Data Processing Addendum

Status and Incorporation

This Data Processing Addendum (“DPA”) is provided by Corenth Technologies LLC (“Corenth”) for use with a business customer (“Customer”) when Corenth processes Customer Personal Data on Customer's behalf in connection with the Service.

This DPA becomes part of the agreement between Corenth and Customer when:

• The applicable customer agreement, order form, or written amendment expressly incorporates this DPA.
• Corenth and Customer execute or electronically accept this DPA through an authorized process.
• Another written agreement signed or accepted by authorized representatives expressly makes this DPA applicable.

Merely viewing this webpage does not create a separate contract between Corenth and the visitor.

Definitions

• Applicable Data Protection Law — privacy, data-protection, and data-security laws applicable to the processing of Customer Personal Data under the parties' agreement.
• Customer Data — data, content, records, prompts, files, communications, and other information submitted to the Service by or for Customer.
• Customer Personal Data — personal data or personal information included in Customer Data that Corenth processes on behalf of Customer.
• Controller — a person or organization that determines the purposes and means of processing personal data.
• Processor — a person or organization that processes personal data on behalf of a controller.
• Service — the Corenth Technologies website, software platform, subscriptions, features, integrations, support, and related services covered by the applicable customer agreement.
• Subprocessor — a third party engaged by Corenth to process Customer Personal Data on Corenth's behalf.
• Security Incident — a confirmed breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

Terms including personal data, personal information, processing, data subject, consumer, business, contractor, service provider, supervisory authority, sale, and sharing have the meanings assigned by Applicable Data Protection Law.

Scope and Roles

This DPA applies when Corenth processes Customer Personal Data on Customer's behalf to provide the Service.

Customer generally acts as a controller, business, or equivalent responsible party. Corenth generally acts as a processor, service provider, contractor, or equivalent party for Customer-directed processing.

Corenth may act as an independent controller or business for limited information processed for its own legitimate and lawful purposes, including:

• Account and business-relationship administration.
• Direct communications with Customer representatives.
• Billing, taxation, accounting, and financial records.
• Security, abuse prevention, and fraud prevention.
• Legal compliance and dispute resolution.
• Aggregated or de-identified information that is no longer Customer Personal Data.

Corenth's independent processing is governed by the Privacy Policy and applicable law rather than Customer's processing instructions.

Processing Instructions

Corenth will process Customer Personal Data only according to documented Customer instructions, including instructions contained in:

• The applicable customer agreement and order form.
• This DPA.
• Customer's account and feature configuration.
• Customer-configured workflows, automations, and platform features.
• Authorized support, implementation, or service requests.
• Customer's lawful use of the Service.

Corenth may process Customer Personal Data when required by applicable law. Where legally permitted, Corenth will inform Customer before performing processing required by law.

Corenth may notify Customer if it reasonably believes a documented instruction violates Applicable Data Protection Law. Corenth may suspend the affected processing while the parties clarify or modify the instruction.

Customer Obligations

Customer is responsible for Customer Data, Customer's processing instructions, and Customer's use of the Service.

Customer represents and warrants that it will:

• Provide required privacy notices and obtain required permissions, authorizations, or consent.
• Maintain a lawful basis for collecting, using, disclosing, and processing Customer Personal Data.
• Submit only information Customer is authorized to process.
• Configure accounts, permissions, workflows, automations, and automation rules responsibly.
• Use the Service in compliance with applicable law, the Terms of Service, and the Acceptable Use Policy.
• Respond to data subjects and consumers where Customer is the responsible controller or business.
• Avoid unsupported sensitive, regulated, or high-risk processing unless Corenth has expressly agreed in writing to support it.
• Maintain appropriate human review for artificial-intelligence output and consequential decisions.

Confidentiality

Corenth will restrict access to Customer Personal Data to personnel and authorized service providers who reasonably require access to perform their responsibilities.

Personnel authorized to process Customer Personal Data will be subject to confidentiality obligations or an appropriate legal duty of confidentiality.

Corenth may access Customer Personal Data for legitimate purposes including:

• Providing and supporting the Service.
• Troubleshooting an authorized customer issue.
• Maintaining platform security and reliability.
• Investigating suspected fraud, misuse, or abuse.
• Responding to a Security Incident.
• Complying with applicable law or legal process.

Security Measures

Corenth will maintain reasonable technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

Security measures are described in Section 19 and may evolve as the platform, architecture, providers, risks, and available safeguards change.

Corenth may update security measures provided that an update does not materially reduce the overall protection of Customer Personal Data during the applicable Service term.

