Data Processing Addendum

"Personal Data" means any information relating to an identified or identifiable individual that Kordis processes on Customer's instructions in the course of providing the Kordis service. Capitalized terms not defined here have the meaning given in the Terms of Service.

Kordis processes Personal Data only on Customer's documented instructions, as necessary to provide the Kordis service (staffing operations: screening, dispatch, communications, compliance, payroll support), unless required to do otherwise by law.

Kordis ensures that personnel authorized to process Personal Data are bound by confidentiality obligations.

Kordis maintains technical and organizational measures appropriate to the risk, including encryption in transit and at rest, tenant data isolation, and access controls. The Security page has the detail.

Kordis uses the subprocessors listed on the subprocessors page and will give Customer notice of any material change, consistent with the Privacy Policy.

Several subprocessors run in the United States, listed by name on the subprocessors page. Where Personal Data is transferred outside Canada, Kordis relies on the subprocessor's own equivalent safeguards and contractual protections.

Kordis assists Customer, insofar as reasonably possible, in responding to requests from individuals exercising their data protection rights.

On termination, Kordis makes Personal Data available for export for the period stated in the Terms of Service, then deletes it, consistent with the retention schedule in the Privacy Policy.

This DPA remains in effect for as long as Kordis processes Personal Data on Customer's behalf under the Terms of Service.