Data Processing Agreement

1. Roles

For personal data your organization ("Controller") enters into Kora, Kora acts as Processor, processing that data solely to provide the service and on Controller's documented instructions.

2. Subject matter and duration

Processing covers the categories of personal data your enabled modules handle (e.g. employee records under HR, contact details under CRM) for the duration of your subscription.

3. Sub-processors

Kora uses infrastructure and integration sub-processors necessary to operate the service (hosting, email delivery, and any third-party integration you explicitly connect). A current list is available on request.

4. Security measures

Tenant-scoped data isolation, encrypted transport, permission-based access control, and audit logging, as described on the Security page.

5. Data subject requests

Where Kora receives a data subject request relating to Controller's data, it will forward the request to Controller promptly rather than act on it directly, unless legally required otherwise.

6. International transfers

Where data is transferred across borders, appropriate safeguards are put in place consistent with applicable law.

7. Deletion on termination

On termination, Controller data is deleted or returned per the retention terms in the Privacy Policy, unless retention is required by law.