Data Processing Agreement

1. Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Cortium Inc. ("Processor") and the customer ("Controller"). It governs the processing of personal data by Cortium on behalf of the customer.

2. Data Processing Details

Cortium processes data solely for the purpose of providing the AI decision engine service. This includes analyzing support requests, generating decisions, storing feedback, and improving decision quality for the customer's organization.

3. Security Measures

Cortium implements appropriate technical and organizational measures to protect personal data, including encryption at rest and in transit, access controls, regular security testing, and incident response procedures.

4. Sub-processors

Cortium may engage sub-processors to assist in providing the service. We maintain a list of current sub-processors and will notify customers of any changes. Sub-processors are bound by equivalent data protection obligations.

5. Data Subject Rights

Cortium will assist the Controller in responding to data subject requests (access, rectification, erasure, portability) to the extent technically feasible and as required by applicable law.

6. Data Retention & Deletion

Upon termination of the agreement, Cortium will delete or return all personal data within 30 days, unless retention is required by applicable law. Customers may request data export at any time during the term.

7. Contact

For DPA-related inquiries or to request a signed copy, contact [email protected] with "DPA" in the subject line.