Data Processing Agreement

Effective Date: October 16, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other applicable service agreement ("Agreement") between Cohora("Provider," "Processor," "we," or "us") and the organization using the Service ("Customer" or "Controller"). This DPA applies where the Provider processes personal data on behalf of the Customer in connection with the Service.

1. Definitions

Personal Data: Information relating to an identified or identifiable natural person, as defined under applicable data protection laws.

Customer Personal Data: Personal Data submitted to or processed through the Service on behalf of the Customer.

Processing: Any operation performed on Personal Data, including collection, storage, retrieval, modification, transmission, restriction, or deletion.

Controller: The party determining the purposes and means of processing Personal Data.

Processor: The party processing Personal Data on behalf of a Controller.

Subprocessor: A third party engaged by the Processor to process Customer Personal Data.

Applicable Data Protection Laws: Privacy and data protection laws applicable to the relevant processing, including the Israeli Protection of Privacy Law and, where applicable, the GDPR.

2. Roles and Responsibilities

The Customer acts as Controller, and the Provider acts as Processor, to the extent these roles apply to Customer Personal Data.

The Customer determines the purposes for which Customer Personal Data is collected and processed.

The Customer is responsible for ensuring that:

Personal Data is collected and processed lawfully.
Appropriate privacy notices are provided.
Necessary consents or other legal authorizations are obtained.
Authorized users receive appropriate permissions.
Instructions given to the Provider comply with applicable law.

The Provider shall process Customer Personal Data only in accordance with documented Customer instructions, except where otherwise required by applicable law.

3. Scope and Purpose of Processing

The Provider processes Customer Personal Data to deliver the functionality of the Service.

Processing may include:

Hosting and storing organizational records.
Managing users, memberships, roles, and permissions.
Maintaining scheduling and administrative records.
Supporting educational and organizational workflows.
Recording attendance, participation, and progress.
Processing administrative payment information.
Providing authorized reporting and data retrieval.
Maintaining security, availability, and operational integrity.

The subject matter, duration, categories of data, and processing activities are further described in Annex A.

4. Documented Instructions

The Provider shall process Customer Personal Data only on documented instructions from the Customer.

Such instructions include the Agreement, this DPA, authorized configuration of the Service, and lawful instructions submitted through supported channels.

If the Provider believes an instruction violates applicable data protection law, it shall inform the Customer where legally required, unless prohibited by law.

If processing is required by applicable law independently of Customer instructions, the Provider shall notify the Customer before processing unless legally prohibited.

5. Confidentiality

The Provider shall ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access shall be limited to personnel and service providers who reasonably require it for authorized operational purposes.

Confidentiality obligations shall continue after the termination of the relevant engagement.

6. Security Measures

The Provider shall implement appropriate technical and organizational measures designed to protect Customer Personal Data, taking into account the nature of the processing, applicable legal requirements, and relevant risks.

These measures shall be documented in Annex B and may include:

Authentication and access restrictions.
Organization-level data isolation.
Role-based authorization.
Encryption during transmission.
Credential protection.
Security logging and monitoring.
Vulnerability management.
Backup and recovery procedures.
Incident response processes.

The Provider shall maintain measures appropriate to the applicable legal requirements and shall not materially reduce agreed security protections without an appropriate contractual basis.

7. Subprocessors

The Customer grants general authorization for the Provider to engage Subprocessors necessary to deliver the Service, subject to applicable law.

The Provider shall maintain an up-to-date list of authorized Subprocessors, including their relevant processing activities.

Where required by applicable law, the Provider shall provide advance notice of intended additions or replacements and an opportunity for the Customer to object on reasonable data protection grounds.

The Provider shall impose appropriate contractual data protection obligations on Subprocessors.

The Provider remains responsible for the performance of its Subprocessors' data protection obligations to the extent required by applicable law.

The initial Subprocessor list shall be provided in Annex C.

8. Personal Data Breaches

The Provider shall notify the Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data, in accordance with applicable law.

The notification shall include reasonably available information concerning:

The nature of the incident.
Categories of affected information.
Known or reasonably estimated scope.
Likely consequences, where known.
Measures taken or proposed to address the incident.

The Provider shall provide relevant updates as additional information becomes available.

The Provider shall reasonably cooperate with the Customer in investigating and addressing the breach.

The Customer remains responsible for notifications to affected individuals and authorities where such responsibility belongs to the Customer under applicable law.

9. Data Subject Requests

The Provider shall provide reasonable assistance to the Customer in responding to requests from individuals exercising applicable privacy rights.

Such requests may concern access, correction, deletion, restriction, portability, or other legally recognized rights.

Where the Provider receives a request concerning Customer-controlled Personal Data, it shall, where appropriate and legally permitted, direct the requester to the relevant Customer or notify the Customer.

The Provider shall not independently modify or disclose Customer Personal Data in response to such requests except as authorized or legally required.

10. International Data Transfers

The Provider shall process and transfer Customer Personal Data in accordance with applicable data protection laws.

Where international transfers require additional safeguards, the parties shall implement appropriate mechanisms before the relevant transfers occur.

