Legal

Data Processing Agreement

Acuerdo de Tratamiento de Datos (DPA)

Version 1.1 · Effective date: April 17, 2026

Last updated: April 18, 2026

This Data Processing Agreement ("DPA") supplements CoreLab Creative's Terms and Conditions of Service and applies when the Client (as Data Controller) uses the Platform to process personal data of their own users, employees, or other natural persons, and CoreLab Creative acts as Data Processor on behalf of the Client. This DPA is particularly relevant where GDPR, UK GDPR, LGPD, DPDPA 2023, or equivalent regulations apply.

1. Definitions

Data Controller: The Client who determines the purposes and means of processing personal data.
Data Processor: CoreLab Creative, which processes personal data on behalf of the Controller, following their instructions.
Sub-processor: Third parties to whom CoreLab Creative may subcontract the processing of data on behalf of the Controller.
Client Personal Data: Personal data that the Client uploads, transmits, or generates through the Platform in the course of the contracted service.
Security Incident: A security breach leading to the destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to personal data.
Applicable Regulation: Any law, regulation, or data protection standard applicable to the processing of personal data under this DPA.

2. Subject Matter and Nature of Processing

2.1 Subject Matter

CoreLab Creative processes personal data on behalf of the Client solely for the purpose of providing the services described in the Terms and Conditions of Service.

2.2 Nature of Processing

Processing operations include: collection and receipt of data uploaded or generated through Platform use; storage and organization within the multi-tenant model; querying and retrieval to display the interface and respond to user actions; modification by authorized Client users; transmission to sub-processors for billing and communications; deletion upon request or upon expiry of retention periods; and activity logging for security and traceability.

2.3 Categories of Data Subjects

Processed data may correspond to the Client's employees, collaborators, or contractors; the Client's end users (if they introduce data of their own clients into the Platform — not recommended except in support tickets); and the Client's suppliers or partners.

2.4 Types of Personal Data

Identification data: names, email addresses.
Access data: user identifiers, roles, access history.
Content data: text of requests, comments, attachments uploaded by the Client.
Technical metadata: IP addresses, browser types, action timestamps.
Communication data: transactional emails sent on behalf of the Client.

2.5 Special Categories

CoreLab is not designed to process special categories of personal data (health, ethnic origin, political opinions, biometric data, etc.). The Client must not upload such data. If they do, they assume full responsibility for applicable regulatory compliance.

2.6 Duration

Processing extends throughout the duration of the subscription contract, plus the post-cancellation retention period (maximum 90 days for client data, with the exception of billing data subject to accounting obligations).

3. Controller's Instructions

CoreLab processes data solely in accordance with the Controller's documented instructions, defined by this DPA, the Terms and Conditions, and the actions of the Client's authorized users on the Platform.

If CoreLab believes that a Client instruction infringes Applicable Regulation, it will notify the Client in writing.

Purpose restriction: CoreLab will not use the Client's personal data for any purpose of its own, including business analysis, marketing, advertising, or training artificial intelligence models.

4. CoreLab Creative's Obligations as Processor

4.1 Confidentiality

CoreLab ensures that personnel with access to Client data are subject to contractual or legal confidentiality obligations. Only personnel with administration or client service roles may access request data, and solely in the context of service delivery.

4.2 Security of Processing

CoreLab implements technical and organizational measures appropriate to the risk, including:

Encryption in transit (HTTPS/TLS in all communications).
Encryption at rest in the storage infrastructure.
Strong authentication with MFA support (TOTP).
Role-based access control at application and database layers.
Data isolation between organizations via database security policies.
Private file storage, accessible only via temporary signed URLs.
Audit logs of all critical actions.
Separation of service credentials for administrative operations.

4.3 Assistance to the Controller

CoreLab will assist the Client with: responding to data subject rights (access, rectification, erasure, portability); impact assessments (DPIA); security incident notification; and regulatory compliance with supervisory authorities.

4.4 Deletion or Return of Data

Upon termination of the service, CoreLab will delete Client data within the established post-cancellation period (90 days). At the Client's request, it may facilitate data export in a standard format prior to deletion.

5. Security Incident Notification

CoreLab will notify the Client of any Security Incident without undue delay and, where possible, within 72 hours of becoming aware of the incident.

The notification will include: description of the nature of the incident, categories and approximate number of data subjects affected, contact details of CoreLab's internal responsible party, possible consequences, and measures taken or proposed.

Notification will be sent to the email of the workspace owner affected. It is the Client's responsibility to notify the incident to the competent supervisory authority when required by applicable regulation.

