This Data Processing Agreement (“DPA”) forms part of the Terms of Service available at clarita.app/terms (the “Agreement”) between Clarita Technology Inc. (“Clarita” or “Processor”) and the entity identified in the applicable account or Order Form (“Customer” or “Controller”) (each a “Party” and together the “Parties”).

By using the Service, Customer agrees to this DPA. Where Customer has executed a separate agreement with Clarita that references or incorporates this DPA, the terms of this DPA shall apply to the processing of Personal Data under that agreement.

1. Introduction and Scope

1.1 Purpose

This DPA sets out the Parties’ obligations with respect to the processing and security of Personal Data in connection with Customer’s use of the Service. This DPA is intended to ensure compliance with applicable Data Protection Laws, including Canadian federal and provincial privacy legislation and U.S. state privacy laws.

1.2 Scope

This DPA applies to all processing of Personal Data by Clarita on behalf of Customer in connection with the provision of the Service. The subject matter, nature, purpose, duration, types of Personal Data, and categories of Data Subjects are described in Schedule A.

1.3 Precedence

In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing and protection of Personal Data. In the event of any conflict between this DPA and any applicable Data Protection Law, the requirements of such Data Protection Law shall prevail.

2. Definitions

Capitalized terms not defined in this DPA have the meanings given to them in the Agreement. In this DPA:

“Applicable Data Protection Laws” or “Data Protection Laws” means all applicable laws, regulations, and binding guidance relating to the processing and protection of Personal Data, including: (a) the Personal Information Protection and Electronic Documents Act (PIPEDA); (b) Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25); (c) any other applicable Canadian provincial privacy legislation; (d) the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA); (e) any other applicable U.S. state privacy legislation; and (f) to the extent applicable, the European Union General Data Protection Regulation (GDPR) and the United Kingdom GDPR.

“Controller” means the Party that determines the purposes and means of the processing of Personal Data. For the purposes of this DPA, Controller refers to Customer. Under PIPEDA and Quebec privacy law, this corresponds to the entity that collects and controls Personal Data. Under the CCPA/CPRA, this corresponds to the “Business.”

“Data Subject” means an identified or identifiable individual whose Personal Data is processed under this DPA.

“Personal Data” means any information that relates to, describes, identifies, or could reasonably be linked, directly or indirectly, to an identified or identifiable individual, as defined under the applicable Data Protection Laws. This includes “personal information” as defined under PIPEDA, Quebec privacy law, and the CCPA/CPRA.

“Processing” (and its variants, including “Process” and “Processed”) means any operation or set of operations performed on Personal Data, whether by automated or manual means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, combination, restriction, erasure, and destruction.

“Processor” means the Party that processes Personal Data on behalf of the Controller. For the purposes of this DPA, Processor refers to Clarita. Under the CCPA/CPRA, this corresponds to a “Service Provider.”

“Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed by Clarita under this DPA. A Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as failed login attempts, pings, port scans, denial-of-service attacks, or similar incidents.

“Sub-processor” means any third party engaged by Clarita to process Personal Data on behalf of Customer in connection with the Service.

3. Roles and Responsibilities

3.1 Customer as Controller

Customer is the Controller of Personal Data processed through the Service. Customer is responsible for: (a) determining the lawful basis for processing Personal Data; (b) ensuring that it has obtained all necessary consents and provided all required notices to Data Subjects in accordance with applicable Data Protection Laws; (c) the accuracy, quality, and legality of Personal Data provided to Clarita; and (d) complying with its obligations as a Controller under applicable Data Protection Laws.

3.2 Clarita as Processor

Clarita shall process Personal Data solely on behalf of and in accordance with Customer’s documented instructions, as described in this DPA and the Agreement. Clarita shall not: (a) process Personal Data for any purpose other than as necessary to provide the Service and fulfill its obligations under the Agreement; (b) “sell” or “share” Personal Data (as those terms are defined under the CCPA/CPRA); (c) retain, use, or disclose Personal Data for any commercial purpose other than providing the Service; or (d) combine Personal Data with personal data received from or on behalf of other customers or collected from Clarita’s own interactions with Data Subjects, except as expressly permitted by applicable Data Protection Laws.

3.3 Compliance Certification

Clarita certifies that it understands and will comply with the restrictions and obligations set forth in this DPA and applicable Data Protection Laws. Clarita shall promptly inform Customer if, in Clarita’s opinion, an instruction from Customer infringes applicable Data Protection Laws.

4. Processing Instructions

4.1 Documented Instructions

Clarita shall process Personal Data only in accordance with Customer’s documented instructions. The Agreement (including this DPA) constitutes Customer’s initial instructions. Customer may issue additional or modified instructions to Clarita in writing, provided such instructions are consistent with the Agreement and the nature of the Service.

