The EU value-chain ceiling limits what large customers may require from suppliers of up to 1,000 employees. Directive (EU) 2026/470 applies to financial years beginning on or after 1 January 2027.The EU value-chain ceilingSee what applies to you →

Version 1.0 · GDPR Art. 28 · EU SCCs Module 2 · UK Addendum · India DPDP Act

Data Processing Agreement

The terms on which Earth Arogyam Innovate processes personal data on your behalf when you use CoreCanopy, including the EU Standard Contractual Clauses for the transfer to India. It forms part of the Terms automatically; nothing needs to be signed.

Last updated 2026-10-03

1. Parties and how this agreement applies

This Data Processing Agreement ("DPA") is between the customer that has accepted the CoreCanopy Terms ("Customer") and EARTH AROGYAM INNOVATE, a sole proprietorship registered in India under Udyam registration UDYAM-WB-23-0081393, of Durgapur 713217, West Bengal, India, operating the CoreCanopy service ("CoreCanopy", "we"). It forms part of the Terms and applies whenever we process Customer Personal Data in providing the service. Accepting the Terms accepts this DPA; a countersigned copy is available on request from support@corecanopy.earth.

If this DPA conflicts with the Terms, this DPA prevails. If the Standard Contractual Clauses conflict with this DPA or the Terms, the Standard Contractual Clauses prevail.

2. Definitions

  • "Data Protection Law" means the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and India’s Digital Personal Data Protection Act 2023 and its Rules, in each case to the extent they apply to the processing.
  • "Customer Personal Data" means personal data that the Customer or its users enter, upload or generate in the CoreCanopy service and that we process on the Customer’s behalf.
  • "Standard Contractual Clauses" or "SCCs" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
  • "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR; under India’s DPDP Act, "Data Fiduciary" corresponds to controller and "Data Processor" to processor.

3. Roles

For Customer Personal Data the Customer is the controller (or Data Fiduciary) and CoreCanopy is the processor (or Data Processor). Where the Customer is itself a processor for another controller, CoreCanopy is its sub-processor and the Customer warrants that its instructions are authorised by that controller. CoreCanopy is a controller only for the data described in its Privacy Policy, such as account and billing records and service logs, and this DPA does not cover that data.

4. Our obligations as processor

  • Instructions. We process Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use and configuration of the service, unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it. We will tell the Customer if we believe an instruction infringes Data Protection Law.
  • Confidentiality. Everyone we authorise to process Customer Personal Data is bound by confidentiality. Our staff can see Customer Personal Data only through a support session the Customer approves, which is read-only, time-limited and recorded in the Customer’s own audit trail; emergency access without approval is limited to one hour, requires a written justification and notifies the Customer at once.
  • Security. We implement the technical and organisational measures in Annex II, appropriate to the risk, and review them at least annually.
  • Data subject requests. We help the Customer respond to requests to exercise data subject rights, mainly through the service itself, which provides export and erasure. If a data subject contacts us directly about Customer Personal Data, we pass the request to the Customer and do not answer it ourselves unless the Customer instructs us to.
  • Assistance. Taking into account the information available to us, we help the Customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation (GDPR Articles 32 to 36).
  • Records. We keep the records of processing that Data Protection Law requires of a processor.

5. Personal data breaches

We notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, so that the Customer can meet its own deadlines. The notice goes to the Customer’s account owners by email and describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We provide further information as it becomes available, and we take reasonable steps to contain and remedy the breach. Notification is not an acknowledgement of fault.

6. Sub-processors

The Customer gives general authorisation for us to engage sub-processors. Our current sub-processors, their purpose, location and the data they receive, are listed at corecanopy.earth/trust/sub-processors and summarised in Annex III. We impose on each sub-processor data protection obligations that are no less protective than this DPA, and we remain liable to the Customer for their performance.

We will give at least 30 days’ notice before adding or replacing a sub-processor, by email to account owners and on the sub-processor page. The Customer may object on reasonable data protection grounds within that period. If we cannot reasonably accommodate the objection, the Customer may terminate the affected service and receive a refund of fees prepaid for the period after termination.

