Data processing agreement

Your company is the Data Fiduciary for the personal data of its employees, candidates, clients and vendors held in its workspace, and we are its Data Processor. The Digital Personal Data Protection Act, 2023 requires that relationship to be set out in a contract. The Terms of Service already contain the essentials; the data processing agreement (“DPA”) sets them out in full, signed by both parties, for your records, your auditors and your own clients.

• The roles of the parties, and that we process only on your documented instructions.
• The categories of data and of people it concerns, and the purposes, as described in the Privacy Policy.
• Confidentiality obligations on our staff, and the support-access controls: opt-in, read-only, time-limited, audited in your workspace.
• The security measures we maintain, with reference to the security page.
• The current sub-processors and 30 days’ notice before one is added, with a right to object.
• Our assistance with requests from the people whose data it is, and with any enquiry from the Data Protection Board.
• Notice of a personal data breach without undue delay.
• Return and deletion of data when the agreement ends, on the timetable in clause 9 of the Terms.
• Your right to information needed to verify our compliance, including answers to a reasonable security questionnaire.

Email hello@corepilott.com from your account address with your company’s legal name, the workspace name, and the name and title of the person who will sign. We send the DPA as a document for electronic signature and countersign it on receipt. It is available on every plan at no charge. Enterprise customers who need changes to it can raise them during the security review.

Once signed, the DPA forms part of your agreement with us. Where it and the Terms say different things about the processing of personal data, the DPA prevails; on everything else the Terms do.