Data Processing Agreement (DPA)
Last updated: July 2026
This Data Processing Agreement ("DPA") supplements the Terms of Service of the oToK platform, operated by Cnergia Education Ltd., an Israeli company, company no. 515780724 ("oToK", "we", "us"). The DPA applies whenever a customer processes personal data about its own contacts through the platform, and for such customers it is incorporated by reference into the Terms of Service and forms an integral part of them — no separate signature is required. A countersigned copy is available on request at [email protected].
1. Roles and definitions
"The customer" in this DPA has the meaning given in the Terms of Service; "personal data" means information, as defined by applicable data-protection law, that the customer processes through the platform. The customer is the data controller: under Israel's Protection of Privacy Law, 5741-1981, the customer is the controller of the database, and under the EU GDPR, where it applies, the customer is the controller. The customer determines the purposes and means of the processing. oToK acts as the customer's processor — the "holder" in the terminology of Israeli law — and processes the data solely on the customer's behalf and under its instructions, as set out in this DPA.
2. Scope of processing
• Subject matter: operating the oToK platform for the customer. • Duration: the term of the customer's engagement with oToK. • Nature and purpose: storage, messaging, automation, and analytics — for the customer and for its purposes. • Categories of data subjects: the customer's contacts, customers, and leads. • Categories of data: contact and identification details, communication content and engagement data, and any custom fields the customer chooses to store on the platform.
3. Processing on documented instructions
We process personal data only in accordance with this DPA and the customer's documented instructions — including the configuration the customer sets in the platform and the way it uses the product. If a legal obligation applying to us requires other processing, we will inform the customer before processing, unless the law prohibits doing so.
4. Confidentiality
We ensure that everyone authorized by us to process personal data is bound by confidentiality obligations, whether contractual or statutory.
5. Security
We implement appropriate technical and organizational measures to protect personal data, in line with the Israeli Privacy Protection (Data Security) Regulations 5777-2017 and, where it applies, Article 32 of the EU GDPR — including the measures described in the security section of the Privacy Policy. Those measures may be updated from time to time, provided the overall level of security is not reduced.
6. Sub-processors
The customer grants us general authorization to engage sub-processors in operating the service. The current list of sub-processors appears in the Privacy Policy published on this site. Before materially adding or replacing a sub-processor, we will give advance notice by email to the workspace owner, and the customer may object on reasonable data-protection grounds. If an objection cannot be resolved, the customer may cancel the engagement in accordance with the Terms of Service. We impose data-protection obligations substantially equivalent to those in this DPA on our sub-processors and remain responsible for their performance.
7. Assistance with data-subject rights
The platform includes built-in tools that help the customer respond to data-subject requests — data export, deletion, unsubscribe, and consent management. Taking the nature of the processing into account, we will provide reasonable further assistance where needed for the customer to meet its obligations to data subjects under applicable law.
8. Personal-data breach
We will notify the customer without undue delay after becoming aware of a security breach affecting personal data processed on its behalf, providing the information reasonably available to us at the time — including the nature of the breach, the data affected so far as known, and the measures taken or planned. We will keep the customer updated as further details become available.
9. International transfers
Our sub-processors may process data in countries other than the customer's own, including the United States and the European Union. Where required, we rely on appropriate safeguards such as the providers' standard contractual clauses (SCCs) and equivalent mechanisms.
10. Return and deletion
At the end of the engagement, data is deleted and retained in accordance with the data retention and deletion section of the Privacy Policy. The platform's export tools are available to the customer before the engagement ends for downloading a copy of the data. We may continue to retain data whose retention is required by law, as well as unsubscribe and suppression records, as described in the Privacy Policy.
11. Information and audit
On written request, we will make available to the customer reasonable information needed to demonstrate compliance with the commitments in this DPA. Where applicable law grants the customer a broader audit right, it will be exercised with advance coordination, at a reasonable scope, and in a manner that does not compromise the security of our systems or the confidentiality of other customers' data.
12. Liability, precedence, and governing law
This DPA is subject to the limitation of liability in the Terms of Service, which also applies to our obligations under it. In the event of a conflict between this DPA and the Terms of Service or the Privacy Policy on matters of personal-data processing, this DPA prevails. This DPA is governed by the governing-law and jurisdiction provisions of the Terms of Service.