Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Terms of Service (the "Terms") between BurTech Solution ("we", "us" and "our") and the Customer. It applies whenever we process Personal Information in Customer Data on the Customer's behalf.

The DPA takes effect when the Customer accepts the Terms, and no separate signature is needed. If you would like a signed copy for your records, write to [email protected]. Capitalised words that this DPA does not define have the meaning given in the Terms.

1. Purpose and order of precedence

This DPA sets out the terms on which we process Customer Personal Information as the Customer's processor, so that both parties meet the requirements of Data Protection Laws.

If this DPA conflicts with the Terms, this DPA applies to anything about the processing of Personal Information. If the Standard Contractual Clauses or another transfer mechanism in Section 13 apply and conflict with this DPA or the Terms, the transfer mechanism applies.

This DPA lasts for as long as we process Customer Personal Information, including after the Terms end until the deletion described in Section 11 is complete.

2. Definitions

Customer Personal Information: Personal Information in Customer Data that we process on the Customer's behalf under the Terms.
Data Protection Laws: All privacy and data protection laws that apply to the processing of Customer Personal Information under the Terms. Where they apply, these include: the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"); the GDPR as it forms part of the law of the United Kingdom (the "UK GDPR") and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection of 25 September 2020 (the "Swiss FADP"); Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and provincial private-sector privacy laws, including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, and the Personal Information Protection Acts of Alberta and British Columbia; United States state privacy laws, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (the "CCPA"); Brazil's Lei Geral de Proteção de Dados (the "LGPD"); and other similar laws, such as South Africa's Protection of Personal Information Act.
Controller, processor, data subject, processing and supervisory authority: Have the meanings given in the GDPR. Where other Data Protection Laws use equivalent terms, these words include them. For example, "controller" includes a "business" and "processor" includes a "service provider" or "contractor" under the CCPA, and "data subject" includes a "consumer" and any other individual whose information Data Protection Laws protect.
Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Information while we or our Subprocessors transmit, store or otherwise process it. It includes a "breach of security safeguards" under PIPEDA and a "confidentiality incident" under Quebec law, to the extent they involve Customer Personal Information.
Standard Contractual Clauses: The standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
Subprocessor: A third party that we engage to process Customer Personal Information on our behalf. Providers of Third-Party Services that the Customer connects are not Subprocessors.
UK Addendum: The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

3. Roles of the parties

Customer Personal Information

For Customer Personal Information, the Customer is the controller and we are its processor. If the Customer itself processes some Customer Personal Information as a processor for someone else, the Customer confirms that its instructions to us, including our appointment as its subprocessor, are authorised by that controller, and we act as the Customer's subprocessor.

Account Data and our own records

We are an independent controller for Account Data, for information sent to us through our website, and for information about the Customer's contacts that we use to manage our relationship with the Customer. Our Privacy Policy describes that processing. The rest of this DPA does not apply to it.

The Customer's responsibilities

The Customer is responsible for:

complying with Data Protection Laws in its use of the Services, including having a lawful ground for the processing and giving the notices and obtaining the consents those laws require, for example to record calls or to send commercial messages;
the accuracy and quality of Customer Personal Information, and for deciding what it records, including any special categories of information; and
making sure its instructions to us comply with Data Protection Laws.

4. Processing on documented instructions

We process Customer Personal Information only on the Customer's documented instructions, including with regard to transfers to other countries, unless the law requires us to do otherwise. In that case we will tell the Customer about the legal requirement before processing, unless the law forbids it.

The Customer's documented instructions are:

the Terms and this DPA;
the Customer's configuration of the Services, including its settings, the Third-Party Services it connects and the automations it sets up;
the actions its Users take in the Services; and
any other written instruction the Customer gives us that is consistent with the Terms, such as a support request.

We will tell the Customer promptly if, in our opinion, an instruction infringes Data Protection Laws. We may then suspend the processing concerned until the instruction is confirmed or changed. We do not have to check whether instructions comply with the law, and our telling the Customer is not legal advice.

We will not process Customer Personal Information for any other purpose.

5. Confidentiality of personnel

We make sure that everyone we authorise to process Customer Personal Information, including our employees and contractors, is bound by a duty of confidentiality, by contract or by law, and has access only to the extent their role needs it. Our staff do not look at the content of a Customer's Workspace except as Section 6 of the Terms allows.

6. Security

We implement and maintain technical and organisational measures that are appropriate to the risk of the processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. Annex 2 describes them.

We may update these measures as technology and threats change, but we will not change them in a way that materially reduces the overall level of protection of Customer Personal Information.

The Customer is responsible for the security settings and choices within its control, such as whom it invites, the roles it gives Users, whether it requires two-step sign-in, the Third-Party Services it connects, and the security of the exports it downloads.