Subprocessors

Customer provides general authorization for Corenth to engage subprocessors reasonably necessary to provide, secure, maintain, and support the Service.

Corenth will require each subprocessor that processes Customer Personal Data on Corenth's behalf to accept data-protection obligations appropriate to:

• The nature of the service performed.
• The categories of information processed.
• The risks associated with the processing.
• Applicable contractual and legal requirements.

Corenth remains responsible for performing its obligations under this DPA when processing is delegated to a subprocessor, subject to the limitations and liability terms in the applicable customer agreement.

Customer may submit a reasonable written objection to a new subprocessor based on legitimate data-protection concerns. Corenth and Customer will attempt to resolve the concern in good faith through available safeguards, configuration changes, alternatives, or other commercially reasonable measures.

Individual Rights Requests

Taking into account the nature of processing, Corenth will provide reasonable assistance enabling Customer to respond to eligible requests involving:

• Access to personal information.
• Correction of inaccurate information.
• Deletion of eligible information.
• Restriction or objection to processing.
• Portability or export where applicable.
• Opt-out or limitation rights where applicable.

If Corenth receives a request relating to Customer Personal Data, Corenth may direct the requester to Customer unless Corenth is legally required to respond directly.

Customer remains responsible for verifying requests, determining whether a right applies, communicating with the requester, and providing lawful instructions to Corenth.

Compliance Assistance

Taking into account the nature of processing and information reasonably available to Corenth, Corenth will provide reasonable assistance relating to:

• Security obligations.
• Security-Incident assessment and notification.
• Individual-rights and consumer requests.
• Data-protection impact assessments.
• Prior consultation with supervisory authorities.
• Customer privacy and security questionnaires.
• Information reasonably necessary to demonstrate compliance with this DPA.

Assistance requiring substantial engineering, legal, professional, audit, export, or custom-development work may be subject to reasonable fees or a separate written agreement.

Security Incidents

Corenth will notify Customer without undue delay after confirming a Security Incident affecting Customer Personal Data.

Notification may be delivered by email, account notice, designated customer contact, or another reasonable method.

To the extent information is available, Corenth's notice may describe:

• The nature of the Security Incident.
• Affected systems, accounts, and data categories.
• Known or reasonably anticipated consequences.
• Containment, investigation, and remediation actions.
• Recommended customer actions where appropriate.
• A contact for follow-up questions.

Information may be provided in phases as the investigation progresses. Notification does not constitute an admission of fault, liability, or violation of law.

Customer is responsible for determining whether Customer must notify individuals, regulators, customers, employees, or other parties.

Return and Deletion

During the Service term, Customer may use available features or submit a request to access or export eligible Customer Data.

Following termination or expiration, Corenth will delete or return eligible Customer Personal Data according to the applicable agreement and Customer's lawful instructions, unless retention is required or permitted by applicable law.

Customer Personal Data may remain temporarily in:

• Provider-managed backups and recovery systems.
• Security and audit logs.
• Fraud-prevention and abuse-investigation records.
• Billing, tax, accounting, and transaction records.
• Legal holds and dispute-resolution records.

Retained Customer Personal Data remains subject to applicable confidentiality and security obligations and will not be used for unrelated commercial purposes.

Audits and Information

Corenth will make information reasonably necessary to demonstrate compliance with this DPA available through appropriate methods, which may include:

• Public security and privacy documentation.
• Subprocessor disclosures.
• Customer security questionnaires.
• Control descriptions and policy summaries.
• Certifications, independent assessments, or test summaries if and when they become available.

If legally required information cannot reasonably be provided through existing documentation, Customer may request an audit subject to:

• Reasonable advance written notice.
• Confidentiality obligations.
• A mutually agreed scope and schedule.
• Reasonable security and non-disruption requirements.
• No access to unrelated customer information.
• Customer bearing reasonable costs unless otherwise required by law or agreed in writing.

International Transfers

Customer Personal Data may be processed in the United States and other countries where Corenth or authorized subprocessors operate.

Where Applicable Data Protection Law requires an international-transfer safeguard, the parties will use an available lawful mechanism appropriate to the transfer.

That mechanism may include:

• An applicable adequacy decision.
• The European Commission's applicable Standard Contractual Clauses.
• The United Kingdom International Data Transfer Agreement.
• The United Kingdom Addendum to the European Commission Standard Contractual Clauses.
• Another legally recognized transfer safeguard.

Where the EU Standard Contractual Clauses apply to a controller-to-processor transfer, Module Two will generally apply. Where Customer acts as a processor and Corenth acts as Customer's subprocessor, Module Three will generally apply, subject to the parties' actual roles and the applicable transfer.