4.2 Scope of Processing

The details of Clarita’s processing activities, including the subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects, are described in Schedule A.

4.3 Additional Instructions

If Customer requires processing beyond the scope described in Schedule A or the Agreement, Clarita will cooperate in good faith to accommodate such requests, which may require a separate written agreement and additional fees. Clarita is not obligated to perform processing outside the scope of the Service.

4.4 Notification of Non-Compliance

Clarita shall promptly notify Customer if it becomes aware that processing of Personal Data under Customer’s instructions may violate applicable Data Protection Laws, unless prohibited from doing so by applicable law. Clarita may suspend the relevant processing until Customer issues new instructions that Clarita reasonably determines are compliant.

5. Personnel and Confidentiality

5.1 Authorized Personnel

Clarita shall ensure that access to Personal Data is limited to personnel who have a need to access it for the purposes of performing Clarita’s obligations under the Agreement and this DPA (“Authorized Personnel”).

5.2 Confidentiality Obligations

Clarita shall ensure that all Authorized Personnel: (a) are bound by written confidentiality obligations at least as protective as those set forth in this DPA; (b) have received appropriate training on data protection and privacy; and (c) process Personal Data only in accordance with Customer’s instructions as set forth in this DPA.

5.3 Ongoing Training

Clarita shall provide regular data protection and security awareness training to Authorized Personnel who process Personal Data.

6. Security Measures

6.1 Technical and Organizational Measures

Clarita shall implement and maintain appropriate technical and organizational security measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, or disclosure. These measures shall be appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. The specific security measures are described in Schedule B.

6.2 Minimum Standards

Without limiting Section 6.1, Clarita’s security measures shall include, at a minimum:

1. Encryption of Personal Data in transit and at rest using industry-standard protocols;
2. Access controls, including role-based access, unique user authentication, and multi-factor authentication for administrative and privileged access;
3. Network security controls, including firewalls, intrusion detection/prevention systems, and network segmentation;
4. Regular vulnerability assessments and penetration testing;
5. Logging and monitoring of access to systems processing Personal Data;
6. Incident response and disaster recovery procedures;
7. Secure development practices, including code review and security testing; and
8. Physical security controls at data center facilities.

6.3 Ongoing Review

Clarita shall regularly review and, where appropriate, update its security measures to reflect changes in technology, industry standards, and the risk profile of its processing activities. Clarita shall not materially reduce the overall level of security provided under this DPA during the term of the Agreement.

7. Sub-processors

7.1 Authorization

Customer provides general written authorization for Clarita to engage Sub-processors to process Personal Data in connection with the Service, subject to the requirements of this Section 7. The current list of Sub-processors is available at sub-processors.

7.2 Sub-processor Obligations

Before engaging any Sub-processor, Clarita shall: (a) conduct reasonable due diligence to evaluate the Sub-processor’s ability to provide adequate data protection; and (b) enter into a written agreement with the Sub-processor that imposes data protection obligations no less protective than those set forth in this DPA.

7.3 Notification of New Sub-processors

Clarita shall provide Customer with at least thirty (30) days’ prior written notice before engaging any new Sub-processor or replacing an existing Sub-processor. Notice will be provided via email to the address associated with Customer’s account and by updating the Sub-processor list at clarita.app/sub-processors. Customer may subscribe to notifications of Sub-processor changes at the same URL.

7.4 Right to Object

If Customer has a reasonable, good-faith objection to a new or replacement Sub-processor based on legitimate data protection grounds, Customer shall notify Clarita in writing within fifteen (15) days of receiving notice. The Parties shall work together in good faith to resolve the objection, which may include Clarita providing additional information about its due diligence, offering an alternative Sub-processor, or modifying the processing arrangement. If the Parties are unable to resolve the objection within thirty (30) days of Customer’s notice, Customer may terminate the affected portion of the Service (or the Agreement, if the Sub-processor is essential to the Service as a whole) and receive a pro-rata refund of any prepaid fees for the unused portion of the Subscription Term.

7.5 Liability

Clarita shall remain fully liable to Customer for the acts and omissions of its Sub-processors in relation to the processing of Personal Data to the same extent as if Clarita had performed the processing itself.

8. Data Subject Rights

8.1 Assistance

Clarita shall, taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Customer’s obligation to respond to requests from Data Subjects exercising their rights under applicable Data Protection Laws, including requests for access, rectification, erasure, restriction, portability, and objection.

8.2 Notification

If Clarita receives a request directly from a Data Subject relating to Personal Data processed on behalf of Customer, Clarita shall promptly (and in any event within five (5) business days) notify Customer of the request and shall not respond to the Data Subject directly unless: (a) directed to do so by Customer; (b) required to do so by applicable law (in which case Clarita will, to the extent permitted, inform Customer before responding); or (c) the response is limited to directing the Data Subject to contact Customer.

