Last updated Mar 19, 2026

This Data Processing Addendum (“DPA”) describes the default data protection terms that apply when TKO SOLUTIONS L.L.C (doing business as “Trac”) processes personal data on behalf of a customer in connection with the Services.

This page is provided for transparency and summary purposes. Binding legal terms are established by your signed master agreement, order form, or negotiated DPA. If there is any conflict, the signed agreement controls.

Scope and applicability#

This DPA applies when:

  • Customer personal data is submitted to or through the Services, and
  • Trac processes that data on behalf of a customer acting as controller (or processor, as applicable under law).

Roles of the parties#

  • Customer is the controller (or business) for customer personal data, unless otherwise stated in a signed agreement.
  • Trac is the processor (or service provider/contractor) for that data, processing it only under documented instructions from Customer, this DPA, and applicable law.

Each party is independently responsible for compliance with obligations that apply directly to it under applicable privacy law.

Subject matter and duration of processing#

  • Subject matter: Provision, support, security, and improvement of the Services.
  • Duration: For the term of the applicable services agreement, plus any post-termination period needed for secure deletion, legal compliance, and backup lifecycle management.

Nature and purpose of processing#

Trac processes customer personal data to:

  • Host and provide the Services.
  • Authenticate users and manage access controls.
  • Support account operations and customer support.
  • Maintain security, logging, and abuse prevention.
  • Monitor reliability and improve service quality.

Categories of data subjects and personal data#

Depending on customer configuration and use, customer personal data may include:

  • Data subjects: customer personnel, end users, counterparties, and other persons represented in uploaded records.
  • Personal data: identifiers, contact information, account metadata, transaction and portfolio records, communications, and usage/security telemetry.

Customers are responsible for determining whether specific fields constitute special categories or sensitive personal data under applicable law.

Customer instructions#

Customer instructs Trac to process customer personal data only:

  • To provide the Services as configured by Customer.
  • As necessary to meet security, legal, and operational obligations.
  • As otherwise documented in customer support requests and settings.

Trac will notify Customer if, in Trac’s opinion, an instruction violates applicable data protection law, unless prohibited by law from doing so.

Confidentiality and personnel access#

Trac ensures that personnel with access to customer personal data are bound by confidentiality obligations and have access only on a need-to-know basis.

Security measures#

Trac maintains technical and organizational measures designed to protect customer personal data, including:

  • Access controls and authentication safeguards.
  • Encryption in transit and at rest where appropriate.
  • Logging and monitoring for security events.
  • Vulnerability and patch management practices.
  • Backup, recovery, and resilience controls.

Security measures may evolve with industry standards and the risk profile of the Services.

Subprocessors#

Customer authorizes Trac to engage subprocessors to support service delivery. Trac remains responsible for subprocessor performance in accordance with applicable law and contractual obligations.

Current subprocessors and purposes are listed on the Subprocessors page.

International data transfers#

When customer personal data is transferred across borders, Trac uses transfer mechanisms required by applicable law, which may include standard contractual clauses, adequacy decisions, and supplementary safeguards.

Assistance with data subject rights and compliance#

Taking into account the nature of processing, Trac provides reasonable assistance to Customer for:

  • Data subject access, correction, deletion, and objection requests.
  • Security incident notification obligations.
  • Data protection impact assessments and regulator consultations where required.

Security incidents#

If Trac confirms a security incident affecting customer personal data, Trac will notify Customer without undue delay and provide available information reasonably required to support Customer’s legal obligations.

Additional process details are described in Incident Response and Breach Notice.

Audits and information requests#

Where required by applicable law or contract, Trac may provide information reasonably necessary to demonstrate compliance, subject to confidentiality, security, and scope limitations.

Deletion and return of data#

Upon termination or expiry of the Services, Trac will delete or return customer personal data in accordance with the services agreement and applicable law, except where retention is required or permitted by law.

Contact#

For DPA questions, contact legal@trac.bot.