# Roles and responsibilities

Controller vs processor and shared duties.

This page defines who owns key responsibilities for privacy, security, and compliance at Cortena.

## 1. Purpose

To clarify ownership and contact points for customers and internal operations.

## 2. Responsibilities

### 2.1 CTO (Security & Infrastructure Owner)

- Infrastructure security controls
- Access control approvals (together with CEO)
- Incident technical response leadership

### 2.2 CEO / Compliance Owner

- Customer-facing compliance and procurement responses
- Contract and DPA/AVV coordination
- Sub-processor transparency and updates

### 2.3 Engineering

- Secure development practices
- Change management via MR + CI/CD
- Remediation and improvements after incidents

### 2.4 Controller vs processor

Under the [DPA](https://help.cortena.ai/compliance/dpa), the **Customer** is the controller and **Cortena B.V.** is the processor for Customer Personal Data processed in the Service.

## 3. Data Protection Officer (DPO)

Cortena has appointed **Sharon Klaver** as Data Protection Officer (DPO) in accordance with GDPR Article 37.

- DPO contact: [dpo@cortena.ai](mailto:dpo@cortena.ai)

## 4. Contact

- Compliance / DPA: [compliance@cortena.ai](mailto:compliance@cortena.ai)
- DPO / Privacy (GDPR): [dpo@cortena.ai](mailto:dpo@cortena.ai)
- Support: [support@cortena.ai](mailto:support@cortena.ai)