Data Processing Agreement

“Customer Data” means any personal information submitted to the Service by or on behalf of the Controller, including inventory records, supplier and customer contact information, and transactional data.

“Personal Information”has the meaning given in PIPEDA (S.C. 2000, c. 5) and, where the Controller is subject to Quebec Law 25, includes “personal information” as defined therein.

“Data Breach”means a loss of, unauthorized access to, or unauthorized disclosure of Customer Data resulting from a breach of the Processor’s security safeguards.

“Sub-processor” means any third-party service provider engaged by the Processor to process Customer Data.

“PIPEDA” means the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, and the Breach of Security Safeguards Regulations (SOR/2018-64), as amended.

The Processor will:

(a) Process Customer Data only on documented instructions from the Controller (which include use of the Service as described in the Terms of Service), unless required to do so by applicable law (in which case the Processor will notify the Controller before processing, to the extent legally permitted);

(b) Ensure that personnel authorized to process Customer Data are subject to confidentiality obligations;

(c) Implement and maintain the technical and organizational security measures described in Section 5;

(d) Not sell or rent Customer Data to any third party;

(e) Notify the Controller in accordance with Section 4 in the event of a Data Breach;

(f) Assist the Controller in responding to requests from individuals exercising their rights under PIPEDA or applicable provincial privacy law, including Quebec Law 25;

(g) Upon termination of the Terms of Service, provide the Controller with a complete export of Customer Data within 30 days in CSV or JSON format, and thereafter securely delete Customer Data from the Processor’s systems within 90 days, unless retention is required by law.

In the event of a Data Breach involving Customer Data:

(a) The Processor will notify the Controller within 72 hours of becoming aware of the breach, even if not all details are known at the time of initial notification;

(b) The initial notification will include, to the extent then known: a description of the nature of the breach, the categories and approximate volume of Customer Data affected, the likely consequences of the breach, and measures taken or proposed to address the breach;

(c) The Processor will provide additional details as they become available and will cooperate with the Controller’s incident response;

(d) The Processor will notify the Office of the Privacy Commissioner of Canada (OPC) as required under PIPEDA s. 10.1 (“as soon as feasible”) and will assist the Controller in notifying affected end-users where required;

(e) The Processor will maintain records of all Data Breaches, whether or not reportable, for a minimum of 24 months as required under the Breach of Security Safeguards Regulations (SOR/2018-64, s. 6).

Note: PIPEDA does not prescribe a fixed-hour deadline for OPC notification but requires action “as soon as feasible.” The 72-hour Controller notification commitment in clause (a) is a contractual commitment that exceeds the minimum statutory standard and reflects enterprise best practice.

Customer Data may be transferred to and processed in Canada and other countries, including the United States and the United Kingdom, by the Sub-processors listed in Section 6. The Processor does not represent that Customer Data is stored exclusively in Canada.

The Processor ensures that:

(a) All cross-border Sub-processor transfers are subject to contractual data protection obligations no less protective than those in this DPA (PIPEDA Schedule 1, Principle 4.1.3 — Accountability for Onward Transfers);

(b) Controllers subject to Quebec Law 25 may request a summary of Privacy Impact Assessments (PIAs) conducted for cross-border transfers to non-Quebec jurisdictions.

The Controller represents and warrants that:

(a) It has the authority to provide Customer Data to the Processor for processing under this DPA;

(b) It has provided all required notices and obtained all necessary consents under applicable law for the personal information included in Customer Data;

(c) It will use the Service only in compliance with applicable law, including privacy laws applicable to its own jurisdiction and industry.

Upon the Controller’s written request (no more than once per calendar year), the Processor will:

(a) Provide a written response to a security questionnaire or provide the results of its most recent third-party penetration test or independent security assessment, subject to reasonable confidentiality obligations; or

(b) Provide documentation of its technical and organizational security measures as described in Section 5, and any remediation actions taken following security assessments.

The Processor conducts annual penetration testing and vulnerability assessments and maintains documented security policies and incident response procedures.

This DPA remains in effect for the duration of the Terms of Service. Upon expiry or termination of the Terms of Service:

(a) The Processor will cease processing Customer Data for the purpose of providing the Service;

(b) The Processor will make Customer Data available for export for 30 days;

(c) Thereafter, the Processor will securely delete Customer Data within 90 days, except to the extent retention is required by law (e.g., financial records retained under the Income Tax Act for six years);

(d) Sections 4 (Data Breach Notification), 7 (Cross-Border Transfers), and 9 (Audit Rights) survive termination to the extent they relate to events occurring during the term.