C
CoheraWork™

Last updated · 6 May 2026

Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Terms of Service and reflects the parties' agreement on the processing of personal data under GDPR Article 28 and equivalent regimes.

1. Roles

You (the customer organisation) are the Controller. CoheraWork is the Processor.

2. Scope and purpose

CoheraWork processes personal data only to deliver the calibration programme purchased and to meet legal obligations.

3. Categories of data subjects and data

  • Subjects: your nominated participants and administrators.
  • Data: name, work email, role, organisational context, programme responses, scores, certificates, audit events.

4. Sub-processors

We use the sub-processors listed in our Privacy Policy §4. We will give 30 days' notice of new sub-processors; you may object on reasonable data-protection grounds.

5. Security

See the Trust Center. RLS on every table, encryption in transit and at rest, signed-URL file access, audit-event log.

6. Personal data breach

We will notify the Controller without undue delay and within 72 hours of confirmation of a personal data breach affecting Controller data.

7. Data subject rights

We will assist Controllers with access, rectification, erasure, restriction, and portability requests via the in-app tooling and, where needed, manual export.

8. International transfers

Standard Contractual Clauses (EU 2021/914) and the UK IDTA apply where data leaves the EEA / UK. Transfer impact assessments available on request.

9. Audit

Annual SOC 2 Type II report (when available) and on-request security questionnaires. On-site audits by negotiation for enterprise customers.

10. Term and deletion

This DPA lasts for the term of the underlying agreement. On termination we delete or return Controller data within 30 days unless legally required to retain it.

11. Sign-off

Enterprise customers can request a counter-signed DPA at legal@cohera.work.

This DPA will be finalised by counsel before live commercial use. Where a negotiated DPA is signed, it supersedes this template.