Master Data Processing Agreement

Version: FENNORICA-COREX-DPA-2026-09-22-V2

This version becomes binding only when incorporated into an executed agreement, order form, tenant schedule, or recorded electronic merchant acceptance. Publication alone does not create a merchant DPA.

The Master DPA is role-neutral. The applicable Processing Schedule identifies the Controller Party and Processor Party for each workstream. It supports both customer/tenant Controller → Fennorica/CoreX Processor arrangements and Fennorica Controller → delivery-partner Processor arrangements.

The Processor Party processes only on documented lawful instructions, applies confidentiality and security controls, uses subprocessors under the agreed authorisation/flow-down mechanism, assists with rights/security/DPIA obligations, notifies personal-data breaches without undue delay, and deletes or returns data according to the applicable schedule and law.

Actual data subjects, data categories, purposes, systems, retention, transfers and subprocessors are authorised by the applicable Processing Schedule. Tenant/workspace boundaries remain mandatory and no tenant may alter another tenant's data or schedule.

Status: Management-approved for operational use on 2026-09-22. External counsel review remains pending and is not represented as completed.

International transfers use an applicable adequacy decision or other lawful Chapter V mechanism; where required, the European Commission 2021 SCCs and supplementary measures apply.