7. Subprocessors

General authorisation

The Customer gives us a general written authorisation to engage Subprocessors. The current list is on our Subprocessors page (Annex 3), and the Customer approves the Subprocessors listed there.

Notice of changes

At least 30 days before a new Subprocessor starts processing Customer Personal Information, we will tell the Customer by email to its Admins and update the Subprocessors page. Anyone at the Customer may ask to receive these notices by writing to [email protected].

Right to object

The Customer may object to a new Subprocessor, on reasonable grounds relating to data protection, by writing to us within the notice period. We will discuss the objection in good faith and, where we can, offer a reasonable alternative. If we cannot resolve the objection before the change takes effect, the Customer may end the Terms, or the affected part of the Services, by notice, and we will refund any fees it prepaid for the period after the end.

Obligations passed on

We will engage each Subprocessor under a written contract that requires it to protect Customer Personal Information in a way no less protective than this DPA, as appropriate to the service it provides, including by implementing appropriate technical and organisational measures.

Responsibility

We remain responsible to the Customer for the performance of each Subprocessor's obligations.

8. Data subject requests

The Services let the Customer find, export, correct and delete records itself. The Customer can use these tools to answer data subjects' requests to access, correct, delete, restrict, object to or move their information.

For a connected Shopify store, the Services also act on Shopify's privacy requests. A customer data request creates a task for the Customer to gather and send what it holds about that person. A customer redaction request removes that person's details from the store's orders, leads and customer record, except that a customer record a quality record relies on is kept, and a task tells the Customer which record and why.

If we receive a request from a data subject about Customer Personal Information, we will not answer it ourselves, except to tell the person that we have passed it on. We will forward it to the Customer promptly, if we can tell from the request which customer it concerns.

If the Customer needs more help, we will assist on request with appropriate technical and organisational measures, as far as possible, taking into account the nature of the processing and the information available to us.

9. Personal Data Breaches

We will notify the Customer of a Personal Data Breach without undue delay, and in any case within 72 hours after becoming aware of it. We will send the notice by email to the Customer's Admins, and to any privacy contact the Customer has given us.

The notice will include the information then available to us, including, as far as we know them:

the nature of the breach, including the categories and approximate number of data subjects and of records concerned;
its likely consequences;
the measures we have taken or propose to take to address it and to reduce its possible harm; and
a contact point for more information.

If we cannot give all of this information at once, we will give it in stages without further undue delay, and update the Customer as we learn more.

We will take reasonable steps to contain and investigate the breach and to reduce its harm, and we will give the Customer the help it reasonably needs to meet its own obligations to record and report the breach and to notify supervisory authorities and the people affected.

Unsuccessful attempts or activities that do not compromise the security of Customer Personal Information, such as failed sign-in attempts, network scans and blocked attacks, are not Personal Data Breaches. Notifying a Personal Data Breach is not an admission of fault or liability.

10. Impact assessments and consultations

Taking into account the nature of the processing and the information available to us, we will give the Customer reasonable help with data protection impact assessments and privacy impact assessments that Data Protection Laws require of it, including the assessment Quebec law requires before personal information is communicated outside Quebec, and with any prior consultation with a supervisory authority. This DPA, Annex 2 and our Subprocessors page are intended to give the Customer most of the information it needs.

11. Deletion or return at the end

Return. The Customer's Admins can export Customer Data, including Customer Personal Information, at any time while the Workspace is open.
Export window. After the Workspace closes, we keep Customer Data for 30 days so that the Customer can export it. During that time an Admin can ask us for a complete export, and we will provide it.
Deletion. After those 30 days, we delete Customer Data from the Services. Backups that contain it are overwritten within a further 15 days.
Copies the law requires. If the law requires us to keep any Customer Personal Information, we will keep it confidential and process it only for the purpose that requires us to keep it.
Confirmation. On written request, we will confirm in writing that the deletion is complete.

12. Information and audits

We will make available to the Customer the information reasonably needed to show that we meet our obligations under this DPA and Article 28 of the GDPR. In particular, we will:

answer reasonable security and privacy questionnaires; and
provide documentation of our security measures and processing, such as this DPA, the measures in Annex 2 and the Subprocessors page.

The Customer, or an independent auditor it appoints who is bound by confidentiality and is not our competitor, may audit our compliance with this DPA, including by inspection, if the information above is not enough to show our compliance, or if a supervisory authority or other regulator requires it. Such an audit:

may take place at most once in any 12-month period, unless a supervisory authority requires more;
needs at least 30 days' written notice, and a scope, timing and method agreed in advance;
takes place during normal business hours, without unreasonable disruption to our business, and without access to other customers' data;
is carried out under a duty of confidentiality; and
is at the Customer's cost.

Our Subprocessors' facilities are not ours to open for audit. For them, we will provide the audit reports and other information the Subprocessors make available to us.