8.3 Self-Service Features

Clarita shall provide Customer with reasonable self-service functionality within the Service to enable Customer to access, export, correct, and delete Personal Data, to the extent technically feasible. Where self-service functionality does not cover a specific Data Subject request, Clarita shall provide reasonable manual assistance to Customer upon request.

9. Security Incident Notification

9.1 Notification

Clarita shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident. Notification shall be made via email to the address associated with Customer’s account and, where available, through an additional communication channel designated by Customer.

9.2 Content of Notification

The notification shall include, to the extent reasonably available at the time of notification (with updates provided as additional information becomes available):

1. A description of the nature of the Security Incident, including, where possible, the categories and approximate number of Data Subjects and Personal Data records affected;
2. The name and contact details of Clarita’s Data Protection Officer or other contact point for further information;
3. A description of the likely consequences of the Security Incident;
4. A description of the measures taken or proposed to be taken to address the Security Incident, including measures to mitigate its possible adverse effects; and
5. The date and time the Security Incident was discovered.

9.3 Remediation

Clarita shall: (a) take all commercially reasonable steps to contain, investigate, and remediate the Security Incident; (b) cooperate with Customer in connection with any investigation, notification, or remediation efforts, including providing Customer with reasonably requested information and assistance; and (c) preserve evidence related to the Security Incident as reasonably requested by Customer or as required by applicable law.

9.4 Customer’s Notification Obligations

Customer is solely responsible for determining whether a Security Incident triggers any notification obligations to Data Subjects, regulators, or other parties under applicable Data Protection Laws, and for making such notifications. Clarita shall cooperate with Customer to provide information necessary for Customer to fulfill its notification obligations.

9.5 Record Keeping

In accordance with Quebec Law 25, Clarita shall maintain a register of all confidentiality incidents, including those that do not present a risk of serious injury. The register shall include a description of the incident, the Personal Data affected, the date of the incident or the period in which it occurred, the date on which Clarita became aware of the incident, and the measures taken to reduce the risk of harm. Records shall be retained for a minimum of five (5) years from the date Clarita became aware of the incident.

10. Privacy Impact Assessments

10.1 Assistance

Clarita shall provide reasonable assistance to Customer in conducting privacy impact assessments (“PIAs”) and prior consultations with supervisory authorities, to the extent that such assessments relate to Clarita’s processing of Personal Data under this DPA. Assistance may include providing information about Clarita’s processing activities, security measures, and Sub-processors.

10.2 Clarita’s Own Assessments

In accordance with Quebec Law 25, Clarita conducts PIAs for its own processing activities, including assessments of cross-border data transfers and the implementation of new technologies that involve the collection, use, or disclosure of Personal Data. Summaries of relevant PIAs are available upon request.

11. Cross-Border Data Transfers

11.1 Transfer Locations

Customer acknowledges that in the course of providing the Service, Personal Data may be transferred to and processed in jurisdictions outside Customer’s jurisdiction of residence, including Canada, the United States, and other countries where Clarita’s Sub-processors operate. The current processing locations are identified in Schedule A.

11.2 Safeguards

For all cross-border transfers of Personal Data, Clarita shall ensure that appropriate safeguards are in place, including:

1. Contractual obligations with Sub-processors requiring compliance with applicable data protection standards and restricting further transfers;
2. Privacy impact assessments as required by Quebec Law 25 before transferring Personal Data outside Quebec, evaluating whether the receiving jurisdiction provides adequate protection;
3. Technical and organizational measures to protect Personal Data during transfer and in the receiving jurisdiction; and
4. Where applicable, reliance on adequacy determinations, standard contractual clauses, or other transfer mechanisms recognized under applicable Data Protection Laws.

11.3 GDPR Transfers

To the extent that the processing of Personal Data under this DPA is subject to the GDPR or UK GDPR, and such processing involves a transfer of Personal Data to a country that has not received an adequacy determination from the European Commission or UK Secretary of State (as applicable), the Parties agree that such transfers shall be subject to the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) or their UK equivalent, as applicable. The Standard Contractual Clauses are hereby incorporated by reference and shall be deemed completed with the information set forth in Schedule A. In the event of a conflict between the Standard Contractual Clauses and this DPA, the Standard Contractual Clauses shall prevail with respect to such transfers.

11.4 Notification of Government Access Requests

Clarita shall, to the extent legally permitted, promptly notify Customer if Clarita receives any request or order from a governmental or regulatory authority for access to or disclosure of Personal Data processed under this DPA. Clarita shall not disclose Personal Data in response to such a request unless required to do so by applicable law, and shall cooperate with Customer in challenging such requests where appropriate.

