CoCalc -- dpa.tsx

GitHub Repository: sagemathinc/cocalc
Path: blob/master/src/packages/next/pages/policies/dpa.tsx
¹⁴⁴²³ views
1
/*
2
 *  This file is part of CoCalc: Copyright © 2026 Sagemath, Inc.
3
 *  License: MS-RSL – see LICENSE.md for details
4
 */
5

6
import { Layout } from "antd";
7

8
import { COLORS } from "@cocalc/util/theme";
9
import A from "components/misc/A";
10
import Footer from "components/landing/footer";
11
import Head from "components/landing/head";
12
import Header from "components/landing/header";
13
import { MAX_WIDTH } from "lib/config";
14
import { Customize, type CustomizeType } from "lib/customize";
15
import withCustomize from "lib/with-customize";
16

17
interface Props {
18
  customize: CustomizeType;
19
}
20

21
export default function DataProcessingAddendumPage({ customize }: Props) {
22
  return (
23
    <Customize value={customize}>
24
      <Head title="Data Processing Addendum" />
25
      <Layout>
26
        <Header page="policies" subPage="dpa" />
27
        <Layout.Content
28
          style={{
29
            backgroundColor: COLORS.WHITE,
30
          }}
31
        >
32
          <div
33
            style={{
34
              maxWidth: MAX_WIDTH,
35
              margin: "15px auto",
36
              padding: "15px",
37
              fontSize: "12pt",
38
            }}
39
          >
40
            <div style={{ textAlign: "center" }}>
41
              <h1>CoCalc - Data Processing Addendum</h1>
42
              <p>Last Updated: April 15, 2026</p>
43
            </div>
44
            <div>
45
              <p>
46
                This Data Processing Addendum ("<b>DPA</b>") is incorporated
47
                into the SageMath, Inc. Terms of Service ("<b>Agreement</b>")
48
                and applies to the processing of Personal Data by SageMath, Inc.
49
                on behalf of its Users.
50
              </p>
51
              <h1>1. Nature and Purpose of Processing</h1>
52
              <p>
53
                SageMath, Inc. provides a collaborative cloud-based platform
54
                (CoCalc) for research, analysis, and scientific publishing. The
55
                Subject Matter of the processing is the data uploaded, created,
56
                or processed by the User within the CoCalc environment.
57
              </p>
58
              <ul>
59
                <li>
60
                  <b>Hosted Platform</b>: Data is stored and processed on
61
                  SageMath, Inc. infrastructure to provide core platform
62
                  functionality.
63
                </li>
64
                <li>
65
                  <b>User-Directed Compute</b>: Users may explicitly choose the
66
                  geographic location and infrastructure provider for specific
67
                  compute tasks. In such cases, SageMath, Inc. processes data in
68
                  the location selected by the User.
69
                </li>
70
                <li>
71
                  <b>AI-Assisted Features</b>: SageMath, Inc. provides optional
72
                  integrations with third-party AI providers. Data is
73
                  transmitted to these providers only upon explicit initiation
74
                  by the User.
75
                </li>
76
              </ul>
77
              <h1>2. Sub-processors</h1>
78
              <p>
79
                The Controller (User) provides a general authorization for
80
                SageMath, Inc. to engage sub-processors.
81
              </p>
82
              <ul>
83
                <li>
84
                  <b>Current List</b>: A current list of sub-processors is
85
                  maintained at the{" "}
86
                  <b>
87
                    SageMath, Inc. Trust Center (
88
                    <A href="https://trust.cocalc.com/">
89
                      https://trust.cocalc.com/
90
                    </A>
91
                    )
92
                  </b>
93
                  .
94
                </li>
95
                <li>
96
                  <b>Notification of Changes</b>: Users may subscribe to
97
                  notifications of changes to the sub-processor list directly
98
                  via the Trust Center. SageMath, Inc. will provide at least{" "}
99
                  <b>15 days&apos; notice</b> before authorizing any new
100
                  sub-processor to process Customer Data, during which time the
101
                  Controller may object to the change in writing.
102
                </li>
103
              </ul>
104
              <h1>3. Security of Processing</h1>
105
              <p>
106
                SageMath, Inc. shall implement and maintain appropriate
107
                technical and organizational measures to protect Customer Data
108
                against unauthorized access, loss, or disclosure. These measures
109
                include, but are not limited to:
110
              </p>
111
              <ul>
112
                <li>
113
                  <b>Encryption</b>: Data is encrypted at rest and in transit
114
                  using industry-standard protocols.
115
                </li>
116
                <li>
117
                  <b>Access Control</b>: Access to production environments is
118
                  restricted to authorized personnel on a "need-to-know" basis.
119
                </li>
120
                <li>
121
                  <b>Audit</b>: SageMath, Inc. undergoes regular security
122
