Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") applies between SlateCore App (the Processor) and the Customer (the Controller) when the Customer processes personal data via the Service. It forms part of the Terms of Service and the Privacy Policy.

This DPA is pre-approved and applies automatically when a Customer required by its jurisdiction to have a written agreement (typically EU customers under GDPR) uses the Service. No additional signature is required — workspace creation constitutes acceptance. If your organization requires a signed DPA on letterhead, write to legal@slatecore.app.

• Customer / Controller: the person or entity contracting the Service.
• SlateCore App / Processor: the operator of the Service.
• Personal Data: any information related to an identified or identifiable natural person, as defined by applicable legislation (LFPDPPP, GDPR, CCPA, etc.).
• Processing: any operation performed on Personal Data (collection, storage, retrieval, modification, deletion, etc.).
• Subprocessor: any third party engaged by SlateCore App to process Personal Data on behalf of the Customer. Current list at /subprocessors.

The Customer is the Controller of the Personal Data uploaded or processed through the Service (including data of its team, collaborators, directory contacts, CRM leads, data room invitees, submission authors, etc.). SlateCore App acts as Processor and processes Personal Data only according to the Customer's documented instructions, materialized through the choice of Service features.

Subject matter: provision of the SlateCore App service to the Customer per the Terms of Service.

Nature: storage, organization, indexing, display and limited processing of Personal Data so the Customer's team can work with it.

Duration: while the Customer's account is active, plus the post-cancellation retention periods described in the Privacy Policy.

Categories of data subjects: workspace users, invited collaborators, directory contacts, leads, data room invitees, public booking visitors, submission senders.

Categories of data: as described in §3 of the Privacy Policy.

SlateCore App agrees to:

• Process Personal Data only according to documented Customer instructions.
• NOT use Personal Data for its own purposes (no selling, no profiling, no AI model training, no advertiser sharing).
• Ensure that personnel with access to Personal Data are subject to appropriate confidentiality obligations.
• Implement reasonable technical and organizational security measures (see /security).
• Assist the Customer in fulfilling its obligations to respond to data subject rights (ARCO, GDPR, CCPA, LGPD, etc.).
• Notify the Customer without undue delay of any security breach affecting its Personal Data.
• Return or delete Personal Data at the end of the Service per Customer instructions, subject to applicable legal retention periods.

The Customer authorizes SlateCore App to engage Subprocessors for the provision of the Service. Current list available at /subprocessors.

SlateCore App will notify any addition or material change of Subprocessor with at least 15 days' prior notice to active accounts via email. The Customer may object to a new Subprocessor on reasonable grounds related to Personal Data protection by writing to legal@slatecore.app within 15 days of notification. If the objection cannot be resolved, the Customer may terminate the Service without penalty.

For Mexican customers: transfers to Subprocessors located in the United States are deemed consented under LFPDPPP upon acceptance of this DPA and the Privacy Policy for the rendering of the Service.

For European Union customers: international transfers are covered by the Standard Contractual Clauses (Module 2: Controller to Processor) approved by the European Commission (Decision 2021/914/EU), incorporated into this DPA by reference. A signed copy is available upon request by writing to legal@slatecore.app.

SlateCore App provides the Customer with reasonable technical tools to respond to data subject requests (access, rectification, deletion, objection, portability). When a request reaches SlateCore App directly regarding Personal Data under the Customer's control, SlateCore App will direct the data subject to contact the Customer and will notify the Customer when appropriate.

The Customer may request reasonable information about SlateCore App's security and compliance measures by writing to security@slatecore.app. For formal audits required by applicable legislation, the parties will coordinate the terms in good faith (scope, schedule, auditor costs, confidentiality). SlateCore App may satisfy audit obligations through existing audit reports of its Subprocessors (e.g. Supabase SOC 2) when adequate.

SlateCore App will notify the Customer without undue delay (and within 72 hours when technically feasible) upon discovery of any security breach affecting their Personal Data. The notification will include: nature of the incident, categories and approximate volume of Personal Data affected, possible consequences, measures adopted and proposed to mitigate the harm.

At the end of the Service, the Customer has a 30-day grace period to export their data. After that period, the Customer's Personal Data is progressively deleted from the Service per the retention periods described in Privacy Policy §12. Encrypted backups are overwritten within the retention cycle (up to 12 weeks).

This DPA enters into force upon acceptance of the Terms of Service and remains in force while the Customer uses the Service. Clauses that by their nature must survive termination (confidentiality, liability, governing law) will continue in effect after.

This DPA is governed by the same applicable law as the Customer's Terms of Service. Where GDPR or other mandatory local law applies, its provisions prevail over any incompatible provision of this DPA.

• Privacy and ARCO rights: privacy@slatecore.app
• Security and incidents: security@slatecore.app
• Legal matters and signed DPA requests: legal@slatecore.app