Data Processing Agreement

This Data Processing Agreement forms part of the Terms of Service between Coorde Tech s.r.o. as Processor and the business customer as Controller. It applies where Coorde processes personal data on the Customer’s behalf, including data of team members added to a workspace.

Roles and scope — The Customer is the controller and Coorde is the processor. Coorde processes personal data only to provide the Service and in accordance with documented instructions, unless required by law.

Confidentiality and security — Authorized personnel are bound by confidentiality. Coorde applies appropriate technical and organizational measures, including encryption in transit and at rest, access controls, two-factor authentication, monitoring and daily backups.

Subprocessors and transfers — The Customer authorizes Coorde to use vetted subprocessors. Coorde remains responsible for them and provides notice of material additions or replacements. International transfers rely on Standard Contractual Clauses and appropriate safeguards.

Assistance, breaches and audits — Coorde assists the Customer with data-subject requests and GDPR obligations where possible. We notify the Customer without undue delay of breaches affecting Customer data and make reasonable compliance information available for audits.

Return and deletion — After the Service ends, customer content is retained for 30 days and then deleted or anonymized, unless law requires retention.

Annex I — Coorde coordinates the Customer’s work by reading calendar events, creating tasks and messaging team members. Relevant data includes names, contact handles, calendar events, tasks, processes and Coorde messages.

Annex II — Security measures include TLS encryption, encryption at rest, least-privilege access, confidential staff access, daily backups retained for seven days, activity logging and vendor due diligence.

Annex III — Current subprocessors include Convex for hosting and database, OpenAI for AI processing, Google for calendar sync, Meta and Slack for messaging, Axiom for observability, Brevo for email, and Paddle for payments and billing.