                  assessments and maintains documentation of its security
123
                  controls (e.g., SOC 2 Type II report).
124
                </li>
125
              </ul>
126
              <h1>4. GDPR Representation</h1>
127
              <p>
128
                Pursuant to Article 27 of the GDPR, SageMath, Inc. has appointed
129
                the following representatives for data protection matters in the
130
                EU and UK:
131
              </p>
132
              <ul>
133
                <li>
134
                  <b>EU Representative</b>: Adam Brogden, Instant EU GDPR
135
                  Representative Ltd (Ireland). Contact:{" "}
136
                  <A href="mailto:[email protected]">
137
                    [email protected]
138
                  </A>
139
                  .
140
                </li>
141
                <li>
142
                  <b>UK Representative</b>: Adam Brogden, GDPRLocal Ltd.
143
                  Contact:{" "}
144
                  <A href="mailto:[email protected]">
145
                    [email protected]
146
                  </A>
147
                  .
148
                </li>
149
              </ul>
150
              <h1>5. Data Subject Rights and Collaboration</h1>
151
              <ul>
152
                <li>
153
                  <b>User-Controlled Deletion</b>: SageMath, Inc. provides the
154
                  Controller with the ability to delete files, projects, and
155
                  accounts directly through the CoCalc interface.
156
                </li>
157
                <li>
158
                  <b>Requests to SageMath, Inc.</b>: If SageMath, Inc. receives
159
                  a request from a Data Subject to exercise their rights
160
                  regarding data contained within a project owned by another
161
                  User, SageMath, Inc. will forward that request to the project
162
                  owner.
163
                </li>
164
                <li>
165
                  <b>Collaborative Integrity</b>: The Controller acknowledges
166
                  that in a collaborative environment, the deletion of a Data
167
                  Subject&apos;s account may not result in the deletion of data
168
                  contained within projects owned by other Users, as that data
169
                  is part of the other User&apos;s records.
170
                </li>
171
              </ul>
172
              <h1>6. International Data Transfers</h1>
173
              <ul>
174
                <li>
175
                  <b>Standard Contractual Clauses (SCCs)</b>: For transfers of
176
                  Personal Data from the EU/EEA to countries that do not ensure
177
                  an adequate level of data protection, the parties hereby
178
                  incorporate by reference the{" "}
179
                  <b>
180
                    Standard Contractual Clauses (Module Two:
181
                    Controller-to-Processor)
182
                  </b>
183
                  .
184
                </li>
185
                <li>
186
                  <b>UK Addendum</b>: For transfers from the UK, the{" "}
187
                  <b>International Data Transfer Addendum</b> to the EU SCCs is
188
                  hereby incorporated.
189
                </li>
190
                <li>
191
                  <b>Hierarchy</b>: In the event of a conflict between this DPA
192
                  and the SCCs, the SCCs shall prevail.
193
                </li>
194
              </ul>
195
              <h1>7. Data Deletion and Return</h1>
196
              <p>
197
                Upon termination of the Agreement or at the Controller&apos;s
198
                request, SageMath, Inc. shall delete or return all Customer Data
199
                in its possession, unless applicable law requires continued
200
                storage. Data is typically deleted within 60 days of contract
201
                termination.
202
              </p>
203
              <h1>8. Audit and Compliance</h1>
204
              <p>
205
                SageMath, Inc. shall make available to the Controller all
206
                information reasonably necessary to demonstrate compliance with
207
                Article 28 of the GDPR. The Controller acknowledges that
208
                SageMath, Inc.&apos;s maintenance of a <b>SOC 2 Type II</b>{" "}
209
                report satisfies the Controller&apos;s right to audit SageMath,
210
                Inc.&apos;s technical and organizational measures.
211
              </p>
212
              <h1>9. Liability</h1>
213
              <p>
214
                The total liability of each party under this DPA shall be
215
                subject to the limitation of liability provisions set forth in
216
                the SageMath, Inc. Terms of Service.
217
              </p>
218
              <hr />
219
              <p>
220
                <b>
221
                  This DPA is incorporated into the SageMath, Inc. Terms of
222
                  Service by reference and is effective as of the date the User
223
                  first accesses the CoCalc platform.
224
                </b>
225
              </p>
226
            </div>
227
          </div>
228
          <Footer />
229
        </Layout.Content>
230
      </Layout>
231
    </Customize>
232
  );
233
}
234

235
export async function getServerSideProps(context) {
236
  return await withCustomize({ context });
237
}
238

239
Product

Resources

Company
