Trama Personal Data Processing Addendum

Version: 2026-10-28 · Effective date: from 28 October 2026

This Addendum forms part of the Trama Terms of Use for every Customer that is a legal entity and governs the processing of personal data between:

• Hallen Consultoria Tecnológica Ltda., CNPJ 45.106.125/0001-39, with its registered office at Rua Juscelino Kubitscheck de Oliveira, 890, Jardim Boa Vista, Barra Mansa (RJ), CEP 27350-130 ("Hallen Tech"); and
• the Customer that contracted Trama.

The Addendum applies from acceptance of the Terms of Use. The Customer may request a signed copy through the contact address contato@trama.sh. In the event of conflict on data protection, this Addendum prevails over the Terms of Use; on all other matters, the Terms prevail.

1. Definitions

The definitions of the General Data Protection Law (LGPD, Law no. 13.709/2018, art. 5) and of the Terms of Use apply. In addition:

• Customer Data: the personal data that Hallen Tech processes as processor, on the Customer's behalf, described in Annex II.
• Sub-processor: the third party engaged by Hallen Tech that processes Customer Data (Annex III).
• Incident: a security incident involving personal data, within the meaning of Resolution CD/ANPD no. 15/2024.

2. Purpose

The Addendum sets out the role of each party, the Customer's instructions, the obligations of security, confidentiality and incident notification, the sub-processors, international transfer and what happens to the data at the end of the contract (LGPD, art. 39).

3. Roles

3.1. Hallen Tech is the processor of Customer Data: the configuration and the work data that the Organisation puts on the Platform, the relaying of the Core's work to the screen, and the incoming and outgoing webhooks (Annex II).

3.2. Hallen Tech is the controller, and not the processor, of account, authentication, security, access-log, audit, billing and tax data, of the website and of data subject requests, processed for its own purposes described in the Privacy Policy. This Addendum does not apply to that data, except for clause 10.4.

3.3. The Core is not processing by Hallen Tech. The Core runs on the Customer's infrastructure, under the Customer's control. Hallen Tech supplies the software, but has no access to what the Core stores (cards, code, transcripts, conversations, attachments, credentials) and does not process that data. The Customer is its controller, and sending that content to the AI Provider, the Tracker and the Repository is processing by the Customer, under the Customer's contracts with those suppliers.

4. Customer's instructions

4.1. The Customer's documented instructions are the Terms of Use, this Addendum and the settings that the Organisation makes on the Platform (Members, roles, projects, budgets, webhooks, SSO).

4.2. Hallen Tech processes Customer Data only to provide Trama and in accordance with those instructions. If it considers that an instruction infringes the LGPD, it notifies the Customer and may stop complying with it until the matter is resolved.

4.3. Hallen Tech does not use Customer Data for its own purposes: it does not sell it, does not use it for advertising and does not use it to train AI models. It may use anonymised statistics (LGPD, art. 12) to operate and improve the service.

5. Hallen Tech's obligations as processor

Hallen Tech undertakes to:

• (a) process Customer Data with the security measures in Annex I (LGPD, art. 46);
• (b) restrict access to Customer Data to the people who need it to operate the service, under a duty of confidentiality;
• (c) keep a record of the processing operations it carries out (LGPD, art. 37);
• (d) assist the Customer, with the information it has, in responding to data subjects (clause 11), in preparing an impact assessment report (LGPD, art. 38) and in responding to the ANPD;
• (e) notify Incidents in accordance with clause 10;
• (f) engage Sub-processors only in accordance with clause 7.

6. Customer's obligations

The Customer undertakes to:

• (a) have a legal basis (LGPD, art. 7) for the personal data it puts into Trama, including that of its own clients, employees and Members, and inform the data subjects about that processing (art. 9);
• (b) not put unnecessary data on the Platform, such as an individual's name in the name of a project or of a client, where this can be avoided;
• (c) maintain the security of the Core's machine, of the credentials and of the Members' access (Terms of Use, clause 10.1);
• (d) choose and contract the AI Provider, the Tracker and the Repository and be responsible for the processing they carry out, including the international transfer to those suppliers;
• (e) respond to the data subject requests that Hallen Tech forwards concerning Core data or Customer Data, within the legal time limit, and inform Hallen Tech that it has responded;
• (f) notify the ANPD and the data subjects of incidents that occur in the Core or in its systems, where the law so requires.

7. Sub-processors

7.1. The Customer authorises Hallen Tech to use the Sub-processors in Annex III.

7.2. Hallen Tech imposes on each Sub-processor data protection obligations consistent with this Addendum and is liable to the Customer for the Sub-processor, under the LGPD.

7.3. New Sub-processor. Hallen Tech notifies the Customer 30 days in advance, by email to the owner of the Organisation and in the Privacy Policy. If the Customer has a reasonable ground related to data protection, it may object within that period. If the parties do not reach a solution, the Customer may terminate the contract at no cost and receives the amount proportional to the period paid for and not used.

8. International transfer

8.1. Customer Data is stored in Brazil, on Hallen Tech servers in São Paulo (SP).

8.2. Part of it is processed by the Sub-processors outside Brazil (Annex III). These transfers rely on the ANPD standard contractual clauses (LGPD, art. 33, II, (b); Resolution CD/ANPD no. 19/2024), incorporated into the contracts with the Sub-processors. Backups stored outside Brazil are encrypted before they leave, and the key stays with Hallen Tech.

