Data Processing Addendum

01 · What this covers

Scope

The DPA sets out the terms under which Co·Connect acts as a data processor for personal data you (the controller) submit to the Service. It supplements the Terms of Service and the Privacy Policy — both stay in force; the DPA only adds the processor-specific obligations required by Article 28 GDPR and the equivalent UK and California provisions.

02 · Who needs one

Who should request a DPA

Most individual users don’t need a signed DPA — the Privacy Policy and Terms describe the relationship in full. You probably want one if any of these apply:

• You’re an organisation procuring CoCo for your team and your privacy office asks for one.
• You’re subject to GDPR, UK GDPR, the CCPA/CPRA, or an equivalent regime and your DPO requires processor terms in writing.
• You’re a regulated industry buyer (finance, health, public sector) whose compliance team needs the document for their vendor file.

03 · What we include

What’s in the DPA

• Roles — controller / processor split.
• Categories of personal data and data subjects (mirroring the Privacy Policy).
• The current list of subprocessors and the change-notice mechanism.
• Security measures (technical and organisational) and breach notification timelines.
• International transfer mechanism — the EU Commission’s Standard Contractual Clauses (Module 2), and the UK Addendum, where applicable.
• Audit rights, data-subject-request assistance, and end-of-contract data return / deletion.

04 · How to request

Request a signed DPA

Send an email to hello@coconnect.ai with:

• Your company’s legal name and registered address.
• The signatory’s name, role, and email.
• Your DPO or privacy-team contact (if separate from the signatory).
• Any deviations you need from our standard template (e.g. jurisdiction-specific addenda).

We’ll send a countersignable version within 5 business days.