Data Processing Addendum

This Data Processing Addendum ("DPA") is intended to describe how Coefficient Analytics processes personal data on behalf of customers when providing the platform, and to reflect commitments consistent with applicable data protection law. This draft outlines the intended structure of that agreement and has not been finalized by legal counsel.

Terms such as "personal data," "processing," "controller," and "processor" are intended to carry the meanings given to them under applicable data protection law (for example, the GDPR, where relevant). Final definitions will be included once this document is completed.

In general, we anticipate that the customer acts as the data controller for personal data it connects to or uploads into the platform, and that Coefficient Analytics acts as a data processor (or service provider), processing that data solely on the customer's documented instructions and for the purpose of providing the service.

We expect to engage a limited number of sub-processors to help operate the platform — for example, providers of cloud hosting, email delivery, and analytics infrastructure. Sub-processors would be bound by data protection obligations consistent with this addendum.

A specific, named and kept-current list of sub-processors will be published here once our infrastructure and vendor selections are finalized, along with a process for customers to be notified of changes.

The conceptual expectation is that customer data is hosted in a defined set of regions, with appropriate safeguards applied to any international transfers. Specific hosting regions and transfer mechanisms (such as standard contractual clauses, where applicable) will be documented once our infrastructure is finalized.

We anticipate implementing security measures consistent with industry practice, potentially including:

• Encryption of data in transit and at rest.
• Access controls and role-based permissions within the platform.
• Logging and monitoring of access to production systems.
• Regular review of security practices as the platform matures.

Specific certifications or audit commitments (such as SOC 2 or ISO 27001) are not claimed here and will only be referenced once genuinely obtained and verifiable.

We intend to provide reasonable assistance to customers responding to data subject requests (such as access, correction, or deletion requests) concerning personal data processed on their behalf. The specific process and timelines for this assistance will be defined once finalized.

In the event of a confirmed personal data breach affecting customer data, we intend to notify affected customers without undue delay. A specific notification timeline (e.g., within a defined number of hours) will be committed to once finalized, rather than presented as binding in this draft.

Upon termination of a customer's subscription, we anticipate deleting or returning customer data within a defined period, subject to any legal retention obligations. The specific retention window will be finalized and documented here.

Questions about this placeholder DPA, or requests for an executed DPA once available, can be sent to sales@domain.com.