12. Return and Deletion of Personal Data

12.1 During the Subscription Term

During the Subscription Term, Customer may access, export, and delete Personal Data through the self-service functionality of the Service or by contacting Clarita at privacy@clarita.app.

12.2 Upon Termination

Upon expiration or termination of the Agreement, Clarita shall:

1. Upon Customer’s written request made within thirty (30) days following termination or expiration, make Customer Data (including Personal Data) available for export in a structured, commonly used, and machine-readable format;
2. After such thirty (30) day period (or upon Customer’s earlier written confirmation), delete all Personal Data processed on behalf of Customer from Clarita’s systems and those of its Sub-processors within a commercially reasonable timeframe, except as required by applicable law or regulation; and
3. Upon Customer’s request, provide written certification of deletion.

12.3 Legal Retention

Clarita may retain Personal Data to the extent required by applicable law, regulation, or legal process, or to maintain its confidentiality incident register as required by Quebec Law 25. Any retained Personal Data shall continue to be protected in accordance with this DPA and shall be processed solely for the purpose for which retention is required.

13. Audits and Compliance

13.1 Information and Access

Clarita shall make available to Customer, upon reasonable request, all information reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Laws. This includes access to relevant policies, procedures, certifications, audit reports, and summaries of privacy impact assessments.

13.2 Third-Party Audits and Certifications

Clarita shall, at its own expense, engage an independent, qualified third-party auditor to conduct an annual assessment of Clarita’s security controls and data processing practices. Clarita will provide Customer with a summary of the most recent audit findings upon written request, subject to confidentiality obligations. Accepted audit frameworks include SOC 2 Type II, ISO 27001, or equivalent certifications.

13.3 Customer Audits

If Customer reasonably determines that the information and certifications provided under Sections 13.1 and 13.2 are insufficient to verify Clarita’s compliance with this DPA, Customer may, at its own expense, conduct or commission a reasonable audit of Clarita’s processing activities, subject to the following conditions:

1. Customer shall provide at least thirty (30) days’ prior written notice of the audit;
2. Audits shall be conducted no more than once per twelve (12) month period, unless a Security Incident has occurred or a supervisory authority requires an audit;
3. Audits shall be conducted during normal business hours and in a manner that minimizes disruption to Clarita’s operations;
4. Auditors shall be bound by confidentiality obligations acceptable to Clarita;
5. Customer shall not have access to data or systems of other Clarita customers; and
6. Audit findings and reports shall be treated as Clarita’s Confidential Information.

13.4 Remediation

If an audit reveals any material non-compliance with this DPA, Clarita shall promptly develop and implement a remediation plan and provide Customer with reasonable progress updates until the non-compliance is resolved.

14. Liability

14.1 Liability Cap

Each Party’s liability under this DPA shall be subject to the limitations and exclusions of liability set forth in the Agreement, except as otherwise required by applicable Data Protection Laws.

14.2 Indemnification

Each Party shall indemnify and hold harmless the other Party from and against any losses, damages, fines, penalties, costs, and expenses (including reasonable attorneys’ fees) arising from or related to any breach of this DPA by the indemnifying Party or its personnel, Sub-processors, or agents, subject to the limitation of liability provisions in the Agreement.

15. Term and Termination

15.1 Term

This DPA shall become effective on the date Customer accepts the Agreement and shall remain in effect for the duration of the Agreement. This DPA shall automatically terminate upon the termination or expiration of the Agreement, subject to any provisions that survive termination.

15.2 Survival

Sections 2, 6, 9.5, 12, 13, 14, and 16 shall survive any termination or expiration of this DPA.

16. General Provisions

16.1 Governing Law

This DPA shall be governed by and construed in accordance with the laws of the Province of Quebec and the federal laws of Canada applicable therein, consistent with the governing law provisions of the Agreement. This choice of law does not affect the applicability of mandatory data protection provisions of other jurisdictions where applicable.

16.2 Amendments

Clarita may update this DPA from time to time to reflect changes in applicable Data Protection Laws, industry standards, or Clarita’s processing activities. Clarita shall provide Customer with at least thirty (30) days’ prior written notice of any material changes. Customer’s continued use of the Service after the effective date of any update constitutes acceptance of the updated DPA.

16.3 Entire DPA

This DPA (including its Schedules) constitutes the entire agreement between the Parties with respect to the processing and protection of Personal Data in connection with the Service and supersedes all prior agreements, understandings, and communications on such subject matter.

16.4 Severability

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

16.5 Contact

For any questions or concerns regarding this DPA, please contact:

Nicholas Martin, Data Protection Officer
Email: privacy@clarita.app
Clarita Technology Inc., 342 Penn, Beaconsfield, QC H9W 1B6, Canada