1. Parties
This Data Processing Agreement ("DPA") applies between the Customer (as data controller) and Core Engineering Kft., Budapest, Hungary (as data processor), and forms part of the Terms of Service.
2. Subject matter and duration
The processor processes personal data on behalf of the controller solely for the purpose of providing the Service. The DPA applies for as long as the controller has an active ScopeSense subscription.
3. Nature and purpose of processing
Storage and processing of project documents (drawings, specifications, BOQs, vendor quotes), extraction of scope items, gap detection and compliance checks.
4. Categories of data subjects
- Employees and authorised users of the Customer.
- Individuals mentioned in project documents (very limited — typically none).
5. Categories of personal data
- Contact data (name, email, workplace).
- Usage data (logs, IP, timestamps).
- Any personal data incidental to uploaded project documents.
6. Subprocessors
The current list of authorised subprocessors:
- netcup GmbH — hosting (EU; servers in Vienna, Austria).
- Anthropic PBC — AI processing (Claude models); no training on customer data; requests are retained by the provider for up to 30 days under its published terms.
- Microsoft Ireland Operations Ltd. — Azure AI Foundry, AI processing in the EU Data Zone; no training on customer data; requests may be retained for up to 30 days under Microsoft's published terms.
- Stripe Payments Europe, Ltd. — payment processing and merchant of record for paid plans and credit packs. Card data is handled by Stripe and is not stored by us.
We notify controllers of new subprocessors at least 30 days in advance.
7. Location of processing
Primary processing takes place in Austria (netcup, Vienna). Azure AI processing stays within the EU Data Zone. Anthropic processing may occur in EU or US endpoints; Standard Contractual Clauses (SCCs) are in place.
8. Security measures
- TLS in transit, AES-256 at rest.
- Access controls, role-based permissions, MFA for administrators.
- Regular backups, disaster recovery, incident response plan.
- Personnel bound by confidentiality agreements.
9. Data subject rights and controller assistance
We assist the controller in fulfilling data-subject rights (access, rectification, erasure, portability) within reasonable time and cost.
10. Return and deletion of data (Article 28(3)(g) GDPR)
At the controller's choice, the processor deletes or returns all personal data after the end of the provision of the Service. The controller may choose by writing to info@coreeng.eu or by deleting the account in the product.
- Return: on request, within 30 days, in the formats described in section 13 of the Terms of Service.
- Deletion: the account and all project data are permanently deleted 30 days after the controller ends the Service (the retrieval period). Existing copies are deleted unless Union or Member State law requires storage; backup copies leave the backups at the latest 14 days later.
- Confirmation: the processor confirms the deletion in writing (email), stating the date by which the data has also left the backups.
- Restore: if a backup has to be restored, the processor first deletes again everything that was deleted after the backup was taken.
- Records required by law (for example invoices and tax records kept by Stripe as merchant of record) are not covered by deletion and are kept only for the legally required period.