Such mechanisms may include applicable adequacy decisions, approved contractual clauses, or other legally recognized safeguards.

Where EU Standard Contractual Clauses or other mandatory transfer instruments are required, they must be incorporated separately with the appropriate modules, annexes, and transfer details.

This DPA does not independently constitute an EU Standard Contractual Clauses agreement.

11. Data Retention, Return, and Deletion

The Provider shall retain Customer Personal Data for the duration necessary to provide the Service and fulfill applicable legal or contractual obligations.

Upon termination of the Agreement, the Provider shall, at the Customer's choice and subject to applicable law, return or delete Customer Personal Data in accordance with the agreed termination procedure.

Where immediate deletion is not technically feasible, including in backup systems, the Provider shall maintain appropriate safeguards until deletion occurs under the applicable retention schedule.

The Provider shall provide reasonable confirmation of deletion where required by law or the Agreement.

The applicable export formats, request procedures, and deletion periods shall be documented before this DPA is put into effect.

12. Compliance Assistance

Taking into account the nature of the processing and information reasonably available to it, the Provider shall assist the Customer in meeting applicable obligations concerning:

Security of Personal Data.
Personal Data breach notifications.
Data protection impact assessments.
Relevant regulatory consultations.
Requests concerning individual privacy rights.

The extent and method of assistance shall be proportionate to the relevant processing and applicable legal requirements.

13. Compliance Information and Audits

The Provider shall make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and applicable data protection law.

Where legally required, the Provider shall allow for and contribute to appropriate audits or inspections conducted by the Customer or an authorized independent auditor.

Audits shall be subject to reasonable confidentiality, security, and operational safeguards, provided these do not prevent the exercise of mandatory legal rights.

The parties shall cooperate in good faith to minimize unnecessary disruption and protect the confidentiality of other customers.

14. Restrictions on Data Use

The Provider shall not:

Sell Customer Personal Data.
Use Customer Personal Data for unauthorized advertising.
Use Customer Personal Data to train artificial intelligence models without separate authorization.
Disclose Customer Personal Data except as authorized or legally required.
Access Customer Personal Data for purposes unrelated to authorized service delivery, security, support, or legal obligations.

The Provider may process account and operational information for its own legitimate business purposes as described in its Privacy Policy, where legally permitted.

15. Duration and Termination

This DPA becomes effective when incorporated into the Agreement and remains effective for as long as the Provider processes Customer Personal Data on behalf of the Customer.

Termination of the Agreement does not eliminate obligations relating to retained Personal Data, confidentiality, deletion, or other provisions that must survive termination.

16. Order of Precedence

In the event of a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA shall prevail to the extent of that conflict.

Mandatory data protection laws and applicable transfer instruments shall prevail where legally required.

17. Governing Law

This DPA shall be governed by the law specified in the Agreement, except where mandatory data protection laws or applicable international transfer instruments require otherwise.

18. Contact

Provider:: Cohora
Product:: Cohora
Privacy Contact:: admin@cohora.org
Business Address:: Israel. Yeffet 203

Annex A — Details of Processing

Category	Description
Subject matter	Provision of organizational management software
Duration	Duration of the Agreement and applicable retention periods
Nature of processing	Collection, storage, organization, retrieval, modification, transmission, and deletion
Purpose	Delivery of authorized Service functionality
Data subjects	Students, employees, instructors, administrators, customers, and other individuals whose information is entered by the Customer
Personal Data	Names, contact information, membership records, schedules, attendance, educational records, administrative payment information, and other Customer-provided information
Sensitive information	Only where permitted by applicable law and authorized under the Agreement
Processing instructions	Agreement, DPA, authorized Service configuration, and documented Customer instructions

Annex B — Technical and Organizational Security Measures

The Provider's implemented security measures shall be documented before execution of this DPA.

The final annex should identify the actual controls used for:

Authentication and credential protection.
Authorization and organizational data isolation.
Encryption in transit and, where implemented, at rest.
Infrastructure and database access.
Security monitoring and logging.
Vulnerability identification and remediation.
Backup, recovery, and business continuity.
Incident detection and response.
Personnel and Subprocessor access.
Data retention and secure deletion.

Implementation status: [Complete and verify before commercial use]

Annex C — Authorized Subprocessors

The Provider shall identify each authorized Subprocessor that processes Customer Personal Data.

Subprocessor	Service Provided	Processing Location	Data Categories
[Hosting provider]	Application infrastructure	[Location]	[Categories]
[Database provider]	Data storage	[Location]	[Categories]
[Email provider]	Transactional email	[Location]	[Categories]
[Monitoring provider, if used]	Error and performance monitoring	[Location]	[Categories]

The Provider shall maintain and update this list in accordance with Section 7.

Annex D — Execution and Incorporation

This DPA shall become binding only when validly incorporated into an Agreement between the parties or otherwise accepted through an enforceable contracting process.

Provider legal name:: Cohora
Customer legal name:: [Customer Legal Name]
Effective date:: [Date]
Method of acceptance:: [Signed agreement / electronic acceptance / other agreed method]