https://getcor.ai/assets/DataProcessingAgreement-BW1pWPCm.js

1import{j as e,a}from"./vendor-react-Bz_ZsvSD.js";import{V as b,P as g,b as y,E as j,D as v}from"./index-CnUkSChN.js";import{g as P,L as w}from"./LegalToc-B_ryUPCs.js";import{A as s,a as t}from"./ArticleH2-DKFlSFJq.js";import"./vendor-wouter-B0CVBZTb.js";import"./vendor-framer-Be2PyxnT.js";const c=[{id:"definitions",label:"1. Definitions"},{id:"scope-and-roles",label:"2. Scope and Roles of the Parties"},{id:"confidentiality",label:"3. Confidentiality"},{id:"processing-restrictions",label:"4. Processing Restrictions"},{id:"individuals-rights",label:"5. Assistance with Individuals' Rights"},{id:"subprocessors",label:"6. Subprocessors"},{id:"remediation",label:"7. Remediation"},{id:"data-breaches",label:"8. Data Breaches"},{id:"audits-compliance",label:"9. Audits and Compliance"},{id:"return-destruction",label:"10. Return or Destruction"},{id:"certification",label:"11. Certification"},{id:"governing-law",label:"12. Governing Law and Miscellaneous"},{id:"annex-a",label:"Annex A: Details of Processing"},{id:"annex-b",label:"Annex B: Subprocessor List"}];function C(){return e.jsxs("svg",{xmlns:"http://www.w3.org/2000/svg",width:"20",height:"20",viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round",children:[e.jsx("path",{d:"M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"}),e.jsx("polyline",{points:"7 10 12 15 17 10"}),e.jsx("line",{x1:"12",y1:"15",x2:"12",y2:"3"})]})}function A(){const[p,f]=a.useState(c[0].id),[l,h]=a.useState(!1);a.useEffect(()=>{const r=new Set,m=[];for(const{id:i}of c){const n=document.getElementById(i);n&&m.push({id:i,el:n})}const u=new IntersectionObserver(i=>{for(const o of i){const d=o.target.getAttribute("data-toc-id");d&&(o.isIntersecting?r.add(d):r.delete(d))}const n=c.find(o=>r.has(o.id));n&&f(n.id)},{rootMargin:"-100px 0px -60% 0px",threshold:0});for(const{id:i,el:n}of m)n.setAttribute("data-toc-id",i),u.observe(n);return()=>u.disconnect()},[]);const x=a.useCallback(async()=>{if(!l){h(!0);try{y("legal_doc_download",{doc:"data-processing-agreement"}),await new Promise(r=>{setTimeout(()=>{P("dpa-content","Data Processing Agreement","Cor_Data_Processing_Agreement.pdf"),r()},0)})}finally{h(!1)}}},[l]);return e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"px-6 lg:px-14 pt-16 pb-10",children:[e.jsx(j,{className:"mb-6",children:"Legal"}),e.jsxs("div",{className:"flex items-start justify-between gap-4",children:[e.jsx("h1",{className:"font-['Inter_Display'] text-[40px] md:text-[52px] xl:text-[64px] font-semibold tracking-[-0.04em] leading-[1.05] mb-0 text-black",children:"Data Processing Agreement"}),e.jsx("button",{onClick:x,disabled:l,"aria-label":"Download data processing agreement",className:"shrink-0 mt-3 text-neutral-500 hover:text-black transition-colors duration-200 cursor-pointer disabled:opacity-40 disabled:cursor-wait",children:e.jsx(C,{})})]}),e.jsxs("p",{className:"text-lg md:text-xl text-neutral-500 leading-8 mt-6 font-['Inter_Display']",children:["This Data Processing Addendum (",e.jsx("strong",{className:"text-black font-semibold",children:'"DPA"'}),") is entered into between ",e.jsx("strong",{className:"text-black font-semibold",children:"Corellian Systems Pty Ltd ABN 26 676 657 364"}),` trading as Cor ("Cor") and the customer identified in the Agreement ("Customer"). This DPA is attached to and incorporated by reference into the order form, subscription agreement, or other written agreement between the Parties for Cor's services (the "Agreement"), and is executed together with, and forms part of, that Agreement. All capitalised terms used but not defined in this DPA have the meaning given in the Agreement. To the extent of any conflict or inconsistency between this DPA and the remaining terms of the Agreement, this DPA will govern with respect to the subject matter herein.`]}),e.jsx("p",{className:"text-lg md:text-xl text-neutral-500 leading-8 mt-4 font-['Inter_Display']",children:"This DPA sets out the terms that apply when Personal Information is Processed by Cor on behalf of the Customer under the Agreement. The purpose of this DPA is to ensure such Processing is conducted in accordance with the Privacy Act and to respect the privacy of individuals whose Personal Information is Processed under the Agreement."