Data Processing Addendum

The short version. This is the contract between your company (the controller) and us (the processor) that data protection law requires. It is part of our Terms, so you have it from the moment you sign up; a signed copy is available on request at legal@codingcords.com. We process your data only on your instructions, keep it secure, use only the listed subprocessors (with 30 days' notice of new ones), help you with requests and breaches, tell you of a breach within 48 hours, and delete your data when you leave. Transfers outside the EU and UK use the Standard Contractual Clauses and the UK Addendum.

1. Scope and roles

This addendum applies when Coding Cords ("Processor") processes personal data in Customer Data on behalf of the Customer ("Controller") under the Terms. It covers the GDPR, the UK GDPR, the Swiss FADP, the CCPA/CPRA (under which we act as a "service provider") and similar laws ("Data Protection Law"). Where the Customer is itself a processor, we are its subprocessor and these terms apply in the same way.

2. Instructions

We process personal data only on the Customer's documented instructions: the Terms, the Customer's set-up and use of the service, and any other written instructions we agree. We tell the Customer if we believe an instruction breaks Data Protection Law. As a CCPA service provider we do not sell or share the data, use it outside the business purpose, or combine it with other data except as the law allows.

3. Confidentiality

Everyone at Coding Cords who can reach personal data is bound by confidentiality and has access only as far as their work needs.

4. Security

We maintain the technical and organisational measures in Annex 2. We may improve them over time but will not lower the overall protection.

5. Subprocessors

The Customer authorises the subprocessors on our list. We bind each of them by written terms that protect the data at least as well as these, and we remain responsible for them. We give at least 30 days' notice of a new subprocessor, by email to workspace owners and on that page. The Customer may object on reasonable data protection grounds within that time. We will try to find a solution; if we cannot, the Customer may end the affected service and we refund prepaid fees for it.

6. Assistance

Taking into account the nature of the processing, we help the Customer to answer requests from people about their data (mostly through the product's own export, edit and delete tools), with data protection impact assessments and prior consultations, and with its own security obligations. If someone writes to us directly about the Customer's data, we pass the request on and do not answer it ourselves unless the Customer asks us to.

7. Personal data breaches

We tell the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting its data. We share what we know (what happened, the kinds and rough numbers of people and records, the likely consequences, what we have done) and update the Customer as we learn more.

8. Deletion and return

The Customer can export its data during the subscription and for 30 days after it ends. We then delete it within 30 days, and it is gone from backups within 35 days after that, unless the law requires us to keep it.

9. Audits

We make available the information needed to show we comply with this addendum: this page, our Security page, answers to reasonable security questionnaires and, once we have them, independent reports. If that is not enough, or a regulator requires it, the Customer may audit once a year with 30 days' notice, during business hours, under confidentiality and at its own cost.

10. International transfers

Customer Data is hosted at Hetzner in the EU. Our team works from Pakistan, and some subprocessors are in the US. Where personal data goes to a country without an adequacy decision:

• the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated: Module 2 (controller to processor) and Module 3 (processor to processor) as applicable, with clause 7 (docking) included, clause 9 option 2 (general authorisation, 30 days' notice), the optional wording in clause 11 left out, and clauses 17 and 18 governed by Irish law and the courts of Ireland. Annexes I to III of the clauses are the annexes below;
• for UK data, the UK International Data Transfer Addendum (version B1.0) applies, and under its Table 4 neither party may end it;
• for Swiss data, the clauses apply with the Swiss FDPIC as the authority and references to Swiss law.

Transfers to providers certified under the EU-US Data Privacy Framework may rely on it.

11. Liability and precedence

Liability under this addendum is subject to the limits in the Terms, as far as Data Protection Law allows. If this addendum conflicts with the Terms on personal data, this addendum wins; if it conflicts with the Standard Contractual Clauses, the clauses win.

Annex 1: Details of processing

• Parties. Controller: the Customer named in the workspace (contact: its owner). Processor: Coding Cords, Bahria Enclave, Islamabad, Pakistan, privacy@codingcords.com.
• Subject matter and duration. Providing the Coding Cords service for the term of the Terms and until deletion under section 8.
• Nature and purpose. Hosting, storing, sending and receiving, transcribing, searching, analysing with AI at the Customer's request, displaying and deleting data, to provide the service.
• People concerned. The Customer's Users; its clients and portal users; contacts, leads and prospects in its CRM and outreach; people who send or receive its mail, chat, calls or meetings; signers of its documents; its employees and contractors (payroll, team, time off); anyone named in its files.
• Kinds of data. Identity and contact details; work and company details; mail, message and chat content; meeting and call audio, video, recordings and transcripts; phone numbers and call records; files and documents; invoices, expenses and payment details; payroll data such as salary, tax and bank details; e-signatures with signing evidence (IP address, time, email); Vault items (contents encrypted in the browser, see Annex 2); usage and security logs.
• Special categories. Not intended. The Customer may put such data in files, notes or payroll (for example health-related absence), is responsible for having a lawful basis for it, and it is protected by Annex 2.
• Frequency. Continuous.
• Retention. As the Customer sets in the service, then section 8.

Annex 2: Technical and organisational measures

• Hosting on dedicated servers in Hetzner's ISO 27001-certified data centres in the EU. Server access by SSH key only, for named staff, with a firewall open only to the ports the service needs.
• Encryption in transit with TLS 1.2 or later for every connection; mail between servers over TLS where the other server supports it.
• Vault item contents encrypted in the browser with keys we never receive. Names and other details of Vault items are not encrypted this way, and each company's admin holds a recovery key (see the Security page).
• Secrets kept in a dedicated secrets store, never in code.
• Passwords stored as argon2id hashes; passkeys and two-step sign-in available; session cookies HttpOnly and Secure; sign-in attempts rate limited.
• Every company's data kept apart by company in every query; access checked per module and member; sensitive actions recorded in an audit history.
• Automated tests of permissions and company separation run before every release.
• Encrypted, off-site backups with tested restores, being put in place; until they are, data is stored on a single server, as the Security page says.
• Monitoring of uptime and errors; operating system and dependencies kept patched.
• An incident response procedure and breach notice under section 7.
• Staff confidentiality, least-privilege access, and access removed when someone leaves.

Annex 3: Subprocessors

As listed at codingcords.com/legal/subprocessors on the date the Customer accepted the Terms, as updated under section 5.