13. International transfers

Where Customer Data is held

Customer Data is stored on servers in the hosting region listed on our Subprocessors page. Cloudflare, which provides security, content delivery and storage for uploaded files, email attachments and backups, operates a global network, so Customer Data may pass through or be held in other countries. Our Subprocessors page shows where each Subprocessor processes data. We are based in Ontario, Canada.

The Customer instructs us to transfer Customer Personal Information to these places to provide the Services. We will make any such transfer only in compliance with Data Protection Laws.

Transfers from the European Economic Area

Where Customer Personal Information subject to the GDPR is transferred to us, or onward from us, in a country that does not have an adequacy decision covering the transfer (such as the European Commission's decision for Canada, which covers organisations subject to PIPEDA), the Standard Contractual Clauses apply and are incorporated into this DPA by reference, as follows:

Modules. Module Two (controller to processor) applies where the Customer is a controller. Module Three (processor to processor) applies where the Customer is a processor.
Parties. The Customer is the data exporter and we are the data importer. Each party is treated as having signed the Standard Contractual Clauses when the Customer accepts the Terms.
Clause 7. The optional docking clause does not apply.
Clause 9. Option 2 (general written authorisation) applies, and the time period for notice of changes to Subprocessors is 30 days, as Section 7 of this DPA describes.
Clause 11. The optional language allowing data subjects to complain to an independent dispute resolution body does not apply.
Clause 13. The competent supervisory authority is the one determined under Clause 13(a).
Clause 17. The Standard Contractual Clauses are governed by the law of Ireland.
Clause 18. Disputes are resolved by the courts of Ireland.
Annex I. Part A: the data exporter is the Customer, with the contact details in its account, and the data importer is BurTech Solution, contact [email protected], acting as processor. Part B is Annex 1 of this DPA. Part C is the supervisory authority under Clause 13.
Annex II is Annex 2 of this DPA, and Annex III is our Subprocessors page (Annex 3 of this DPA).

Our obligations under Clauses 8.5 (deletion), 8.6 (security and breaches), 8.9 (documentation and audits) and 9 (Subprocessors) are carried out as Sections 11, 6 and 9, 12 and 7 of this DPA describe, to the extent this is consistent with the Standard Contractual Clauses. Where we transfer Customer Personal Information onward to a Subprocessor in a country without an adequacy decision covering the transfer, we will put in place an appropriate transfer mechanism, such as the Standard Contractual Clauses (Module Three).

Transfers from the United Kingdom

Where Customer Personal Information subject to the UK GDPR is transferred to a country without UK adequacy regulations covering the transfer, the UK Addendum applies and is incorporated by reference. In it: Table 1 is completed with the parties' details in Annex I of the Standard Contractual Clauses, as set out above; Table 2 refers to the Standard Contractual Clauses incorporated above, with the modules and options selected above; Table 3 is completed with Annexes 1, 2 and 3 of this DPA; and, for Table 4, the data importer may end the UK Addendum as its Section 19 allows.

Transfers from Switzerland

Where Customer Personal Information subject to the Swiss FADP is transferred to a country without an adequacy finding under Swiss law covering the transfer, the Standard Contractual Clauses apply as set out above, with these changes:

the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority for transfers governed by the Swiss FADP;
references to the GDPR are to be read as references to the Swiss FADP, for transfers governed by it; and
the term "Member State" in Clause 18(c) is not to be read so as to prevent data subjects in Switzerland from bringing claims where they habitually reside.

Canada

The Customer remains accountable for the Personal Information it transfers to us for processing. This DPA is the contractual means by which we provide a comparable level of protection while we process it, as principle 4.1.3 of Schedule 1 to PIPEDA contemplates.

For Customer Personal Information subject to Quebec's Act respecting the protection of personal information in the private sector, this DPA is the written agreement contemplated by section 17 of that Act, for communication outside Quebec, and the written contract contemplated by section 18.3, for services entrusted to us. In particular, we will:

take the measures in Section 6 and Annex 2 to protect the confidentiality of the information;
use the information only to provide the Services;
not keep the information after the Terms end, except as Section 11 describes;
notify the Customer's person in charge of the protection of personal information, without delay, of any violation or attempted violation of an obligation concerning the confidentiality of the information that we become aware of; and
allow that person to carry out verifications of these confidentiality requirements, as Section 12 describes.

Other countries

Where another Data Protection Law, such as the LGPD, requires a specific transfer mechanism, the parties will cooperate in good faith to put one in place.

14. US state privacy laws

For Customer Personal Information covered by US state privacy laws, we act as the Customer's service provider, contractor or processor. The Customer discloses Customer Personal Information to us only for the limited and specified business purposes of providing, supporting and securing the Services as the Terms describe (the "Business Purposes"). We will:

not sell or share Customer Personal Information, as those laws define "sell" and "share";
not retain, use or disclose it for any purpose, including any commercial purpose, other than the Business Purposes, except as those laws allow a service provider to do;
not retain, use or disclose it outside the direct business relationship between us and the Customer;
not combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with the individual, except as those laws allow;
comply with the obligations those laws place on us, and give Customer Personal Information the same level of privacy protection those laws require of the Customer; and
tell the Customer if we determine that we can no longer meet these obligations.