})]}),e.jsx(v,{}),e.jsx("section",{className:"bg-white border-b border-zinc-300",children:e.jsxs("div",{className:"flex items-stretch",children:[e.jsx("div",{className:"hidden lg:block w-[30%] shrink-0 border-r border-neutral-200 lg:pl-6 xl:pl-14 pr-8 pt-8 lg:pb-16 xl:pb-20",children:e.jsx(w,{tocItems:c,activeId:p})}),e.jsxs("div",{id:"dpa-content",className:"min-w-0 flex-1 px-6 md:px-8 lg:pl-8 lg:pr-12 xl:pr-24 pt-8 pb-8 md:pb-10 lg:pb-16 xl:pb-20 space-y-16 md:space-y-20 text-neutral-500 leading-7 text-base font-['Inter_Display']",children:[e.jsxs("section",{children:[e.jsx(s,{id:"definitions"}),e.jsx(t,{num:"01",noBorder:!0,children:"Definitions"}),e.jsxs("div",{className:"space-y-4",children:[e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"Privacy Act"'}),` means the Privacy Act 1988 (Cth), including the Australian Privacy Principles set out in Schedule 1 to that Act (the "APPs") and the Notifiable Data Breaches scheme in Part IIIC of that Act, in each case as amended from time to time, together with any other data protection or privacy law applicable to Cor's Processing of Personal Information under the Agreement.`]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"Business Purposes"'})," means Cor's provision of the services to Customer in accordance with the Agreement."]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"Personal Information"'})," has the meaning given in the Privacy Act, and includes Sensitive Information as defined in that Act."]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"Customer Personal Information"'})," means Personal Information Processed by Cor on behalf of the Customer to provide the services to Customer."]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"Process"'})," and ",e.jsx("strong",{className:"text-black font-semibold",children:'"Processing"'})," mean any operation or set of operations performed on Customer Personal Information, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction."]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"Eligible Data Breach"'})," has the meaning given in the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act."]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"Security Event"'})," means a breach of Cor's security leading to any of the following: (i) unauthorised Processing, use, or disclosure of Personal Information; (ii) unauthorised access to or acquisition of Personal Information or the systems on which Personal Information is Processed; (iii) any significant corruption or loss of Personal Information that Cor is unable to repair within a minimal period of time; or (iv) any event that has, or is reasonably likely to, significantly disrupt the Processing of Personal Information as part of the services, but not including any routine, unsuccessful events such as pings, port scans, blocked malware, failed log-in attempts, or denial of service attacks."]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"Subprocessor"'})," means any third party engaged by Cor to Process Customer Personal Information in connection with the provision of the services."]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-black font-semibold",children:'"OAIC"'})," means the Office of the Australian Information Commissioner."]})]})]}),e.jsxs("section",{children:[e.jsx(s,{id:"scope-and-roles"}),e.jsx(t,{num:"02",children:"Scope and Roles of the Parties"}),e.jsx("p",{children:"Cor acknowledges and agrees that certain Customer Personal Information that Customer disclose

1s to Cor under the Agreement is or may become subject to the Privacy Act. The Parties agree that, with respect to such Customer Personal Information, Customer determines the purposes and means of the Processing and Cor Processes such Customer Personal Information only on behalf of, and in accordance with the reasonable instructions of, the Customer."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"confidentiality"}),e.jsx(t,{num:"03",children:"Confidentiality"}),e.jsx("p",{children:"Cor shall ensure that the persons it authorises to Process Customer Personal Information are subject to a duty of confidentiality, whether by contract or under an appropriate statutory obligation of confidentiality."