CoSprint Data Processing Addendum

1. Processing entrusted

Processing lasts for the term of the agreement under the Terms of Service.

2. Purpose limitation

We process personal data only on the Customer's instructions and under this addendum, never for other purposes or for third parties, and never to train AI models. We tell the Customer at once if we believe an instruction breaks the law.

3. Customer responsibilities

As controller, the Customer must have a lawful basis for processing and give data subjects the notices and obtain the consents the law requires.

For AI performance reviews, before connecting work tools and having employees' records read, the Customer must complete the employee notice, consent and works-council or union consultation its internal rules and the law require. We may supply a draft notice but do not notify employees ourselves, and we provide the Service on the basis that the Customer has completed these steps.

4. Security

• Encryption in transit and at rest; work-tool credentials stored encrypted
• Each customer's data kept separate
• Staff access to personal data kept to a minimum, with access control and access logs
• In AI performance reviews, original work-tool text is not stored: it sits in an encrypted processing queue during analysis and is then deleted
• Confidentiality undertakings and regular training for staff

5. Sub-processors

We may engage the sub-processors listed at www.cosprint.ai/subprocessors, binding each by contract to duties equivalent to this addendum. We give 30 days' notice of additions or changes, during which the Customer may object.

6. International transfers

Personal data may be transferred abroad to sub-processors. We meet the requirements of Article 28-8 of the Personal Information Protection Act and other applicable law, and bind recipients to protection equivalent to this addendum.

7. Data subject requests

If a data subject asks us to access, correct, delete or stop processing their data, we forward the request to the Customer without delay and give the Customer the tools and information it needs to respond.

8. Personal data breaches

We notify the Customer without delay, and within 24 hours at the latest, of any breach affecting entrusted data, with the data involved, what happened, the steps taken and what the Customer needs to do, and we help the Customer meet its own reporting and notification duties.

9. Audits

The Customer may request information to verify our compliance, and we provide reasonable material such as a security overview and assessment results. On-site audits are arranged with 30 days' notice during business hours.

10. Return and deletion

When the agreement ends we let the Customer export its data, then delete entrusted personal data held by us and our sub-processors within 30 days and issue a deletion certificate. Data the law requires us to keep is held separately until then deleted.

11. Liability

We are liable for loss caused to the Customer or data subjects by our breach of this addendum, subject to the limitation of liability in the Terms of Service, except where the law does not allow it to be limited.

12. Other countries' law

Where the Customer or data subjects are outside Korea and local privacy law applies — such as Japan's APPI or the EU GDPR — we also meet the duties that law places on processors and, where needed, sign additional documents such as standard contractual clauses.