# TAVONEL processing addendum

Version: 2026-09-30. This addendum becomes part of the self-service agreement when your workspace owner explicitly accepts it. Acceptance records the version and document hash; it is not a certification or a claim of independent legal review.

## Parties, scope and instructions

The customer controls the material it submits and is the controller of personal data contained in it. TAVONEL, identified in the service operator disclosure at https://tavonel.com/terms, acts as processor for that material. TAVONEL separately controls account, security, support and billing information as described at https://tavonel.com/privacy.

Your documented instructions are this agreement, your selected processing scope, the files and connections you submit, and verified requests made through the service or support. Direct file upload and connection to a third-party source are separate permissions. Accepting one does not authorize the other. A processing permission is limited to the workspace identified in its receipt.

The purpose is to deliver and secure the document-processing, compilation, retrieval and export services you request. Operations include receipt, scanning, sanitization, OCR, extraction, organization, linking, storage, retrieval, export and deletion. Source content and its derived text, tables, citations and knowledge artifacts may be processed. Personal data, if present within the permitted scope, concerns the individuals described in the customer's business documents; the customer determines those data subjects and categories.

Processing lasts while the service is provided and while necessary to complete an authorized return, deletion or applicable retention obligation. TAVONEL does not use customer document contents to train shared models and does not sell personal data. It will notify the customer if it believes an instruction violates applicable data-protection law. Legally compelled processing beyond the instructions is notified unless prohibited by law.

## Permitted data and processing locations

You must have the rights and lawful basis required to submit the material and to instruct the disclosed processing. The self-service scope does not accept the restricted data categories stated in the service terms. Where an international transfer requires a separate instrument or completed annexes, TAVONEL and the customer agree that arrangement before the affected personal data is submitted, and the customer does not submit that data until it is agreed. Contact privacy@tavonel.com to establish it. This addendum does not represent that Standard Contractual Clauses, a UK Addendum or a transfer impact assessment have already been executed for you.

The current provider list, purpose, data classes and configured locations are published at https://tavonel.com/subprocessors. Database and application functions are configured in Seoul; the content sanitization service is configured in Google Cloud's Seoul region. Cloudflare and other providers operate global infrastructure, and the OCR provider does not currently offer a Korean-residency commitment for this service. The service does not guarantee that all document processing remains in Korea. Do not submit material requiring a region or provider restriction the selected service cannot satisfy.

## Subprocessors

The customer authorizes the subprocessors disclosed for the services it selects. TAVONEL limits their access to the applicable service purpose and requires appropriate contractual confidentiality and data-protection obligations. TAVONEL remains responsible for its processing obligations when using a subprocessor.

TAVONEL gives 30 days' notice before an intended new or replacement subprocessor begins processing customer personal data. The customer may object on reasonable data-protection grounds during that period. The parties will seek a reasonable solution; if none is available, the customer may terminate the affected service before that processing begins.

## Confidentiality and safeguards

Personnel access is limited to operational need and subject to confidentiality obligations. Safeguards include authenticated workspace access, server-side authorization, tenant-scoped storage paths, encrypted transport, storage-provider encryption at rest, quarantine and file checks, bounded archive processing, and source-linked output. The applicable measures are described at https://tavonel.com/security. No independent certification or customer-managed encryption-key capability is implied by this agreement.

Processing may be refused when authorization or a required check cannot be established. A failed processing request is not silently treated as successful. Security changes must maintain or improve the protection appropriate to the processing. No specific recovery point or recovery time objective is included in self-service; maintain independent copies of your originals and important exports.

## Return, deletion and retained evidence

Use the available export controls to retain your compiled results. For a source or workspace deletion, use the available deletion controls or contact privacy@tavonel.com. TAVONEL verifies the requester and the scope before acting. Revoking a connection stops future authorized retrieval; it is not, by itself, a request to erase all previously derived content.

A verified deletion request restricts use of the affected material and enters the governed deletion process. That process accounts for source files, document-derived copies and affected compiled snapshots. Removing a source may invalidate an entire compiled snapshot containing it; unchanged source documents remain available for a new compilation. A deletion request is not represented as complete while a covered artifact is retained or a required verification fails.

Immutable document artifacts are configured with a recovery protection of 28 days from object creation, during which the storage provider refuses their removal. The self-service deletion process makes affected material eligible for physical purge 30 days after the verified request; purge then runs, and each removal is independently verified before it is reported. These are configured periods, not a guaranteed completion deadline. Contact privacy@tavonel.com if applicable law or your circumstances require earlier action; TAVONEL will assess and act on that request in accordance with applicable law. A legal hold or mandatory retention duty may delay particular deletions, and its scope will be explained where permitted.

Provider backups may retain a deleted database record until their retention cycle ends. No immediate backup erasure or unverified backup expiry date is promised. Hashes, minimal transaction and deletion receipts, and records needed for security, accounting or legal obligations may remain for those purposes. They must not be used to reconstruct or continue serving deleted document content. TAVONEL confirms the observed deletion scope and any outstanding retention separately; the initial request receipt is not a certificate of completed erasure.

## Assistance, incidents and audit

TAVONEL assists with applicable access, correction, restriction, portability and deletion requests, and with assessments or regulator inquiries concerning its processing. A request received directly from an individual is referred to the customer unless law requires otherwise. Contact privacy@tavonel.com.

TAVONEL notifies the customer without undue delay and no later than 72 hours after becoming aware of a personal data breach affecting the customer's data. Available information includes the nature and likely effects, affected data categories, measures taken or proposed, and a contact point. Missing information is supplied as it becomes available. This does not change a customer's own statutory notification deadline. Report suspected incidents to security@tavonel.com.

TAVONEL makes information reasonably needed to demonstrate compliance available to the customer and cooperates with a reasonable audit, subject to confidentiality and protection of other customers' data. Ordinarily this is on reasonable notice and no more than once in twelve months, without restricting an audit required by a breach, law or a competent authority.

## Term and precedence

This addendum lasts for the service term and for any remaining authorized processing or retention. It prevails over the service terms for the processing of customer personal data. For a workspace that accepts this version, it replaces every earlier draft data processing agreement published on this site; those drafts do not form a second agreement alongside it. A separately executed data-processing or transfer agreement prevails within its scope, and mandatory law remains applicable. The liability provisions of the service agreement apply without excluding non-excludable data-protection obligations.