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"processing-restrictions"}),e.jsx(t,{num:"04",children:"Processing Restrictions"}),e.jsx("p",{className:"mb-4",children:"Cor will Process Customer Personal Information solely (1) to fulfil its obligations to Customer for performance of the Business Purposes under the Agreement, including this DPA; (2) on Customer's behalf; and (3) in compliance with the Privacy Act. Cor will:"}),e.jsxs("div",{className:"space-y-3",children:[e.jsx("p",{children:"Process Customer Personal Information only as reasonably necessary to provide the services and as instructed by the Customer, and not for any other purpose;"}),e.jsx("p",{children:"not use, retain, or disclose Customer Personal Information for any purpose other than the Business Purposes, unless required or authorised by law;"}),e.jsx("p",{children:"not sell, or disclose for valuable consideration, any Customer Personal Information to any third party;"}),e.jsx("p",{children:"handle Customer Personal Information in accordance with the Australian Privacy Principles to the extent applicable to the services;"}),e.jsx("p",{children:"take reasonable steps to implement and maintain appropriate administrative, technical, physical, and organisational measures to protect Customer Personal Information from misuse, interference, loss, and unauthorised access, modification, or disclosure;"}),e.jsx("p",{children:"not transfer, or permit access to, Customer Personal Information outside Australia except as disclosed to the Customer or otherwise permitted under the Agreement, and in accordance with APP 8; and"}),e.jsx("p",{children:"promptly notify Customer if Cor determines that it can no longer meet its obligations under this DPA or the Privacy Act."})]}),e.jsx("p",{className:"mt-4",children:"The nature and purpose of the Processing, the categories of Personal Information, and the categories of individuals are described in Annex A."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"individuals-rights"}),e.jsx(t,{num:"05",children:"Assistance with Individuals' Rights"}),e.jsx("p",{children:"Cor shall provide reasonable assistance to Customer in fulfilling Customer's obligations under the Privacy Act to respond to requests from individuals (or their authorised representatives) to access, correct, or deal with their Personal Information, and to Customer's obligations under the Australian Privacy Principles more generally."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"subprocessors"}),e.jsx(t,{num:"06",children:"Subprocessors"}),e.jsx("p",{className:"mb-4",children:"6.1. Customer acknowledges and agrees that Cor may use Cor affiliates and other Subprocessors to Process Customer Personal Information in accordance with this Section 6 and the Privacy Act. Where Cor sub-contracts any of its rights or obligations concerning Customer Personal Information, including to any affiliate, Cor will: (i) take reasonable steps to select and retain Subprocessors capable of maintaining appropriate privacy and security measures to protect Customer Personal Information consistent with the Privacy Act; and (ii) require that each Subprocessor is bound by obligations no less restrictive than those imposed on Cor under this DPA. Cor remains responsible for the acts and omissions of its Subprocessors with respect to Customer Personal Information as if such acts or omissions were Cor's own."}),e.jsx("p",{children:"6.2. Cor has provided a current list of its Subprocessors in Annex B, and Customer consents to Cor's use of such Subprocessors. Customer acknowledges that the services are built on rapidly evolving third-party AI technologies and that the Subprocessor list will change from time to time as Cor's technology stack evolves; updates to the Subprocessor list made in accordance with this Section 6 do not require an amendment to this DPA or the Agreement. Cor will maintain an up-to-date list of its Subprocessors and will provide Customer with at least fourteen (14) days' notice of any new Subprocessor added to the list prior to transferring or making available Customer Personal Information to such new Subprocessor. Notice will be given by email to Customer's nominated contact. If Customer objects to a new Subprocessor on reasonable grounds relating to privacy or data protection, Customer may, as its sole and exclusive remedy, terminate the Agreement by written notice to Cor before the new Subprocessor commences Processing of Customer Personal Information, in 

