1. Scope and roles
This Addendum applies when a customer uses Worcora™ to process personal data on the customer’s behalf. The customer is the controller and Worcora™ is the processor, unless the parties agree otherwise for a specific service such as account administration, billing, security, or support.
2. Processing instructions
Worcora™ processes personal data only to provide the subscribed CRM, integrations, communications, automation, support, and AI agent services, in accordance with the customer’s documented instructions and the customer’s agreement with Worcora™.
3. Confidentiality and security
Worcora™ requires authorized personnel to protect personal data and applies appropriate technical and organizational measures, including access control, encrypted credentials, HTTPS, audit records, approval controls, backups, and incident monitoring.
4. Subprocessors
Worcora™ may use hosting, email, payments, security, integration, and AI subprocessors needed to provide the service. Worcora™ remains responsible for their contractual data-protection obligations and will provide relevant information about subprocessors on request.
5. Assistance
Taking into account the nature of processing, Worcora™ will reasonably assist the customer with data-subject requests, security obligations, breach notifications, and regulatory inquiries. The customer remains responsible for its notices, lawful basis, retention decisions, and instructions.
6. Incidents and deletion
Worcora™ will notify the customer of a confirmed personal-data breach without undue delay after becoming aware of it, subject to applicable law. At the customer’s request and subject to legal retention duties, Worcora™ will delete or return personal data after termination.
7. International transfers
Transfers outside the EEA, UK, or Switzerland will use an applicable adequacy decision, standard contractual clauses, or another lawful transfer mechanism.
8. Contact
For DPA requests, contact support@worcora.com.