Data Processing Addendum

Last updated October 7, 2026

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between [Company legal name] ("Coho", "we") and the customer that accepted them ("you"). Terms defined in the Terms of Service have the same meaning here. "Personal data", "controller", "processor", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings the GDPR gives them.

1. Roles and scope

• This DPA applies to personal data contained in Customer Content ("Customer Personal Data"). For Customer Personal Data, you are the controller, or a processor acting for your own client, and we are your processor, or sub-processor.
• It doesn't cover personal data that we handle as a controller, such as account, billing and support data. Our Privacy Policy covers that.
• "Data Protection Laws" means every law that applies to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation (the "GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act and other US state privacy laws.
• You are responsible for having a lawful basis for putting Customer Personal Data into the Services, and for your instructions complying with Data Protection Laws.

2. Details of the processing

This section is Annex I to the Standard Contractual Clauses described in section 6.

Parties

You, as data exporter and controller (or processor), and Coho, as data importer and processor (or sub-processor). Contact details are those of your account's admins and, for Coho, privacy@coho-cms.com.

Subject matter and purpose

Providing the Services: storing, versioning, branching, merging, releasing and delivering Customer Content as you direct through the Services, and support you ask for.

Duration

The term of the Terms of Service, and the 30 days after your account closes during which we keep your content (section 10).

Nature of the processing

Collection through the APIs, storage, organization, versioning, retrieval, transmission to the audiences you choose, and erasure. Processing is continuous.

Types of personal data

Whatever you choose to include in Customer Content. Typically names, job titles, business contact details and biographies of people featured in it.

Special categories of data

None. The Terms forbid them unless we have agreed otherwise in writing.

Data subjects

People featured in or identified by Customer Content, such as your staff, clients and contacts.

3. Our obligations

We will:

1. process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you first unless the law forbids it. The Terms, this DPA and your use and configuration of the Services are your complete instructions. We will tell you if we believe an instruction infringes Data Protection Laws;
2. make sure that everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality;
3. keep the security measures in section 7;
4. engage sub-processors only as section 5 allows;
5. help you answer requests from data subjects, mainly through the Services, which let you find, change, export and delete Customer Content. If a request reaches us, we will pass it to you and not answer it ourselves unless you ask us to;
6. help you, taking into account the nature of the processing and the information available to us, with security, breach notifications, data protection impact assessments and consultations with supervisory authorities;
7. return or delete Customer Personal Data when the Services end, as section 10 describes; and
8. give you the information you need to show compliance with this DPA, and allow audits, as section 9 describes.

4. US state privacy laws

For the California Consumer Privacy Act and similar US state laws, we are your service provider (or processor). We will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than providing the Services, or outside our direct business relationship with you; or combine it with personal information from other sources, except as those laws permit. We will comply with those laws and give Customer Personal Data the level of privacy protection they require, and we will tell you if we can no longer do so. You may take reasonable steps to stop and remedy any unauthorized use of Customer Personal Data. We understand these restrictions and will comply with them.

5. Sub-processors

You authorize us to engage sub-processors. Each is bound by a written contract that protects Customer Personal Data at least as well as this DPA, and we remain responsible for their work. Our sub-processor for Customer Personal Data is:

These service providers handle data that we control, but never Customer Content. They are listed so that you can see everyone involved in providing Coho:

We will give you at least 30 days' notice before a new sub-processor starts processing Customer Personal Data, by email to your account's admins and by updating this page. You may object on reasonable data protection grounds within that time. We will then work with you in good faith to find a solution, and if we can't, you may cancel the affected Services and receive a refund of any fees you have paid for the period after cancellation.

6. International transfers

• We process Customer Personal Data in the United States.
• For transfers from the European Economic Area to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 (the "SCCs"), which are incorporated into this DPA: Module Two where you are a controller, and Module Three where you are a processor. Clause 7 applies; under Clause 9 option 2 applies, with the notice period in section 5; the optional wording in Clause 11 doesn't apply; under Clause 13 the competent supervisory authority is the one that clause determines; Clauses 17 and 18 choose the law and the courts of Ireland; Annex I is section 2, Annex II is section 7, and Annex III is the list in section 5.
• For transfers from the United Kingdom, the SCCs apply as amended by the International Data Transfer Addendum issued by the UK Information Commissioner, completed with the details in this DPA.
• For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
• If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

7. Security measures

This section is Annex II to the SCCs. We will keep at least these measures, and may improve them over time without reducing the overall protection they give:

• Encryption. TLS on every connection to the Services. Databases and stored files encrypted at rest with AES-256.
• Separating customers. Content is kept apart by customer with row-level security in the database itself, as well as by checks in the application.
• Access control. Roles within each account decide who may read, change, release and promote content. Access to production systems is limited to authorized Coho personnel who need it.
• Authentication. Passwords are held only by Amazon Cognito, in hashed form. Bot protection guards the forms that create accounts or send email. Sign-in tokens stay on our servers and never reach the browser.
• Network. The services that hold Customer Content are not reachable from the internet. Only the sign-in service, the web app's server and content delivery are public.
• Records. An audit trail of changes to accounts and their members, which can't be edited. Every change to content is kept as a new version. Service logs record the method, path and result of each request, never its body.
• People. Everyone with access to Customer Personal Data is bound by confidentiality.
• Incidents. Breaches are handled as section 8 describes.

8. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after we become aware of a personal data breach affecting Customer Personal Data. As far as we know them at the time, we will describe the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and what we have done or propose to do about it, and we will update you as we learn more. Notifying you of a breach is not an admission of fault.

9. Information and audits

• When you ask, we will give you the information you reasonably need to show that we comply with this DPA, such as answers to security questionnaires and the independent certifications and audit reports of our sub-processors.
• If that isn't enough, or a supervisory authority requires it, you may audit our compliance, or have an independent auditor bound by confidentiality do so, once a year, with 30 days' notice, during business hours and at your own expense. We will agree the scope beforehand. Audits under the SCCs are carried out in the same way.

10. Return and deletion

• While your account is open, you can export Customer Content at any time through the APIs and the coho command-line tool.
• When your account closes, we keep Customer Content for 30 days so that you can export it or ask us to return it, and then we delete it, unless the law requires us to keep it. Copies in backups are deleted as those backups expire, within a further 35 days.
• If you ask, we will confirm the deletion in writing.

11. General

• This DPA lasts for as long as we process Customer Personal Data.
• Each party's liability under this DPA is subject to the limits in the Terms, except where the SCCs or Data Protection Laws don't allow it.
• If documents conflict on data protection, the SCCs prevail, then this DPA, then the rest of the Terms.
• We may update this DPA to reflect changes in the law or in our sub-processors, giving notice as the Terms describe. An update won't reduce the overall protection this DPA gives Customer Personal Data.

Questions about this DPA: privacy@coho-cms.com. [Company legal name], [Mailing address].