creavio DATA PROCESSING ADDENDUM
Last Updated: October 12, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between creavio, Inc. ("Processor," "we," "us") and the Creator ("Controller," "you") and governs the processing of personal data by creavio on your behalf.
1. DEFINITIONS
1.1. "Personal Data" means any information relating to an identified or identifiable natural person processed through the Platform on your behalf.
1.2. "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.
1.3. "Data Subject" means any identified or identifiable natural person whose Personal Data is processed (your clients, contacts, and leads).
1.4. "Sub-processor" means any third party engaged by creavio to process Personal Data on your behalf.
2. ROLES & SCOPE
2.1. You are the Data Controller for all client data you store on the Platform (client names, emails, phone numbers, addresses, photos, contracts, invoices, booking details, and any other information you upload or collect through forms).
2.2. creavio is the Data Processor, processing your client data only as necessary to provide the Platform services and as instructed by you.
2.3. creavio is the Data Controller for its own operational data (your account information, billing data, usage analytics, and support communications).
2.4. Agency-Tier (On-Behalf-Of) Processing. Where you operate creavio under the Agency tier to manage workspaces on behalf of third-party brands or businesses ("Brands"), you act as the Data Controller (or as the Brand's processor authorized to engage creavio) for that Brand's data and the personal data of the Brand's customers and contacts, and creavio acts as your Processor or sub-processor for that data, processing it only on your documented instructions. References to "you," "Creator," and "Controller" in this DPA include the Agency for such processing. You are responsible for the lawful basis, notices, and consents required for processing each Brand's data, and you represent that you are authorized by each Brand to engage creavio to process it. Each managed workspace is data-isolated from every other workspace. The Agency Services Addendum (creav.io/legal/agency-terms) governs the broader Agency relationship.
3. PROCESSING INSTRUCTIONS
3.1. creavio will process Personal Data only on your documented instructions, which include: hosting and displaying client data, sending emails on your behalf, processing payments, generating contracts and invoices, and any other Platform features you activate.
3.2. creavio will not process Personal Data for any purpose other than providing the Platform services, unless required by law.
3.3. If creavio is required by law to process Personal Data beyond your instructions, we will notify you before such processing unless legally prohibited from doing so.
4. SECURITY MEASURES
4.1. creavio implements appropriate technical and organizational measures to protect Personal Data, including:
(a) Encryption in transit (TLS 1.2+) and at rest;
(b) Tenant data isolation (all queries scoped to your tenant ID);
(c) Password hashing with PBKDF2 (100,000 iterations);
(d) AES-256-GCM encryption for sensitive data (contract signatures);
(e) Role-based access controls;
(f) Regular security monitoring and logging;
(g) Secure file storage with access controls (Cloudflare R2).
5. SUB-PROCESSORS
5.1. General Authorisation by Category. You provide creavio with a general written authorisation, under Article 28(2) of the GDPR, to engage sub-processors within the following categories to process Personal Data on your behalf:
(a) Cloud infrastructure and hosting;
(b) Payment processing;
(c) Email and SMS and MMS delivery;
(d) AI processing under enterprise or API terms that prohibit training on Personal Data;
(e) Search and SEO data (aggregate, non-personal);
(f) Media processing (image, print, and video);
(g) Analytics; and
(h) Plagiarism search and AI-written-text detection for creavio write, used only when a user selects text and clicks Check, and only for the checks the user picks, subject to Section 5.4.
A current, itemized list of the specific sub-processors engaged within these categories, including each sub-processor's name, location, and processing purpose, is available to you on request by contacting
[email protected].
5.2. Notice and Right to Object. creavio will notify you of any intended addition or replacement of a sub-processor at least 30 days before that sub-processor begins processing Personal Data. You may object to a proposed sub-processor on reasonable data-protection grounds by contacting
[email protected] within that 30-day period, and the parties will work in good faith to resolve the objection.
5.3. creavio ensures all sub-processors are bound by written data protection obligations no less protective than those in this DPA, except as stated in Section 5.4.
