Data Processing Agreement

This Data Processing Agreement (DPA) applies to all processing of personal data carried out by NovaCore on behalf of your institution in connection with the NovaCore platform. It forms part of your subscription agreement with us.

Your institution acts as the Data Controller — you determine the purposes and means of processing. NovaCore acts as the Data Processor — we process personal data only on your documented instructions and for no other purpose.

We process the following categories of personal data on your behalf: user account information (name, email, role), document metadata (creator, timestamps, approvers), audit log entries (user actions, IP addresses), and digital signature records.

We use a limited number of sub-processors for infrastructure services (cloud hosting, email delivery, error monitoring). All sub-processors are bound by data processing agreements with protections equivalent to this DPA. We will notify you before adding new sub-processors.

Your data is stored in the region you selected during onboarding. We do not transfer personal data outside that region without your consent, except where required to provide the service (such as email delivery through our mail provider).

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These include AES-256 encryption at rest, TLS 1.3 in transit, access controls, and regular security audits.

We will assist you in responding to requests from individuals exercising their rights (access, correction, deletion, portability). Most requests can be fulfilled directly through the platform's admin interface. For requests requiring our involvement, we respond within 72 hours.

In the event of a personal data breach, we will notify you without undue delay and no later than 72 hours after becoming aware, providing sufficient information to meet your own notification obligations to supervisory authorities and affected individuals.

Upon termination of your subscription, we will delete or return all personal data within 30 days, and certify deletion in writing upon request. Anonymized aggregate statistics may be retained for platform improvement purposes.

For DPA-related inquiries, contact us at privacy@novacorecloud.com. For institutions requiring a signed DPA as a separate document, contact sales@novacorecloud.com.