📄 Data Processing Agreement

1. Definitions

2. Scope and Applicability

This DPA applies when CarbonCore processes personal data on behalf of customers, including:

• User Account Information: Names, emails, contact details
• Territory Owner Data: Land ownership documents, verification records
• Expert and VVB Records: Professional credentials, verification reports
• Transaction Data: Payment information, carbon credit purchases
• Communication Records: Support tickets, email correspondence

3. Data Processing Principles

CarbonCore.Earth commits to processing data in accordance with the following principles:

4. Data Processor Obligations

4.1 Processing Instructions

CarbonCore shall:

• Process personal data only on documented instructions from Controller
• Immediately inform Controller if instructions violate GDPR or other data protection law
• Not transfer data outside EEA without Controller approval and appropriate safeguards
• Ensure any person acting under CarbonCore's authority processes data only on instructions

4.2 Confidentiality

CarbonCore ensures that persons authorized to process personal data:

• Are subject to binding confidentiality obligations (contractual or statutory)
• Receive appropriate training on data protection principles and GDPR
• Have access only to data necessary for their specific role
• Sign non-disclosure agreements before accessing personal data

4.3 Security Measures

CarbonCore implements the following technical and organizational measures:

Security Measure	Implementation
Encryption	AES-256 for data at rest, TLS 1.3 for data in transit
Access Control	Role-based permissions, multi-factor authentication
Monitoring	24/7 security monitoring, intrusion detection systems
Audit Logs	Comprehensive logging of all data access and modifications
Testing	Regular penetration testing, security audits
Backup	Encrypted daily backups with disaster recovery procedures

4.4 Sub-processors

CarbonCore may engage the following sub-processors:

Sub-processor	Service	Location
Amazon Web Services (AWS)	Cloud infrastructure and hosting	US-East-1 (Virginia)
Paypal	Payment processing	United States
AWS SES / SendGrid	Email delivery services	United States
Google Analytics	Platform analytics and monitoring	United States

5. Data Subject Rights

CarbonCore assists Controller in responding to data subject requests for:

6. Data Breach Notification

In case of a personal data breach, CarbonCore will:

1. Notify Controller within 48 hours of becoming aware of the breach
2. Provide description of breach including categories and approximate number of affected data subjects
3. Detail measures taken to address breach and mitigate harm
4. Recommend steps Controller should take to minimize adverse effects
5. Cooperate fully with Controller's breach response and notification obligations

7. Data Protection Impact Assessment

CarbonCore provides reasonable assistance for:

• Data Protection Impact Assessments (DPIA) when processing presents high risks
• Prior consultations with supervisory authorities when required
• Risk assessments related to processing operations
• Documentation of processing activities

8. International Data Transfers

Personal data may be transferred to and processed in:

9. Audit and Compliance

Controller may:

• Request information demonstrating GDPR compliance
• Conduct audits with reasonable advance notice (annually or as needed)
• Receive SOC 2 Type II reports and security certifications
• Review sub-processor agreements and compliance documentation

10. Data Deletion and Return

Upon termination or expiry of services, CarbonCore will:

1. Delete or return all personal data within 90 days
2. Exception: Data retained for legal/regulatory compliance purposes only
3. Blockchain data: Remains immutable (inherent to technology)
4. Certification: Provide written confirmation of secure deletion upon request

11. Liability and Indemnification

Each party is liable for damages caused by GDPR violations attributable to them:

• CarbonCore indemnifies Controller against third-party claims arising from CarbonCore's non-compliance
• Controller indemnifies CarbonCore when processing occurs per Controller's unlawful instructions
• Liability caps do not apply to GDPR violations or data breaches

12. Term and Termination

This DPA:

• Becomes effective upon acceptance of Terms of Service
• Remains in effect while CarbonCore provides services
• Survives termination for obligations requiring completion (deletion, audit)
• Can be updated with 30-day notice for regulatory changes

13. Contact for DPA Matters