8.3. The Customer acknowledges that the transfer of the Core's content to the AI Provider, the Tracker and the Repository is made by the Customer, as controller, and that it is for the Customer to choose the transfer mechanism.

9. Security

Hallen Tech maintains the measures in Annex I and may replace them with others of equal or greater effectiveness. Each party is responsible for the security of what is under its control: Hallen Tech for the Platform, the Customer for the Core's machine and for the credentials.

10. Incidents

10.1. Hallen Tech notifies the Customer without undue delay and within 48 (forty-eight) hours after confirming an Incident affecting Customer Data, by email to the owner of the Organisation.

10.2. The notice states, to the extent known: the nature of the Incident; the data and the data subjects affected; the measures taken and those recommended; and a contact. Any missing information is sent as soon as it becomes known.

10.3. The Customer, as controller, decides on notification to the ANPD and to the data subjects of the Customer Data (LGPD, art. 48; Resolution 15/2024). Hallen Tech cooperates with whatever it has.

10.4. In Incidents involving data of which Hallen Tech is the controller, Hallen Tech itself notifies the ANPD and the data subjects, and informs the Customer where the Incident may affect it.

10.5. Hallen Tech keeps a record of Incidents, including those that are not notified, for the period required by Resolution 15/2024.

11. Data subjects' rights

11.1. If Hallen Tech receives a request from a data subject concerning Customer Data or Core data, it forwards the request to the Customer within 5 (five) business days, informs the data subject of the forwarding and does not respond on the merits on the Customer's behalf, unless instructed by the Customer.

11.2. Hallen Tech gives the Customer the tools and the information available to it so that the Customer can respond to data subjects (export and deletion in the panel, and the data stored on the Platform, on request).

12. Information and audit

12.1. Hallen Tech provides the Customer, on request and no more than once a year (or after an Incident), with the information necessary to demonstrate compliance with this Addendum: answers to security questionnaires, the description of the measures in Annex I and the up-to-date list of Sub-processors.

12.2. Any audit beyond that, including by an independent third party under a duty of confidentiality, requires prior agreement on the scope, the date and the cost, which is borne by the Customer. The ANPD may audit at any time, under the law.

13. End of the contract: return and deletion

13.1. During the contract and for up to 30 days after it ends, the Customer may request a copy of the Customer Data stored on the Platform, in a structured format, which Hallen Tech sends within 30 days.

13.2. Once the Organisation is closed at the Customer's request, Hallen Tech deletes the Customer Data within the periods set in the Privacy Policy. The encrypted backups expire within 30 days.

13.3. Hallen Tech may keep what the law requires (LGPD, art. 16), such as tax records and access logs, and anonymised records.

13.4. The Core data remains with the Customer, on the Customer's machine. Deleting it is the Customer's decision.

14. Liability

14.1. Each party is liable for the damage it causes by breaching the LGPD or this Addendum, under arts. 42 to 45 of the LGPD. Hallen Tech, as processor, is jointly and severally liable where it breaches the law or the Customer's lawful instructions (art. 42, § 1, I).

14.2. Between the parties, the limitation and the exceptions in section 18 of the Terms of Use apply. The limitation does not apply as against data subjects, nor to damage caused by wilful misconduct or gross negligence.

15. Term and jurisdiction

15.1. This Addendum remains in force for as long as Hallen Tech processes Customer Data, including after the end of the contract, until that data is deleted.

15.2. This Addendum is governed by Brazilian law. The courts of the judicial district (Comarca) of Barra Mansa (RJ) are elected as the forum.

---

Annex I — Security measures

• Location: the Platform runs on Hallen Tech's own servers in São Paulo (SP).
• Access: restricted to the Hallen Tech people who need it, with individual credentials.
• Secrets: passwords with a scrypt hash; invitation, access-link and reset tokens and the Cores' connection credentials stored only as a hash.
• Encryption at rest: boleto payer data and refund bank details (AES-256-GCM), second-factor seed, SSO and webhook secrets.
• Customer credentials: encrypted in the browser to the Core's key; the Platform cannot open them.
• No Core content on the Platform: an automated check rejects the database schema if it gains a column for the content of cards, prompts, transcripts, code or credentials. Relaying to the screen is done in memory, without storing.
• Signed decisions on the Core's machine: each signature is valid once, for five minutes; Hallen Tech cannot approve anything on the Customer's behalf.
• Authentication: second factor available, SSO (OIDC or SAML) per Organisation, sessions with an expiry that can be ended, limit on attempts.
• Logs: immutable audit trail in the database (only anonymisation is permitted); logs with no free text and no payment data.
• Backups: encrypted with age before leaving the server, kept for 30 days on Cloudflare R2; the key that opens them is kept off the server and outside the storage account. Production backups are not restored in a test environment, except in restore drills, in an isolated environment deleted afterwards.
• Browser: security headers; the panel uses no third-party analytics tool.
• Retention: each table has a period declared in the schema, and daily routines enforce it.

Annex II — Description of the processing as processor

Annex III — Sub-processors

PostHog, Google and GitLab are not Sub-processors of Customer Data: PostHog only measures visits to the website, and Google and GitLab act as login providers chosen by the user.