5.4. Copyscape (Indigo Stream Technologies Ltd.) is creavio's only sub-processor for plagiarism search and AI-written-text detection in creavio write. It provides its service to creavio on its standard terms. Copyscape's privacy policy says that search terms will be used only to run automated plagiarism searches on behalf of its customer, here creavio, and will not be given or sold to third parties. That policy speaks of plagiarism searches; for the AI-written-text check, creavio relies only on Copyscape's written statement described next. Copyscape told creavio in writing on October 10, 2026 that it deletes submitted text after 14 days, that Copyscape staff can access the text during those 14 days, does not use it to improve its service or train algorithms, and does not add it to any index used to check other users' text. For the plagiarism check, Copyscape says it uses Google as a search provider; Copyscape has not told creavio exactly what it sends to Google or what Google keeps. Copyscape has not agreed to the other terms of this DPA, such as breach notice, audit, and deletion on request, and has not told creavio in which countries it processes checked text. creavio does not screen or block Personal Data in the text a user selects: whatever text is selected and checked is sent to Copyscape. You must not run the plagiarism check or the AI-written-text check on text that contains Personal Data. You may object to this sub-processor by contacting
[email protected]; until your objection is resolved, do not use either check.
6. DATA SUBJECT REQUESTS
6.1. If creavio receives a request from a Data Subject regarding Personal Data you control, we will promptly notify you and will not respond directly unless legally required.
6.2. creavio will provide reasonable assistance to help you respond to Data Subject requests (access, rectification, erasure, portability, restriction, or objection).
6.3. You can fulfill most Data Subject requests directly through the Platform (export data, delete clients, update records).
7. DATA BREACH NOTIFICATION
7.1. creavio will notify you without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data breach affecting your client data.
7.2. Notification will include: nature of the breach, categories and approximate number of affected Data Subjects, likely consequences, and measures taken or proposed to address the breach.
7.3. creavio will cooperate with you and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.
8. DATA RETURN & DELETION
8.1. Upon termination of your account, you may export your data within 30 days using the Platform's data export feature.
8.2. After the 30-day period, creavio will delete all Personal Data processed on your behalf, except where retention is required by law (e.g., payment records retained for 7 years).
8.3. creavio will purge Personal Data from backups within 30 days of the deletion date.
9. INTERNATIONAL TRANSFERS
9.1. Except as stated in Section 9.3, Personal Data may be transferred to and processed in the United States and other countries where Cloudflare operates infrastructure.
9.2. Except as stated in Section 9.3, for transfers from the EEA or UK, creavio relies on Standard Contractual Clauses as approved by the European Commission.
9.3. Copyscape exception. Text sent to the plagiarism check or the AI-written-text check in creavio write goes to Copyscape (Section 5.4). Copyscape has not told creavio in which countries it processes that text. Copyscape's terms are governed by the laws of Gibraltar; that is a choice of law, not a statement of where the text is processed. creavio has no Standard Contractual Clauses or other transfer mechanism with Copyscape, so Sections 9.1 and 9.2 do not cover that text. For a transfer of that text from the EEA or the United Kingdom, we rely on your explicit consent, given when you tick Allow originality checks (GDPR Article 49(1)(a)), after you are shown these words: "It has not told us which countries it processes text in. If that is outside the US, the EU or the UK, there may be no legal finding that the country protects data adequately and no contract safeguards for your text." Your instruction under Section 5.4 not to run either check on text that contains Personal Data applies, and creavio does not screen or block Personal Data in that text.
10. AUDIT RIGHTS
10.1. creavio will make available to you, upon reasonable request, information necessary to demonstrate compliance with this DPA.
10.2. You may conduct an audit, or engage a third-party auditor, to verify creavio's compliance. Audits shall be conducted with reasonable notice, during business hours, and no more than once per year.
10.3. creavio may satisfy audit requests by providing relevant certifications, audit reports, or documentation.
11. TERM & TERMINATION
11.1. This DPA remains in effect for the duration of your use of the Platform and for as long as creavio processes Personal Data on your behalf.
11.2. The obligations in Sections 7, 8, and 10 survive termination.
12. GOVERNING LAW
This DPA is governed by the same governing law as the Terms of Service (Commonwealth of Virginia).