Data Processing Addendum

1.1 Purpose. This Data Processing Addendum (the "Addendum") describes how Bitlogix Technologies ("Bitlogix") handles personal information that it processes on behalf of a Customer while providing the Services. It supplements the Terms and Conditions and forms part of the Agreement.

1.2 When it applies. The Addendum applies whenever Bitlogix has access to Personal Information in Customer Data in the course of the Services, whether that access is on the Customer's premises, through remote management tools, through vendor accounts that Bitlogix administers for the Customer, or because Customer Data is stored on systems that Bitlogix controls.

1.3 Order of precedence. If this Addendum conflicts with Section 7 of the Terms and Conditions, the Addendum governs for Personal Information. A Services Agreement signed by both parties, a schedule for regulated data, or a separate agreement required by law prevails over this Addendum to the extent of any conflict.

1.4 Changes. Bitlogix may update this Addendum by publishing a new version with a new "last updated" date. An update that reduces the protections for Personal Information applies to an existing Services Agreement only on its renewal or with the Customer's written agreement.

2.1 Defined terms. Capitalized terms not defined here have the meanings given in the Terms and Conditions. In this Addendum:

1. "Applicable Privacy Law" means British Columbia's Personal Information Protection Act (PIPA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and any other privacy or data protection law that applies to the Customer or to the Personal Information, including the privacy laws of other Canadian provinces where the Customer operates;
2. "Personal Information" means information about an identifiable individual, in any form, that is included in Customer Data, excluding the business contact information of the Customer's own staff used only to deal with the Customer.
3. "Processing" means any operation performed on Personal Information, including collecting, accessing, viewing, storing, copying, backing up, transferring, migrating, restoring, disclosing, erasing and destroying it, and "process" has the same meaning;
4. "Security Incident" has the meaning given in Section 7.5 of the Terms and Conditions;
5. "Subprocessor" means a subcontractor or vendor that Bitlogix engages to process Personal Information on the Customer's behalf, excluding Third-Party Services that the Customer selects or contracts for directly and that Bitlogix merely administers;
6. "Instructions" means the Customer's documented instructions to Bitlogix about Processing, which consist of the Agreement, the Services Agreement, support requests and other written directions given through the agreed support channels.

3.1 Customer. The Customer decides why and how Personal Information is collected and used, and is responsible for having the legal authority, consents and notices that Applicable Privacy Law requires for its collection and for its disclosure to Bitlogix.

3.2 Bitlogix. Bitlogix processes Personal Information only on behalf of the Customer and only to provide the Services. Bitlogix does not determine the purposes of Processing and does not become the owner of any Personal Information.

3.3 Business contact information. Bitlogix uses the business contact information of the Customer's staff (names, work email addresses, work phone numbers and job titles) under its own Privacy Policy to deliver and administer the Services. That information is not covered by this Addendum.

4.1 Processing on Instructions. Bitlogix will process Personal Information only as needed to perform the Services, in accordance with the Instructions, and as required by law. If a law requires Bitlogix to process Personal Information in a way not covered by the Instructions, Bitlogix will tell the Customer before doing so unless the law prohibits that notice.

4.2 Unlawful instructions. If Bitlogix believes that an Instruction would breach Applicable Privacy Law, Bitlogix will tell the Customer and may suspend the affected Processing until the parties agree a lawful approach.

4.3 What Bitlogix will not do. Bitlogix will not:

1. sell, rent, share for advertising or otherwise disclose Personal Information for any purpose other than performing the Services;
2. use Personal Information for its own purposes, including marketing, analytics about individuals, or building or improving products or services for other customers;
3. combine Personal Information received from the Customer with personal information from other customers or sources, except as needed to deliver a Service the Customer has ordered or as Applicable Privacy Law permits;
4. retain, use or disclose Personal Information outside the direct business relationship between the parties; or
5. process Personal Information in a way that is incompatible with the Instructions.

4.4 Minimum necessary. Bitlogix will access and view Personal Information only to the extent a support task, migration, backup, restore, investigation or other Service requires, and will avoid viewing the content of files, mailboxes and records where the task can be completed without it.

