Data Processing Agreement

1. Definitions and Scope

This Data Processing Agreement (DPA) governs the processing of personal data by Canzobytex Inc. (the "Processor"), located at Rue Sainte-Catherine 1422, H3G1R5 Montreal, directed by Stephanie Brown, on behalf of the Client (the "Controller"). This agreement is supplementary to the Terms and Conditions.

The scope of this agreement covers all personal data processed during the provision of editorial and copywriting services. Both parties agree to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL).

2. Obligations of the Processor

The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by Canadian law. The Processor ensures that persons authorized to process the data have committed themselves to confidentiality.

The Processor shall assist the Controller in fulfilling its obligations to respond to requests from data subjects, as outlined in the Privacy Policy.

3. Categories of Data and Subjects

The data processed under this agreement includes:

• Data Subjects: Client employees, interviewees, and company representatives.
• Data Categories: Names, professional titles, contact details (e-mail, phone), and professional biographies provided for corporate stories or localization.
• Purpose: Creating website copy, corporate blogs, and conducting interviews.

4. Sub-processors

The Processor engages the following sub-processors to ensure service delivery:

• WHC.CA: Hosting provider located at 7005 boul. Taschereau, Bureau 200, Brossard QC J4Z 1A7.
• FormSubmit: Service used for processing contact requests (data transferred to USA).

The Processor ensures that sub-processors are bound by data protection obligations no less stringent than those in this DPA.

5. Security and Incident Notification

Canzobytex Inc. implements technical and organizational measures to protect data against unauthorized access or loss. In the event of a data breach, the Processor will notify the Controller without undue delay after becoming aware of the incident.

Complaints regarding data handling may be directed to the Office of the Privacy Commissioner of Canada (OPC), 30 Victoria Street, Gatineau QC K1A 1H3.

6. Data Retention and Deletion

Personal data is processed for the duration of the service contract. In accordance with our business rules, draft materials are stored for 6 months after the final delivery of the project.

Upon termination of services or upon written request, the Processor will delete or return all personal data to the Controller, except where retention is required by law.

7. Audit and Compliance

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and PIPEDA. The Controller may conduct audits of the Processor's data handling practices upon reasonable prior notice.

8. Final Provisions

This DPA is governed by the laws of Quebec and Canada. Any disputes arising from this agreement shall be subject to the exclusive jurisdiction of the courts in Montreal.

For inquiries regarding this agreement, please contact:

Canzobytex Inc.
Rue Sainte-Catherine 1422, H3G1R5 Montreal
Email: [email protected]
Phone: (514) 277-8535