Legal
Data Processing Addendum
Where Trenvo Media processes personal data on your behalf — running your ad accounts, handling conversion data, working inside your analytics — you are the controller and we are the processor. A signed DPA governs that relationship. This page states the operational position it will reflect.
What is already true
We process only on your documented instructions
The scope of an engagement is the instruction. We do not repurpose data from one client for another, and we do not use your data to build anything of our own.
Least data, not most
We ask for the minimum access that lets the work be done. Read access where read access is enough.
Personal data is not put into generative AI tools
Customer records, email lists and anything identifying an individual stay out of them entirely. Where a tool offers a training opt-out, it is switched off before the tool touches client work.
Sub-processors are named, not implied
Any platform or tool that will handle your data in the course of an engagement is named in the DPA before the engagement starts, and you are told before one changes.
Access ends when the engagement does
Account access is handed back or revoked at the end of an engagement. Because the accounts are yours and in your name, this is a permission change rather than a migration.
We assist with data subject requests
If a request reaches you that concerns data we process on your behalf, we help you answer it rather than telling you it is your problem.
What is still with counsel
Still to be completed with counsel: the executable DPA itself, including the full sub-processor schedule, the technical and organisational measures annex, the international transfer mechanism and its standard contractual clauses, and breach notification timelines.
For any question about data we hold, or to ask for the current draft of this document, write to hello@trenvomedia.com and a person will answer it.
See also our AI policy, which covers how AI is used in production and what happens to data around it.