1which case the termination will take effect at the end of the then current Term and Cor will refund any prepaid Fees for the period after termination. Cor will disclose in Annex B the country in which each Subprocessor Processes Customer Personal Information for the purposes of APP 8."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"remediation"}),e.jsx(t,{num:"07",children:"Remediation"}),e.jsx("p",{children:"Customer shall have the right, upon fourteen (14) days' written notice, to take reasonable and appropriate steps to stop and remediate unauthorised Processing of Customer Personal Information."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"data-breaches"}),e.jsx(t,{num:"08",children:"Data Breaches"}),e.jsx("p",{className:"mb-4",children:"In the event of a discovered Security Event, Cor shall provide notice to Customer without undue delay, and in any event no more than seventy-two (72) hours following such discovery. Cor's notice shall include the following information to the extent reasonably available at the time, and Cor shall update its notice as additional information becomes reasonably available: (i) the dates and times of the Security Event; (ii) the facts underlying its discovery or the decision to investigate; (iii) a description of the Personal Information involved, either specifically or by reference to the data set(s); and (iv) the measures planned or underway to remedy or mitigate the vulnerability."}),e.jsx("p",{className:"mb-4",children:"Cor will take those measures available, including measures reasonably requested by Customer, to address the vulnerability, mitigate the resulting harm, and prevent similar occurrences. Cor will provide reasonable assistance to Customer in relation to Customer's obligations under the Notifiable Data Breaches scheme, including assessing whether an Eligible Data Breach has occurred and, where required, notifying affected 

1individuals and the OAIC."}),e.jsx("p",{children:"Except to the extent required by law or as reasonably required by Cor's investigation or other contractual obligations, Cor will not disclose to any third party the existence of a Security Event or any related investigation without Customer's prior written consent."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"audits-compliance"}),e.jsx(t,{num:"09",children:"Audits and Compliance"}),e.jsx("p",{children:"Cor will demonstrate its compliance with this DPA by making available to Customer, not more than once every twelve (12) calendar months and upon reasonable prior written notice, (i) Cor's then-current SOC 2 Type II report (or equivalent independent third-party attestation) and (ii) responses to reasonable written security and privacy questionnaires. The Parties agree that the provision of such report and questionnaire responses satisfies Customer's audit and inspection rights under this DPA, and Cor shall not be required to permit on-site audits or physical inspections of its facilities."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"return-destruction"}),e.jsx(t,{num:"10",children:"Return or Destruction"}),e.jsx("p",{children:"Except to the extent otherwise required by law, Cor will, at Customer's choice, return to Customer and/or securely destroy or de-identify all Customer Personal Information upon Customer's written request, in accordance with APP 11.2."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"certification"}),e.jsx(t,{num:"11",children:"Certification"}),e.jsx("p",{children:"Cor certifies that it understands and will comply with its obligations under this DPA."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"governing-law"}),e.jsx(t,{num:"12",children:"Governing Law and Miscellaneous"}),e.jsx("p",{children:"This DPA is governed by the laws of the State of Victoria, Australia, and the Parties submit to the non-exclusive jurisdiction of the courts of that State, unless the Agreement specifies a different governing law and jurisdiction, in which case that governing law and jurisdiction will apply to this DPA. The term of this DPA corresponds to the term of the Agreement and any subsequent agreements referencing it between the Parties. Provisions which by their nature are intended to survive termination or expiration of this DPA will continue and survive. This DPA is executed together with the Agreement and does not require separate signature; execution of the Agreement constitutes acceptance of this DPA."