7. International transfers

Customer Personal Data is stored and processed in Amazon Web Services eu-central-1 (Frankfurt, Germany) and its backups are kept in the same region. CoreCanopy itself is established in India and administers the service remotely from India, which is a transfer of personal data to a country without an adequacy decision.

  • EU. To the extent the Customer’s processing is subject to the GDPR, the parties incorporate Module Two (controller to processor) of the Standard Contractual Clauses, with the Customer as data exporter and CoreCanopy as data importer, completed as follows: Clause 7 (docking clause) applies; in Clause 9, Option 2 (general written authorisation) applies with the 30-day notice in section 6; the optional wording in Clause 11 does not apply; in Clause 13, the competent supervisory authority is determined as Clause 13 provides; in Clause 17, Option 1 applies and the governing law is that of Ireland; in Clause 18, the courts of Ireland. Annexes I, II and III of this DPA are the annexes to the SCCs.
  • United Kingdom. To the extent the processing is subject to the UK GDPR, the parties incorporate the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0), with Table 1 completed from Annex I, Table 2 by reference to the SCC options above, Table 3 by Annexes I to III, and Table 4 allowing either party to end the Addendum as its Section 19 provides.
  • Switzerland. To the extent the processing is subject to the Swiss FADP, the SCCs apply with the Federal Data Protection and Information Commissioner as competent supervisory authority, references to the GDPR read as references to the FADP, and "Member State" read so as not to exclude data subjects in Switzerland from bringing claims in their place of habitual residence.
  • Onward transfers to sub-processors are made under the sub-processor’s own transfer mechanism, such as the SCCs in the AWS Data Processing Addendum.

We have assessed the laws of India that could affect the protection of Customer Personal Data, and we apply the supplementary measures in Annex II: the data stays in the EU, it is encrypted in transit and at rest, administrative access is limited, authenticated with MFA and logged, and we will challenge and minimise any government access request and tell the Customer about it where the law allows.

8. Audits and information

We make available the information reasonably needed to demonstrate compliance with this DPA: our published Cloud Security Alliance STAR self-assessment, our written security policies, and answers to the Customer’s reasonable security questionnaires. If that is not enough to meet a requirement of Data Protection Law, or a supervisory authority requires it, the Customer or an independent auditor bound by confidentiality may audit our compliance once a year, on at least 30 days’ notice, during business hours, at the Customer’s cost, without access to other customers’ data and without disrupting the service. Audits of our sub-processors are met by their own certifications and reports.

9. Return and deletion

The Customer can export its data in CSV and XLSX at any time while its account is open. When the account is closed we delete Customer Personal Data from the live service within 30 days, and it leaves our backups within a further 35 days as they expire. We retain data only where the law requires it, and then keep it confidential and process it for no other purpose. Records the Customer filed as reports are part of its data and are deleted with it.

10. India: DPDP Act 2023

Where the Customer is a Data Fiduciary under India’s Digital Personal Data Protection Act 2023, CoreCanopy processes Customer Personal Data as its Data Processor under a valid contract as section 8(2) of that Act requires, only for the purpose of providing the service, and applies the obligations in sections 4 to 9 of this DPA to that processing, including reasonable security safeguards and notice of personal data breaches.

11. Liability and term

Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not permit them to apply. This DPA lasts as long as we process Customer Personal Data, and its obligations on deletion, confidentiality and audit survive termination for as long as we hold any of it.

