# CoreForge Data — Data Processing Addendum (Standard Form)

**Last updated:** 2026-06-20
**Controller:** Customer (as defined in the Master Subscription Agreement)
**Processor:** CoreForge Data, Inc. ("CoreForge")

This DPA forms part of the Master Subscription Agreement ("Agreement") between
Customer and CoreForge and applies whenever CoreForge processes Personal Data
on behalf of Customer in connection with the Services.

---

## 1. Definitions
Capitalised terms not defined here have the meanings given in the GDPR, UK GDPR,
or CCPA/CPRA as applicable.

## 2. Roles of the Parties
Customer is the **Controller** (or Business under CCPA). CoreForge is the
**Processor** (or Service Provider under CCPA) and shall process Personal Data
only on the documented instructions of Customer, including instructions in the
Agreement and the Services configuration.

## 3. Nature, Purpose, Duration
| Element | Description |
| --- | --- |
| Subject matter | Provision of B2B prospecting, enrichment, and intent data services |
| Duration | Term of the Agreement plus a 30-day deletion window |
| Nature | Collection, organisation, storage, retrieval, use, transmission, deletion |
| Purpose | Operating the Services for Customer |
| Categories of data | Business contact data (name, work email, work phone, job title, employer, public professional profile data, intent signals) |
| Categories of data subjects | Customer's prospects and end users of Customer's website who are tracked via Customer-installed scripts |

## 4. Security Measures (Annex II)
CoreForge implements appropriate technical and organisational measures
including, without limitation: encryption in transit (TLS 1.2+) and at rest
(AES-256), role-based access control with least privilege, MFA for all
privileged accounts, vulnerability management, secure SDLC, logging, intrusion
detection, and an annual third-party penetration test.

## 5. Subprocessors
Customer authorises CoreForge to engage the subprocessors listed at
https://coreforgedata.com/subprocessors. CoreForge will provide 30 days'
notice of material additions and offer Customer the right to object on
reasonable grounds related to data protection.

## 6. International Transfers
For transfers from the EEA, UK, or Switzerland to countries without an
adequacy decision, the EU Standard Contractual Clauses (Modules 2 and 3,
Commission Decision 2021/914) plus the UK Addendum are incorporated by
reference. CoreForge is the data importer.

## 7. Data Subject Requests
CoreForge will assist Customer in responding to data subject requests under
GDPR Articles 15-22 and CCPA §1798.105-130 within 30 days, subject to the
limitations of the Services. End-data-subject-direct requests submitted via
https://coreforgedata.com/data-request are honoured directly.

## 8. Personal Data Breach Notification
CoreForge will notify Customer without undue delay and in any event within 72
hours after becoming aware of a confirmed Personal Data Breach affecting
Customer's data, and will provide information reasonably required by Customer
to meet its own notification obligations.

## 9. Deletion and Return
On termination, CoreForge will delete or return all Personal Data within 30
days, except where retention is required by law. Backups are purged on the
standard backup rotation (≤ 90 days).

## 10. Audit Rights
Customer may, no more than once per year and on 30 days' written notice,
review CoreForge's most recent third-party audit report and submit reasonable
written questions to security@coreforgedata.com.

## 11. CCPA Service Provider Terms
CoreForge processes Personal Information only for the Business Purposes set
out in the Agreement, and does not (a) sell or share Personal Information, or
(b) retain, use, or disclose Personal Information outside the direct business
relationship between the parties, or for any commercial purpose other than the
Business Purposes.

## 12. Governing Law and Order of Precedence
This DPA is governed by the law specified in the Agreement. In the event of a
conflict between this DPA and the Agreement, this DPA prevails with respect to
the processing of Personal Data.

---

*For an executed counter-signed copy, contact legal@coreforgedata.com.*