and that it does not instruct TechMaven to process special categories of personal data except to the extent Customer has confirmed appropriate safeguards with TechMaven in writing.
4. Customer Instructions
TechMaven will process Customer Data only on Customer's documented instructions, including those given through Customer's configuration of the Services and this DPA, unless required to do otherwise by applicable law, in which case TechMaven will inform Customer of that legal requirement before processing, unless the law prohibits such notice. TechMaven will inform Customer if, in its reasonable opinion, an instruction infringes applicable data protection law.
5. Confidentiality
TechMaven will ensure that personnel authorized to process Customer Data are subject to a duty of confidentiality, whether contractual or statutory, and that access is limited to what is necessary to provide the Services.
6. Security Measures
TechMaven will implement appropriate technical and organizational measures to protect Customer Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, including tenant-level data isolation enforced at the database layer, encryption of data in transit, role-based access controls, and append-only audit logging of access to and actions taken on Customer Data within the Services, including any access by TechMaven personnel. Customer is responsible for configuring the Services, including retention, access permissions, and integration settings, in a manner consistent with its own security obligations.
7. Subprocessors
Customer authorizes TechMaven to engage the Subprocessors listed at https://www.techmavs.com/legal/subprocessors as of the effective date of this DPA. TechMaven will provide notice through that page, or by email, before engaging a new Subprocessor, and Customer may object on reasonable data-protection grounds by writing to support@techmavs.com within fourteen (14) days of notice; if the parties cannot resolve the objection, Customer may terminate the affected Service as its sole remedy. TechMaven will impose data protection obligations on each Subprocessor that are substantially equivalent to those in this DPA and will remain liable for each Subprocessor's performance of those obligations.
8. Assistance with Data Subject Rights
Taking into account the nature of the processing, TechMaven will provide reasonable assistance to Customer, through the features of the Services or otherwise, to enable Customer to respond to a request from an End User to exercise its rights under applicable data protection law, including access, correction, deletion, restriction, and portability requests. If TechMaven receives such a request directly from an End User, TechMaven will not respond to it directly, other than to direct the End User to Customer, unless legally required to do otherwise, and will promptly notify Customer of the request.
9. Personal Data Breach Notification
TechMaven will notify Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware, after confirming a personal data breach affecting Customer Data, and will provide the information reasonably available to it regarding the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach, and will cooperate reasonably with Customer's own notification obligations.
10. Deletion or Return of Data
On termination of the Services, or earlier on Customer's written request, TechMaven will provide Customer Data to Customer in a commonly used machine-readable format within thirty (30) days of a verified request made within thirty (30) days of termination, and will thereafter delete Customer Data in accordance with the Terms of Service, except to the extent applicable law requires retention of specific data, in which case TechMaven will isolate and protect that data from further processing.
11. International Transfers
Where TechMaven or a Subprocessor transfers Customer Data originating in the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of protection, the transfer will be made subject to the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor, or Module 3: Processor to Processor, as applicable) or the UK International Data Transfer Addendum, which are incorporated into this DPA by reference and will apply to the extent required by applicable law.
12. Audit Rights
TechMaven will make available to Customer, on reasonable written request and no more than once per year absent a security incident or regulatory requirement, information reasonably necessary to demonstrate compliance with this DPA, which may include responding to a written questionnaire in lieu of an on-site audit. Any on-site audit will be conducted during business hours, on reasonable notice, subject to confidentiality obligations, and at Customer's expense.
13. Liability
Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in Section 21 of the Terms of Service.
14. Order of Precedence
In the event of a conflict between this DPA and the Terms of Service with respect to the processing of Customer Data, this DPA controls. In the event of a conflict between this DPA and the Standard Contractual Clauses incorporated under Section 11, the Standard Contractual Clauses control.
15. Contact
Questions about this DPA should be directed to support@techmavs.com. TechMaven LLC, 8 The Grn Ste A, Dover, DE 19901, United States.