Data Processing Addendum
1. Roles and scope
For personal data contained in workspace content, the customer is the controller and Kordvik is the processor within the meaning of Art. 28 GDPR. This DPA applies for as long as Kordvik processes such data on the customer's behalf.
2. Subject matter of processing
| Description | |
|---|---|
| Nature & purpose | Hosting, storage, display, document-field extraction, analysis, reminder delivery, and export of vendor/contract records at the customer's instruction. |
| Data categories | Business contact details (names, emails, phone numbers of vendor contacts and workspace members), contract terms and financial amounts, content of uploaded contract documents. |
| Data subjects | The customer's workspace members, and its vendors' contact persons. |
| Duration | Until the customer deletes the data, the workspace, or the account, or the agreement ends. |
3. Instructions
Kordvik processes workspace content only on documented instructions from the customer — given through the product's features and settings — unless EU or member-state law requires otherwise, in which case Kordvik informs the customer before processing (unless the law prohibits it).
4. Confidentiality and personnel
Persons authorised to process the data are bound by confidentiality obligations and access data only as needed to operate and support the service.
5. Security measures (Art. 32)
- Tenant isolation: all data is partitioned per workspace with role-based access control enforced server-side.
- Encryption in transit (TLS) and encryption at rest for integration credentials (OAuth tokens).
- Authentication hardening: password policy, account lockout, per-IP rate limiting, optional 2FA and passkeys.
- AI processing on Kordvik-operated infrastructure — no contract content is sent to third-party AI providers.
- Audit logging of data-changing actions at workspace and platform level.
- Nightly backups with a documented restore procedure.
Details: kordvik security page.
6. Subprocessors
The customer authorises the following subprocessors. Kordvik will give notice (email or in-app) before adding or replacing a subprocessor, and the customer may object on reasonable data-protection grounds.
| Subprocessor | Purpose | Location | Safeguard |
|---|---|---|---|
| Stripe, Inc. | Payment processing and billing | US/EU | EU–US DPF / SCCs |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | US | SCCs |
| Cloudflare, Inc. | DNS, TLS, network security | EU/US (global network) | EU–US DPF / SCCs |
| Sentry (Functional Software, Inc.) | Error monitoring (only when enabled) — technical error reports, which may include a user ID and request metadata | EU/US | EU–US DPF / SCCs |
| [Hosting provider — to be confirmed at production deployment] | Application & database hosting | EU (planned) | — |
Connected services are not subprocessors. Services the customer connects itself (Slack, Microsoft Teams, Google Drive, OneDrive, SharePoint, Outlook) receive data at the customer's instruction under the customer's own agreements with those providers.
7. Assistance
Kordvik assists the customer, insofar as possible, in fulfilling data-subject requests (much of which is self-serve: in-product edit, export, and deletion) and in meeting its obligations under Arts. 32–36 GDPR.
8. Personal data breaches
Kordvik notifies the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information reasonably required for the customer's own notification duties.
9. Deletion and return
On termination, or when the customer deletes a workspace or account, the associated content is deleted from production systems promptly and expires from backups within the backup rotation window (at most 35 days), unless EU or member-state law requires longer storage. Export tools (CSV, personal-data download) are available in-product at any time before deletion.
10. Audits
Kordvik makes available the information reasonably necessary to demonstrate compliance with Art. 28 and allows audits by the customer or its mandated auditor, at reasonable intervals and notice, in a manner that does not endanger other customers' data.
11. International transfers
Where subprocessing involves transfers outside the EU/EEA, the safeguards listed in the subprocessor table apply (EU–US Data Privacy Framework and/or Standard Contractual Clauses).