Data Processing Addendum (DPA)

1. Definitions

In this DPA:

• "Controller" means you, the customer, who determines the purposes and means of processing personal data.
• "Processor" means Coactra, who processes personal data on your behalf.
• "Personal Data" means any information in your Content that relates to an identified or identifiable natural person.
• "Processing" has the meaning given in GDPR Article 4(2).
• "Data Protection Laws" means GDPR and all applicable data protection laws.
• "Sub-processor" means any third party appointed by Coactra to process Personal Data.

2. Roles and Scope

You are the Controller. You determine what Personal Data to store in the Services, why you process it, and how you use it. You are responsible for ensuring you have a lawful basis for processing (consent, contract, legitimate interest, etc.).

Coactra is the Processor. We process Personal Data only on your documented instructions. Your instructions are:

• Set out in the Terms of Service
• Given through your use of the Services (creating records, running automations, configuring integrations)
• Provided via support requests or operator assistance

We will not process Personal Data for any purpose other than those instructed by you, except as required by applicable law.

3. Your Obligations as Controller

You warrant and undertake that:

• You have a lawful basis for processing the Personal Data you upload to the Services
• You have obtained necessary consents from data subjects where required
• You have provided required privacy notices to data subjects
• Your instructions to us comply with Data Protection Laws
• You will not instruct us to process Personal Data in a way that violates Data Protection Laws

4. Our Obligations as Processor

Coactra will:

• Process Personal Data only on your documented instructions (unless required by law to do otherwise)
• Ensure that persons authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational measures (see Section 6 below)
• Assist you in responding to data subject rights requests (access, deletion, correction, portability)
• Assist you with data protection impact assessments and consultations with supervisory authorities
• Delete or return Personal Data at the end of the service (see Section 10 below)
• Make available information necessary to demonstrate compliance with GDPR Article 28
• Notify you without undue delay after becoming aware of a Personal Data breach (see Section 7 below)

5. Details of Processing

a. Subject Matter and Duration

The subject matter and duration of processing are determined by your use of the Services and your subscription term.

b. Nature and Purpose of Processing

Coactra processes Personal Data to provide the Services, including:

• Storing and managing data in structured tables
• Running automations (scheduled, triggered, or manual)
• Generating reports and insights
• Connecting to third-party services you authorize
• Providing operator assistance when you request it

c. Categories of Data Subjects

The categories of data subjects depend on your use of the Services, but may include:

• Your customers (current and prospective)
• Your employees and contractors
• Business contacts and leads
• Website visitors
• Other individuals whose data you choose to process

d. Categories of Personal Data

The categories of Personal Data depend on your use, but may include:

• Identification data (names, email addresses, phone numbers)
• Professional data (company name, job title, work contact details)
• Commercial data (transaction history, purchase records, invoices)
• Communication data (emails, messages, support requests)
• Technical data (IP addresses, device information, usage logs)

6. Technical and Organizational Measures

Coactra implements the following security measures to protect Personal Data:

a. Encryption

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest

b. Access Control

• Multi-factor authentication (MFA) available for all accounts
• Role-based access control within workspaces
• Operator access requires explicit customer authorization, is scoped, time-limited, and audited
• Least-privilege principle for internal access

c. Data Isolation

• Each customer has a separate, isolated database environment
• Physical separation prevents cross-customer data access

d. Backup and Recovery

• Automatic daily local backups (on-server)
• Off-site encrypted backups to cloud storage (USA)
• 30-day backup retention
• Documented disaster recovery procedures

e. Monitoring and Logging

• Security event logging and monitoring
• Regular security assessments
• Incident response plan

f. Organizational Measures

• Staff training on data protection
• Confidentiality agreements with all personnel
• Documented security policies and procedures

7. Personal Data Breach Notification

In the event of a Personal Data breach, Coactra will:

• Notify you without undue delay and within 24 hours of becoming aware of the breach
• Provide details including:
  • Nature of the breach
  • Categories and approximate number of data subjects affected
  • Categories and approximate number of Personal Data records affected
  • Likely consequences of the breach
  • Measures taken or proposed to address the breach
• Assist you in meeting your GDPR Article 33 and 34 obligations (notifying supervisory authorities within 72 hours and data subjects where required)

We cannot notify supervisory authorities or data subjects on your behalf (you are the Controller), but we will provide information you need to meet your obligations.