Annex I. Description of the processing

  • Data exporter: the Customer, as identified in its account, acting as controller (or as processor for its own controller). Contact: the account owners. Activities: use of the CoreCanopy service.
  • Data importer: Earth Arogyam Innovate, Durgapur 713217, West Bengal, India, operating CoreCanopy, acting as processor. Contact: support@corecanopy.earth; security matters to security@corecanopy.earth.
  • Categories of data subjects: the Customer’s users of the service; the Customer’s employees, contractors and other individuals named in data the Customer uploads, such as travellers in business-travel records or contacts in supplier records; auditors the Customer invites.
  • Categories of personal data: names, work email addresses and organisation; account credentials (stored only as one-way hashes) and MFA secrets (encrypted); audit-trail entries recording who did what and when, including IP address and browser user agent; any personal data contained in activity records, documents and free-text fields the Customer provides.
  • Sensitive data: none is required by the service and the Customer should not upload special categories of data. Any that is uploaded is protected by the measures in Annex II.
  • Frequency: continuous, for as long as the Customer uses the service.
  • Nature and purpose: storage, calculation of greenhouse gas emissions figures, generation of reports and exports, audit logging, and support at the Customer’s request, solely to provide the CoreCanopy service.
  • Retention: for the life of the Customer’s account, then deleted as section 9 describes.
  • Sub-processor transfers: as listed in Annex III, for the purposes stated there.
  • Competent supervisory authority: as determined under Clause 13 of the SCCs.

Annex II. Technical and organisational measures

  • Encryption: TLS 1.2 or higher for all traffic to the service; data at rest encrypted with AES-256 on AWS-managed volumes and storage; passwords hashed with argon2id; tokens stored only as hashes.
  • Tenant isolation: each customer’s data is separated by row-level security enforced by the database, which the application’s own database role cannot bypass, and by per-customer authorisation checks on every request.
  • Access control: mandatory MFA for all staff accounts and for administrative access to the infrastructure; least-privilege roles; no SSH access to servers; customer-approved, read-only, time-limited support sessions recorded in the customer’s audit trail.
  • Logging and monitoring: hash-chained, append-only audit trails for customer and staff actions; AWS CloudTrail with log-file validation retained 400 days; alarms on privileged and security-relevant changes; continuous threat detection with AWS GuardDuty; application logs retained 180 days.
  • Resilience: nightly encrypted backups retained 35 days in the same region, with a restore test every month; automatic rollback of failed releases; a documented rebuild procedure.
  • Secure development: every change passes automated tests, static analysis, dependency auditing and container vulnerability scanning before it can be deployed, and nothing reaches production except through that pipeline.
  • Data minimisation and privacy by default: error reports strip personal data at source; product analytics run only with the user’s consent; personal data in audit records is pseudonymised on erasure.
  • Incident response: a written incident response plan with notification to customers within 48 hours, and to authorities within the periods the law sets, including six hours to CERT-In and 72 hours to India’s Data Protection Board.
  • Governance: written security and privacy policies approved by the business and reviewed annually; a risk register; a published Cloud Security Alliance STAR self-assessment.
  • Supplementary measures for the transfer to India: Customer Personal Data is never stored in India; administrative access from India is limited to the operator, protected by MFA and recorded; we will review the legality of any government request for Customer Personal Data, challenge it where there are grounds, disclose the minimum required, and inform the Customer unless the law prohibits it.
  • Sub-processor assistance: sub-processors are bound to provide the assistance the Customer needs to respond to data subject requests and to meet its security and breach obligations, to the extent they process Customer Personal Data.

Annex III. Sub-processors

  • Amazon Web Services (contracted through Amazon Web Services India Private Limited): hosting, storage, email delivery, logging and threat detection; data stored in eu-central-1, Frankfurt, Germany.
  • Functional Software, Inc. (Sentry): error tracking; European Union (Germany); stack traces and opaque identifiers, with personal data scrubbed.
  • Mixpanel, Inc.: product analytics, only for users who consent; European Union (Netherlands); event names and opaque identifiers.
  • Razorpay Software Private Limited: payment processing; India; billing contact and payment metadata. Card details never reach CoreCanopy.
  • Google (Google Workspace): company email; Google’s regions; whatever the Customer chooses to send us by email.

Version 1.0, effective 3 October 2026. This agreement has been prepared by CoreCanopy and is pending review by counsel; if review changes it, the new version will be published here with the date, and customers will be notified as for a change of sub-processor.