The Customer may take reasonable and appropriate steps to make sure we use Customer Personal Information consistently with its obligations under those laws, for example through Section 12, and, after giving us notice, to stop and remedy any unauthorised use.

The rest of this DPA, including its sections on instructions, confidentiality, Subprocessors, assistance, deletion and audits, provides the processor terms that other US state privacy laws require. We certify that we understand and will comply with the restrictions in this section.

15. Liability

Each party's liability arising out of or relating to this DPA, and to the Standard Contractual Clauses to the extent they allow, is subject to the limitations and exclusions of liability in the Terms. Nothing in this DPA limits either party's liability to data subjects under the Standard Contractual Clauses or where Data Protection Laws do not allow it to be limited.

Annex 1: Details of processing

Item	Details
Subject matter	Providing the Services to the Customer under the Terms: hosting and processing Customer Data in the Customer's Workspace.
Duration	For as long as the Terms are in force, then until the deletion described in Section 11 is complete (30 days after the Workspace closes, and up to 15 more days for backups).
Nature of the processing	Collecting (from Users and from Third-Party Services the Customer connects), recording, storing, organising, searching, displaying, synchronising with connected Third-Party Services, sending the messages and documents Users send, backing up, restoring, exporting and deleting. If the Customer turns on AI Features, sending the text a User asks about to the Customer's own AI provider.
Purpose	To provide the Services as the Terms and the Documentation describe and as the Customer and its Users instruct, and to support, maintain and secure them.
Categories of data subjects	The Customer's customers and their staff; its dealers and distributors; its suppliers; its prospects and leads; people who write to or call the Customer; the Customer's Users; and other people named in the Customer's correspondence and records.
Categories of personal data	Contact details (such as name, job title, company, email address, phone number and postal address); order, quote, invoice, shipment and return details; correspondence, including emails, attachments and internal notes; call logs, voicemail and call recordings; text messages; complaint, service and incident narratives; and the names of Users in records and audit logs.
Special categories of data	Possibly health information in complaint and incident narratives (for example, a description of an injury involving a product), only as the Customer chooses to record it. The safeguards in Annex 2 apply, including separation between Workspaces, roles and permissions, and the audit log.
Frequency of transfer	Continuous, for as long as the Customer uses the Services.
Retention	As Section 11 describes.
Transfers to Subprocessors	As listed on the Subprocessors page (Annex 3), for the subject matter, nature and duration described there and in this Annex.

Annex 2: Technical and organisational measures

Access control

Each User signs in with their own account. Passwords are stored only as salted Argon2id hashes.
Two-step sign-in with authenticator codes and recovery codes, which a company can require for all its Users. Two-step secrets are encrypted, and recovery codes are stored only as keyed hashes.
An account is locked for 15 minutes after 5 failed sign-in attempts.
Limits per network address on sign-in, password reset and public links.
Roles and permissions for each User, set by the Customer's Admins.
The platform operator console requires two-step sign-in, and shows companies, not their records.

Isolation

Each company's data is kept apart by PostgreSQL row-level security, plus checks in the application on every query.
The server is reached only through Cloudflare's encrypted tunnel, with no inbound ports open, behind Cloudflare's web application firewall.

Encryption

HTTPS for every connection to the website and the app, with HTTP Strict Transport Security (HSTS).
Credentials for connected services, two-step secrets and app passwords are encrypted with a key derived for each company (using HKDF) from a server secret held outside the database.

Availability and backups

Nightly backups of the whole database, stored in Cloudflare R2 for about 15 days.
Nightly snapshots of each company, kept for 14 days.
Documented restore procedures, which are tested.

Logging

An audit log of changes, recording who made each change and when.
Access logs never record keys or tokens in web addresses.
Server logs are kept in a fixed amount of space and overwritten as new entries arrive.

Personnel

Everyone who processes Customer Personal Information for us is bound by confidentiality (Section 5).
Access is given only to the extent a person's role needs it.
Our staff look at the content of a Workspace only as Section 6 of the Terms allows.

Development

Email received from outside is cleaned with an allow-list sanitiser before it is stored, and remote images load only when a User asks.
Spreadsheet (CSV) exports neutralise values that a spreadsheet program would run as formulas.
Forms carry anti-forgery tokens.
An automated test suite includes tests of the separation between companies and of row-level security.

Annex 3: Subprocessors

The current list of Subprocessors, with what each does and where it processes data, is on our Subprocessors page. That page forms Annex 3 of this DPA and is updated as Section 7 describes.