8. Sub-processors

a. Authorization

You authorize Coactra to engage Sub-processors to process Personal Data on your behalf. By accepting this DPA, you provide general written authorization for the Sub-processors listed below.

b. Current Sub-processor Categories

Coactra uses sub-processors in the following categories to deliver the Services:

A complete list of specific sub-processor names and providers is available to customers on request via legal@coactra.com. We will notify you at least 30 days before adding or replacing any sub-processor, and you may object on reasonable data protection grounds.

Note: AI and enrichment sub-processors only receive data when you explicitly use those features. You can disable these features from your workspace settings.

c. Sub-processor Obligations

Coactra ensures that:

• Sub-processors are bound by written contracts imposing data protection obligations equivalent to this DPA
• Sub-processors implement appropriate technical and organizational measures
• Coactra remains liable for Sub-processor performance

d. Changes to Sub-processors

We will inform you of any intended changes to Sub-processors (additions or replacements) at least 30 days in advance by:

• Email to your registered account email
• Update to this page with effective date

If you object to a new Sub-processor on reasonable data protection grounds, you may terminate your subscription without penalty before the Sub-processor takes effect.

9. International Data Transfers

Your data is primarily stored and processed in the European Union (data centers in Germany).

Where sub-processors are located outside the EU/EEA (e.g., backup storage, payment processing, email delivery, AI providers in the USA), we ensure adequate safeguards through:

• EU Standard Contractual Clauses (SCCs) — Approved by the European Commission for data transfers to third countries
• Supplementary measures — Encryption, access controls, and contractual restrictions
• Transfer Impact Assessments — We assess the legal framework in destination countries

Copies of Standard Contractual Clauses are available upon request to legal@coactra.com.

10. Data Subject Rights Assistance

If a data subject submits a request to exercise their rights (access, deletion, correction, portability, restriction, objection) directly to Coactra, we will forward the request to you without undue delay.

If you receive such a request and need our assistance, we will:

• Provide technical assistance to help you fulfill the request (e.g., exporting data, deleting records)
• Respond to reasonable requests within 10 business days
• Not charge fees for assistance with up to 5 requests per year; additional requests may incur reasonable fees

You remain responsible for verifying the data subject's identity and determining whether to fulfill the request.

11. Data Return and Deletion

At the end of your subscription or upon your request:

• 30-day grace period — Your data remains accessible for 30 days after subscription ends
• Export available — You can export your data at any time before permanent deletion
• Permanent deletion — After 30 days, all Personal Data is permanently and irreversibly deleted from our systems, including backups (within 90 days of subscription end for backup rotations)
• Exceptions — We may retain limited data where required by law (e.g., financial records for 7 years) or to establish/defend legal claims

We will provide written confirmation of deletion upon request.

12. Audits and Compliance

Upon reasonable written request and with at least 30 days notice, Coactra will:

• Provide information necessary to demonstrate compliance with GDPR Article 28
• Allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you

Audits must:

• Be conducted during business hours (9am-5pm CET)
• Not disrupt our operations or other customers
• Be limited to once per year (unless required by supervisory authority or after a breach)
• Be subject to confidentiality obligations

You will bear the costs of audits. We may charge reasonable fees if audits require significant resources.

13. Liability and Indemnification

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service.

Coactra is liable only for damages caused by processing that:

• Violates obligations specifically directed to Processors under GDPR, or
• Is outside of or contrary to your lawful instructions

Coactra is not liable for damages caused by your failure to comply with your obligations as Controller.

14. Term and Termination

This DPA takes effect on the date you first use the Services to process Personal Data and continues for the duration of your subscription.

Upon termination of your subscription, the data return and deletion provisions in Section 11 apply.

15. Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the laws of the Republic of Rwanda.

Any disputes relating to this DPA shall be subject to the dispute resolution provisions in the Terms of Service (good-faith negotiation → mediation → arbitration/courts in Kigali, Rwanda).

EU residents may lodge complaints with their local data protection supervisory authority or bring proceedings in their member state of residence, notwithstanding the above.

16. Contact

For questions about this DPA or data protection:

Email: legal@coactra.com

Data Protection Inquiries: privacy@coactra.com