6. Sub-processors

6.1 Authorized Sub-processors

Sub-processor	Purpose	Data Transferred	Location
Supabase Inc.	Database, authentication, file storage	All application data	AWS (configurable region)
Stripe Inc.	Payment and subscription processing	Client's email, organization name, subscription metadata	United States (SCCs)
Resend Inc.	Transactional email delivery	Recipient email, email content (name, ticket data, invitation URLs)	United States

6.2 New Sub-processors

CoreLab will notify the Client at least 30 days in advance before adding or replacing a sub-processor. The Client may object to the change within that period. If no agreement is reached, the Client may cancel their subscription without penalty.

6.3 Liability

CoreLab imposes data protection obligations on its sub-processors equivalent to those in this DPA through written agreements. CoreLab will be liable to the Client for the acts of its sub-processors to the same extent as if it had performed the processing directly.

7. International Data Transfers

Transfers of data to sub-processors located outside the European Economic Area are carried out under appropriate mechanisms, including Standard Contractual Clauses (SCCs) approved by the European Commission and specific Data Processing Agreements with each sub-processor.

If the Client has specific data residency requirements (e.g., that data remain in the EU or LATAM), they must communicate this to CoreLab before or during contracting.

8. Audits and Transparency

The Client has the right to audit CoreLab's compliance with this DPA, directly or through a designated auditor, with reasonable prior notice (at least 30 days) and without interfering with CoreLab's normal operations.

Alternatively, CoreLab may provide security reports conducted by independent third parties when available. CoreLab maintains internal records of processing activities carried out on behalf of the Client, available upon request from supervisory authorities.

9. Contact

CoreLab Creative — Data Protection Officer
Email: info@corelabcreative.com
Suggested subject: [DPA] - brief description

10. Document Hierarchy

In the event of conflict between this DPA and the Terms and Conditions on data protection matters, this DPA will prevail.

11. Acceptance

By accepting the Terms and Conditions of Service, the Client also accepts the terms of this DPA, which forms an integral part of the agreement.

12. Obligations as Service Provider under CCPA/CPRA

CoreLab acts as a Service Provider with respect to personal data of California consumers processed on behalf of the Client.

CoreLab commits to: not selling Client data to any third party; not sharing it for behavioral advertising; not retaining, using, or disclosing it for purposes other than the contracted service; and not combining it with data from other sources or other clients except for security or compliance purposes.

CoreLab will assist the Client in responding to California consumer rights requests within timelines that enable compliance with legal deadlines (45 days).

13. Appendix — UK GDPR

This appendix supplements the DPA for processing of data of persons located in the United Kingdom, governed by UK GDPR (Data Protection Act 2018).

Transfers of personal data from the United Kingdom will use the ICO's International Data Transfer Addendum (UK IDTA), or the EU SCCs with the ICO Addendum, as applicable.

Competent supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk.

Annex I: Technical and Organizational Measures

Applicable to the processing of Client data by CoreLab Creative, pursuant to Art. 32 GDPR and Annex II of the applicable SCCs.

A. Physical Access Control

CoreLab operates entirely in the cloud without its own physical server facilities. Physical infrastructure security is the responsibility of cloud sub-processors. CoreLab verifies that they maintain adequate physical security certifications.

B. Logical Access Control

Multi-factor authentication required for internal staff access to the administration panel.
Access to production data limited to strictly necessary personnel (principle of least privilege).
Database security policies for isolation between organizations.
Separation between service credentials and standard credentials.
Periodic review of access privileges to the production environment.

C. Transmission Control

All communications between client and server are conducted over HTTPS/TLS 1.2+.
API routes do not expose data across different organizations.
Attachments are served exclusively via temporary signed URLs with short expiry.

D. Input Control and Data Integrity

Audit logs of all critical actions (user, action, resource, IP, timestamp).
Input validation at all API access points.
Passwords are processed via secure hashing algorithms and never stored in plain text.

E. Availability and Resilience

Cloud-hosted infrastructure with redundancy per provider configuration.
Automatic backups managed by the infrastructure provider.
Ability to restore data from backups in the event of an incident.

F. Security Incident Management

Client notification within 72 hours of becoming aware of an incident affecting their data.
Immediate internal investigation with documented record of the incident, its scope, and measures taken.
Coordination with sub-processors for incidents originating in their infrastructure.

G. Sub-processor Management

All sub-processors are subject to processing agreements with obligations equivalent to those in this DPA.
Sub-processors are evaluated before onboarding and monitored on an ongoing basis.
The Client is notified 30 days in advance of any sub-processor changes.

H. Staff Training

Personnel with access to client data are aware of their confidentiality and data protection obligations. Internal policies define proper handling and the consequences of non-compliance.

Annex II: List of Authorized Sub-processors

Sub-processor	Purpose	Data Transferred	Location	Reference
Supabase Inc.	Database, authentication, storage	All application data	AWS (configurable region)	supabase.com/privacy
Stripe Inc.	Payments and subscriptions	Email, organization name, subscription metadata	USA (SCCs)	stripe.com/privacy
Resend Inc.	Transactional emails	Recipient email, email content	USA	resend.com/legal/privacy-policy