Any required annexes, party information, processing details, security measures, competent supervisory authority, governing-law selection, transfer-risk assessment, or supplemental measures must be completed for the applicable transaction.

United States Privacy Terms

Where an applicable United States privacy law treats Corenth as Customer's service provider, contractor, processor, or equivalent party, Corenth will process Customer Personal Data for the limited and specified purposes described in the applicable agreement, this DPA, and Customer's documented instructions.

To the extent required by applicable law, Corenth will not:

• Sell Customer Personal Data.
• Share Customer Personal Data for cross-context behavioral advertising.
• Retain, use, or disclose Customer Personal Data outside the specified business purposes except as legally permitted.
• Retain, use, or disclose Customer Personal Data outside the direct business relationship except as legally permitted.
• Combine Customer Personal Data with information obtained from unrelated sources except where permitted by applicable law.

Corenth will notify Customer if Corenth determines it can no longer meet a material obligation applicable to its role. Customer may take reasonable and appropriate steps to stop and remediate unauthorized processing.

Corenth will provide reasonable assistance with applicable consumer requests and maintain a level of privacy protection consistent with Corenth's obligations under this DPA and applicable law.

AI-Supported Processing

Customer may choose to submit Customer Personal Data to supported artificial-intelligence features for purposes such as generating responses, summaries, classifications, recommendations, workflow actions, or other requested output.

Corenth may transmit the information required to perform the requested feature to an authorized AI provider acting as a service provider or subprocessor, subject to the applicable integration, provider terms, account settings, and contractual protections.

Corenth does not use Customer business data to train third-party foundation models without Customer consent.

Customer is responsible for:

• Determining whether the AI feature is appropriate.
• Avoiding submission of unsupported sensitive or regulated information.
• Reviewing AI-generated output for accuracy and suitability.
• Maintaining human oversight for important or consequential uses.
• Complying with applicable notice, consent, privacy, employment, consumer-protection, and recordkeeping duties.

Liability, Priority and Conflicts

The liability, remedies, exclusions, indemnification, governing law, and dispute-resolution terms in the applicable customer agreement apply to this DPA unless Applicable Data Protection Law requires otherwise.

If this DPA conflicts with another part of the applicable customer agreement concerning processing of Customer Personal Data, this DPA controls to the extent of that conflict.

If completed international-transfer clauses conflict with this DPA, the international-transfer clauses control to the extent required by their terms or applicable law.

Except as modified by this DPA, the remaining customer agreement continues in effect.

Schedule 1 — Processing Details

Categories of individuals

• Customer employees, contractors, administrators, and authorized users.
• Customer prospects, leads, contacts, clients, and customers.
• Website visitors, chatbot users, and communication recipients.
• Appointment participants and individuals included in Customer records.
• Other individuals whose information Customer lawfully submits to supported Service features.

Categories of personal information

• Names, usernames, business contact details, and account identifiers.
• Employment, organization, role, and professional information.
• CRM, lead, customer, appointment, workflow, and communication records.
• Prompts, instructions, files, documents, messages, and generated content.
• Authentication, session, device, browser, IP-address, log, and usage information.
• Subscription, invoice, transaction, and billing-administration information.
• Other information selected and lawfully submitted by Customer.

Special or sensitive information

The Service is not intended for unsupported categories of sensitive or highly regulated information unless Corenth has expressly agreed in writing to support the applicable use.

Customer must not submit protected health information, biometric identifiers, complete financial-account credentials, government-identification documents, children's information, criminal-history information, or other specially regulated information unless:

• The applicable Service feature expressly supports it.
• Corenth has approved the use in writing.
• The parties have completed any additional required agreement.
• Customer has implemented all legally required notices, consent, safeguards, and oversight.

Schedule 2 — Technical and Organizational Measures

Corenth's security program is developing alongside the production platform. The following categories describe the safeguards Corenth uses or intends to maintain as applicable to the deployed Service.

Specific controls may depend on the customer plan, enabled features, production architecture, provider capabilities, and nature of processing.

Corenth may replace a provider or control with an alternative that provides materially comparable protection appropriate to the Service and processing risk.

Contact and Acceptance

Customers seeking to incorporate this DPA into an agreement or requesting additional processing information may contact:

This is Corenth Technologies LLC's mailing address and should not be interpreted as a public office, retail location, or customer-service center.

A DPA request should identify the Customer's legal name, contact person, applicable Service or plan, requested effective date, relevant privacy jurisdiction, and any required international-transfer documents.