This Data Processing Addendum ("DPA") is part of the Terms of Service between you (the "Customer") and Core Rift LLC, doing business as Core Rift Gate ("CoreRift," "we," "us"). It applies when CoreRift processes personal information on the Customer's behalf through CoreRift Gate (the "Service").
1. Roles
For Site Data, the Customer is the controller (or "business") that decides why and how the information is processed, and CoreRift is the processor (or "service provider") that processes it on the Customer's behalf. Terms such as "personal data," "controller" and "processor" have the meanings given in the privacy laws that apply, including the Virginia Consumer Data Protection Act and the California Consumer Privacy Act.
2. Instructions
CoreRift processes Site Data only to provide the Service as described in the Terms and the Customer's settings, which are the Customer's documented instructions, and as the law requires. CoreRift will tell the Customer if it believes an instruction breaks the law.
3. Restrictions
CoreRift will not sell or share Site Data, use it for advertising, combine it with information from other sources except as needed to provide the Service, or retain, use or disclose it for any purpose other than providing the Service.
4. Confidentiality and Security
Everyone at CoreRift who can access Site Data is bound to keep it confidential. CoreRift maintains appropriate technical and organizational measures, including encryption in transit, hashing of codes and keys, access limited by site membership, and provider-level encryption at rest.
5. Subprocessors
The Customer authorizes CoreRift to use the subprocessors listed on the Service Providers page. CoreRift binds each to data-protection terms at least as protective as this DPA, remains responsible for them, and updates that page before adding or replacing one that handles Site Data. The Customer may object on reasonable data-protection grounds by emailing us; if we cannot address the objection, the Customer may close the affected sites.
6. Assistance
CoreRift will help the Customer respond to requests from individuals to access, correct or delete their information, mainly through the dashboard's export and delete tools, and will pass on any such request it receives directly. CoreRift will provide information reasonably needed for the Customer's data protection assessments.
7. Security Incidents
CoreRift will notify the Customer without undue delay, and within 72 hours where feasible, after becoming aware of a breach affecting the Customer's Site Data, with the information reasonably available to help the Customer meet its own obligations.
8. Deletion
When the Customer deletes Site Data or a site, CoreRift deletes it from the live database, and copies in provider backups expire on the providers' schedules, generally within 30 days. The Customer can export Site Data from the dashboard at any time before deletion.
9. Audits
On reasonable written request, no more than once a year, CoreRift will provide information needed to demonstrate compliance with this DPA.
10. Precedence
If this DPA conflicts with the Terms on the processing of Site Data, this DPA controls.
11. Changes to This Addendum
We may update this DPA. Each version is posted here with its effective date, and earlier versions remain available. We will tell site owners about material changes before they take effect.
12. Contact
Core Rift LLC, doing business as Core Rift Gate, Virginia. Email: admin@corerift.com.