5.1 Confidentiality. Personal Information is the Customer's Confidential Information under Section 8 of the Terms and Conditions, and the obligations there apply to it indefinitely.

5.2 Personnel. Bitlogix will ensure that each person who processes Personal Information on its behalf is bound by written confidentiality obligations, has received privacy and security training appropriate to their role, is given access only to the Personal Information their work requires, and, where permitted by law and relevant to the role, has passed a criminal record check. Bitlogix will remove the access of any such person who leaves Bitlogix or the Customer's account within one (1) Business Day.

6.1 Safeguards. Bitlogix will protect Personal Information with the administrative, technical and physical safeguards described in Section 7.8 of the Terms and Conditions, which include multi-factor authentication and managed encrypted devices for Bitlogix personnel, named accounts with least privilege, an encrypted vault for credentials and secrets, encryption of Personal Information in transit and at rest on Bitlogix's systems, patched and monitored tools, logging of administrative access, prompt removal of access for departing personnel, and secure disposal of media under Section 7.15.

6.2 Customer systems. Where Personal Information resides on the Customer's own systems or on Third-Party Services, the security of those systems depends on their configuration, the Vendor Terms and the Customer's decisions. Bitlogix will implement the security measures included in the Service Plan and will recommend in writing any further measures that it believes are needed to protect Personal Information. The Customer decides whether to adopt them.

6.3 Review. Bitlogix will review its safeguards at least annually and after any Security Incident, and will not reduce the overall level of protection for Personal Information during the term of a Services Agreement.

7.1 Authorization. The Customer authorizes Bitlogix to engage Subprocessors to help provide the Services, such as the providers of Bitlogix's remote management, ticketing, documentation, backup and email platforms. Bitlogix will give the Customer a current list of Subprocessors on request.

7.2 Changes. Bitlogix will give the Customer at least thirty (30) days' written notice before a new Subprocessor begins processing Personal Information. If the Customer has a reasonable objection based on privacy or security grounds, the parties will work together to find a solution. If none can be found within the notice period, the Customer may terminate the affected Services on written notice without an early termination charge.

7.3 Flow-down and responsibility. Bitlogix will bind each Subprocessor in writing to data protection obligations no less protective than those in this Addendum, will give it access only to the Personal Information it needs, and remains responsible to the Customer for the Subprocessor's performance.

7.4 Third-Party Services. Vendors that the Customer selects or contracts with directly, such as its email, accounting or line-of-business platforms, are not Subprocessors, even where Bitlogix administers the account for the Customer. Their handling of Personal Information is governed by the Vendor Terms, and Bitlogix will help the Customer review them on request.

8.1 Notice. If Bitlogix becomes aware of a Security Incident affecting Personal Information, Bitlogix will notify the Customer without undue delay and in any event within seventy-two (72) hours after confirming it, and will follow the process in Section 7.5 of the Terms and Conditions: a description of what is known, regular updates, containment and preservation of evidence, and a written summary once the incident is contained.

8.2 Assistance. Bitlogix will give the Customer the information reasonably needed to assess the incident and to decide whether notification to individuals, regulators or others is required under Applicable Privacy Law, including the categories and approximate number of individuals and records affected, where known. The Customer decides on and makes those notifications. Bitlogix will help prepare them at the Customer's request.

8.3 No public statements. Bitlogix will not notify affected individuals, regulators, the media or the public about a Security Incident affecting the Customer unless the law requires it to do so or the Customer directs it to.

8.4 Cost. Assistance under this Section is provided at Bitlogix's hourly rates, unless the Services include incident response or the Security Incident resulted from Bitlogix's breach of the Agreement, in which case it is provided at no charge to the extent of the breach.

9.1 Requests from individuals. If Bitlogix receives a request from an individual to access, correct, delete or stop using their Personal Information, Bitlogix will not respond to it except to direct the individual to the Customer, and will forward the request to the Customer within five (5) Business Days. Bitlogix will help the Customer respond, for example by locating or exporting records, at its hourly rates unless the Services Agreement includes it.

