Skip to main content

Data Processing Agreement (DPA)

Last updated: 2026-09-01

This Data Processing Agreement (“DPA”) forms part of the CoreZT Terms of Service and applies to the processing of Personal Data in connection with the use of CoreZT’s services (“Services”).

This DPA is entered into by and between:

  • Customer (“Controller”), and
  • CoreZT (“Processor”)

collectively referred to as the “Parties”.

1. Definitions​

Unless otherwise defined in this DPA, capitalized terms have the meaning given in applicable data protection laws, including the General Data Protection Regulation (“GDPR”).

  • Personal Data: Any information relating to an identified or identifiable natural person.
  • Processing: Any operation performed on Personal Data.
  • Sub-processor: Any third party engaged by CoreZT to process Personal Data.

2. Scope and Purpose​

This DPA applies to Personal Data processed by CoreZT on behalf of the Customer solely for the purpose of providing and supporting the Services in accordance with the Terms of Service.

3. Roles and Responsibilities​

3.1 Customer Responsibilities​

The Customer:

  • Acts as the data controller
  • Determines the purposes and means of processing
  • Ensures it has a lawful basis for processing Personal Data
  • Is responsible for the accuracy, quality, and legality of Personal Data

3.2 CoreZT Responsibilities​

CoreZT:

  • Acts as a data processor
  • Processes Personal Data only on documented instructions from the Customer
  • Ensures that personnel authorized to process Personal Data are bound by confidentiality obligations

4. Details of Processing​

  • Subject Matter: SaaS platform usage
  • Duration: For the term of the Services
  • Nature of Processing: Hosting, storage, transmission, and analysis
  • Categories of Data Subjects: Customer users, administrators, end users
  • Types of Personal Data: Contact information, identifiers, usage metadata, customer-submitted content

5. Security Measures​

CoreZT implements appropriate technical and organizational measures to protect Personal Data, including:

  • Access controls and authentication
  • Encryption in transit where feasible
  • Logical segregation of customer data
  • Monitoring and incident response procedures

6. Sub-processors​

6.1 Authorization​

The Customer authorizes CoreZT to engage Sub-processors as necessary to provide the Services.

6.2 Obligations​

CoreZT ensures that Sub-processors are subject to data protection obligations no less protective than those in this DPA.

6.3 Changes​

CoreZT may update its list of Sub-processors from time to time and will provide notice of material changes where required by law.

7. Data Subject Rights​

CoreZT will assist the Customer, where reasonably possible, in responding to requests from data subjects to exercise their rights under applicable data protection laws.

8. Data Breach Notification​

CoreZT will notify the Customer without undue delay after becoming aware of a Personal Data breach and will provide reasonable information regarding the breach as it becomes available.

9. International Data Transfers​

Where Personal Data is transferred outside the country of origin, CoreZT will implement appropriate safeguards in accordance with applicable data protection laws.

10. Audits and Compliance​

Upon reasonable written request, CoreZT will make available information necessary to demonstrate compliance with this DPA and allow for audits as required by applicable law, subject to reasonable confidentiality and security restrictions.

11. Data Return and Deletion​

Upon termination of the Services, CoreZT will, at the Customer’s option:

  • Return Customer Personal Data, or
  • Delete Customer Personal Data after a reasonable retention period

unless retention is required by law.

12. Liability​

Liability arising from this DPA is subject to the limitations of liability set forth in the CoreZT Terms of Service.

13. Governing Law​

This DPA is governed by the same law and jurisdiction as the CoreZT Terms of Service unless otherwise required by applicable data protection laws.

14. Order of Precedence​

In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters.

15. Contact​

For data protection inquiries, contact:

support@corezt.com