})]}),e.jsxs("section",{children:[e.jsx(s,{id:"annex-a"}),e.jsx(t,{num:"A",children:"Annex A: Details of Processing"}),e.jsxs("div",{className:"space-y-6",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-semibold text-black mb-2",children:"Nature and purpose of the Processing"}),e.jsx("p",{children:"Cor's provision of its voice AI services to Customer and its authorised users as described in the Agreement, which may include transcription of session audio to text, post-session redaction of personal information, and generation of in-session guidance via third-party large language model providers (currently OpenAI, Anthropic, and Google)."})]}),e.jsxs("div",{children:[e.jsx("p",{className:"font-semibold text-black mb-2",children:"Duration of the Processing"}),e.jsx("p",{children:"For the term of the Agreement between the Parties."})]}),e.jsxs("div",{children:[e.jsx("p",{className:"font-semibold text-black mb-2",children:"Categories of Personal Information involved"}),e.jsx("p",{children:"Voices and spoken statements of users; names, contact information, and other identifiers spoken or otherwise provided during sessions; and any other Personal Information disclosed by or on behalf of Customer or its users in the course of using the services."})]}),e.jsxs("div",{children:[e.jsx("p",{className:"font-semibold text-black mb-2",children:"Categories of individuals"}),e.jsx("p",{children:"Customer's personnel and authorised users; Customer's own customers or clients; and any end users or other individuals whose Personal Information is provided to or Processed by the services in connection with the Agreement."})]})]})]}),e.jsxs("section",{children:[e.jsx(s,{id:"annex-b"}),e.jsx(t,{num:"B",children:"Annex B: Subprocessor List"}),e.jsx("p",{className:"mb-6",children:"The following Subprocessors are engaged by Cor in connection with the provision of the services. Customer acknowledges that, because the services depen

1d on rapidly evolving AI technologies, this list will be updated from time to time as Cor's technology stack evolves. Changes are notified in accordance with Section 6 of this DPA and do not require an amendment to this DPA or the Agreement. Locations are disclosed for the purposes of APP 8 (cross-border disclosure)."}),e.jsx("div",{className:"overflow-x-auto -mx-6 md:-mx-8 lg:-mx-12 xl:-mx-24 px-6 md:px-8 lg:px-12 xl:px-24",children:e.jsxs("table",{className:"w-full text-sm border-collapse min-w-[600px]",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"border-b border-zinc-300",children:[e.jsx("th",{className:"text-left py-3 pr-4 font-semibold text-black font-['Inter_Display'] w-[22%]",children:"Subprocessor"}),e.jsx("th",{className:"text-left py-3 pr-4 font-semibold text-black font-['Inter_Display'] w-[18%]",children:"Country"}),e.jsx("th",{className:"text-left py-3 pr-4 font-semibold text-black font-['Inter_Display'] w-[30%]",children:"Processing Activity"})]})}),e.jsxs("tbody",{className:"divide-y divide-zinc-200",children:[e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"Amazon Web Services"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"Hosting"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"Deepgram"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"Transcription + Voice"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"ElevenLabs"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"Transcription + Voice"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"Cartesia"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"Voice"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"OpenAI"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"LLMs + Voice"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"Google"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"LLMs + Voice"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"Anthropic"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"LLMs"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"Cerebras Systems Inc."}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"LLMs"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"Sentry"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"Error telemetry"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-black font-medium",children:"PostHog"}),e.jsx("td",{className:"py-3 pr-4",children:"USA"}),e.jsx("td",{className:"py-3 pr-4",children:"Product analytics"})]})]})]})})]})]})]})})]})}function B(){return e.jsxs(b,{ctaHref:"/book-a-demo",children:[e.jsx(g,{path:"/dpa"}),e.jsx(A,{})]})}export{B as default};