9.2 Assessments and inquiries. Bitlogix will provide the information reasonably available to it to support the Customer's privacy impact assessments, security reviews, insurance applications and responses to regulators, taking into account the nature of the Services and the information Bitlogix holds.

9.3 Records. Bitlogix will keep reasonable records of the Services it performs that involve Personal Information, including the Subprocessors used and the locations where Personal Information in its possession is stored, and will make them available under Section 12.

10.1 Location. On request, Bitlogix will tell the Customer the country or countries in which Personal Information in Bitlogix's own possession is stored, including backups. Bitlogix will give the Customer at least thirty (30) days' written notice before moving Personal Information it holds to a different country, except where the move is required by law or is necessary to respond to an emergency.

10.2 Transfers by vendors. Some Subprocessors and Third-Party Services store or process information outside Canada. Where that is the case, Bitlogix will tell the Customer on request, and the Customer acknowledges that Personal Information held by those providers may be subject to the laws of the country where it is stored. Where the Services Agreement requires Personal Information to remain in a particular country, Bitlogix will configure the Third-Party Services it manages for the Customer to use that country's regions wherever the vendor makes them available and will tell the Customer in writing where that is not possible.

10.3 Provincial requirements. Where the Customer is subject to Quebec's private-sector privacy law, the parties will record in the Services Agreement any additional measures that law requires, including the assessment of transfers outside Quebec.

11.1 Retention. Bitlogix retains Personal Information in its own possession only for as long as needed to provide the Services and as required by law. Personal Information held in Bitlogix's ticketing, documentation and monitoring systems is kept for the retention period stated in the Service Plan or, if none is stated, for the term of the Agreement.

11.2 Return and deletion. On termination of the Agreement, Section 7.7 of the Terms and Conditions applies: Bitlogix will return Personal Information in its possession on written request made within thirty (30) days, in a commonly used, machine-readable format, and may delete it sixty (60) days after termination, except for copies that must be kept by law or that sit in archival backups, logs and billing records until they are overwritten in the ordinary course. Retained copies remain protected by this Addendum.

11.3 Confirmation. On request, Bitlogix will confirm in writing that it has deleted or destroyed Personal Information that it no longer needs, and will dispose of media under Section 7.15 of the Terms and Conditions.

12.1 Information. Not more than once in any twelve (12) month period, on at least thirty (30) days' written notice, the Customer may ask Bitlogix to answer a reasonable written questionnaire about its handling of Personal Information and to provide evidence of the safeguards described in this Addendum, such as policies, configuration summaries, training records and Subprocessor attestations.

12.2 Audit. Where the Customer's regulator, insurer or Applicable Privacy Law requires a further review, Bitlogix will cooperate with an audit of its Processing of Personal Information, during Business Hours and in a manner that does not unreasonably disrupt Bitlogix's business or expose other customers' Confidential Information. The Customer bears the cost of any audit beyond the annual questionnaire, including Bitlogix's time at its hourly rates, unless the audit reveals a material breach by Bitlogix.

13.1 Additional requirements. Health information, information from public bodies and other categories subject to additional rules will be covered by a schedule to the Services Agreement that sets out the extra requirements before Bitlogix processes them.

13.2 Notice to Bitlogix. The Customer will tell Bitlogix in writing before giving Bitlogix access to regulated categories of Personal Information so that the required agreement or schedule can be put in place first. Bitlogix may decline to process regulated information until it is.

14.1 Term. This Addendum applies for as long as Bitlogix processes Personal Information on the Customer's behalf, and Sections 5, 10 and 11 continue to apply to any Personal Information that Bitlogix retains after termination.

14.2 Liability. The limitations and exclusions of liability in Section 11 of the Terms and Conditions apply to this Addendum, except where Applicable Privacy Law does not allow them to be limited.

14.3 Customer responsibilities. Nothing in this Addendum relieves the Customer of its own obligations under Applicable Privacy Law, including its duty to limit the Personal Information it collects and shares with Bitlogix to what its purposes require.

14.4 Contact. Our privacy officer is Sabastien Obi, reachable at hello@bitlogix.tech or +1 (778) 779-7127.