Overview
This Data Processing Addendum (“DPA”) forms part of the Master Services Agreement (“MSA”) when we process personal information on your behalf under an Order. It covers that processing; our own sales, billing, recruitment, and business relationship records are covered by our Privacy Policy.
1. Scope and Instructions
Client Personal Information means personal information we receive, access, or otherwise process on your behalf in providing the Services. Applicable Privacy Laws means the privacy and data protection laws that apply to that processing. Other capitalised terms have the meanings given in the MSA.
You determine the purposes of processing and provide the necessary authority, notices, consents, and lawful instructions. We process Client Personal Information as your service provider or processor, only to provide and secure the Services, follow your documented instructions, or comply with law. The Order, this DPA, and instructions from your authorised contacts through email or our project and support systems record those instructions, including any authorised transfers.
We will notify you if we believe an instruction infringes Applicable Privacy Laws and may suspend the affected processing while it is resolved. If law requires processing outside your instructions, we will notify you beforehand unless prohibited by law.
2. Information and Processing
The Order and related written instructions describe the actual Services and any special processing requirements. Depending on those Services:
- Activities: hosting, development, maintenance, support, migration, deployment, integrations, communications, testing, and backups.
- Information: contact details, account identifiers, membership or customer records, form submissions, uploaded files, transaction references, usage records, and support information.
- Individuals: your personnel, members, customers, registrants, donors, applicants, and website visitors.
- Duration: the service term and the return, deletion, and permitted retention periods in Section 9.
Provide only information needed for the Services. Identify sensitive or regulated information and any residency, security, or retention restrictions before providing it, so we can confirm suitable arrangements. We limit production personal information used in development and testing to what the work requires.
We do not sell Client Personal Information, use it for unrelated advertising or general-purpose model training, or combine client datasets for unrelated purposes. Any additional service-provider restrictions required by Applicable Privacy Laws apply to the relevant processing.
3. Confidentiality and Security
We use reasonable administrative, technical, and physical safeguards appropriate to the information, systems, and risks. These include access restrictions, confidentiality duties, secure credential handling, appropriate authentication and transmission protection, and incident response procedures.
Access is limited to authorised personnel and providers who need the information for the Services and are bound by confidentiality duties. Each party protects the accounts and systems within its control.
Maintenance, monitoring, backups, and restoration services follow the Order and SLA. We do not guarantee uninterrupted service, prevention of every security incident, or successful data recovery. The MSA’s backup responsibilities and liability limits apply.
4. Service Providers
You authorise us to use relevant providers to deliver the Services. A provider is a Subprocessor when we appoint it to process Client Personal Information on your behalf. We use written terms requiring appropriate protection and any equivalent processing obligations required by Applicable Privacy Laws. Our responsibility for delegated processing remains subject to Section 11.
Section 5 identifies our usual providers and purposes. We will provide relevant processing information on reasonable request. Where Applicable Privacy Laws or the Order require advance notice of a Subprocessor addition or replacement, we will notify affected clients and allow a reasonable opportunity to object on privacy or security grounds before the change. We will work to resolve a justified objection; any alternative scope or termination follows the Order and MSA. We will not proceed with processing that would be unlawful.
Providers you engage directly operate under your agreement with them. Their terms govern their services; this DPA governs our handling of Client Personal Information.
5. Provider Information
This shared list covers tools and services used for client work, our website, and our business operations. Only providers relevant to the work receive personal information. Processing on your behalf follows this DPA, including Section 6 for AI-assisted work; our own website and business use follows our Privacy Policy.
| Provider | Typical purpose |
|---|---|
| Adobe | Shared design assets and document workflows |
| Anthropic | AI-assisted work and website chat |
| Canadian Web Hosting | Server hosting for selected websites and systems |
| Cloudflare | Website delivery, DNS, security, and cookieless performance reporting |
| Customer.io | Contact profiles, email communications, and consented activity measurement |
| Figma | Design, prototyping, and review |
| GitHub | Code hosting, version control, and development collaboration |
| Google AI | AI-assisted work and website chat |
| Google Analytics | Website measurement |
| Google Cloud | Cloud hosting and application infrastructure |
| Google Tag Manager | Website tag management |
| Google Workspace | Email, calendars, documents, and file sharing |
| Markup.io | Website and design feedback |
| OpenAI | AI-assisted work and website chat |
| OpenAI Ads Measurement Pixel | Consented advertising attribution and conversion measurement |
| Pantheon | Website hosting, form records, files, and operational logs |
| Productive | Sales and client contacts, project records, communications, and billing coordination |
| Twilio SendGrid | Transactional email, including form notifications and account messages |
Client-appointed platforms, including translation services such as Weglot or WPML, are identified where relevant to the work.
6. AI-Assisted Work
We may use AI tools to assist with the Services. Where a tool will process Client Personal Information, the product, purpose, and relevant access must be covered by your documented instructions. We use appropriate business terms and settings that prevent that information being used for general-purpose model training. Any sensitive information requires suitable safeguards before use.
This applies to prompts and information retrieved through connected systems. Our public TwirlingGPT service is separate and does not authorise use of client information for client work. Alternative workflows or additional requirements may affect scope and fees under the Order.
7. Processing Locations
Providers may process information outside Canada, including through remote support. Canadian hosting alone does not mean all connected services process information in Canada. We will follow documented location restrictions and put any legally required transfer safeguards in place before the affected transfer. Tell us about special requirements before service begins.
8. Requests and Security Incidents
We will forward requests from individuals concerning Client Personal Information to you and provide reasonable assistance with access, correction, deletion, and other requests required by Applicable Privacy Laws. You determine the response for information under your control.
A Security Incident is a breach of safeguards resulting in unauthorised access, disclosure, alteration, loss, or destruction of Client Personal Information in our custody or control. We will notify you without undue delay after becoming aware of an incident, take reasonable containment and remediation steps, and provide available information and material updates to assist your assessment and reporting. Initial notice need not await a completed investigation and is not an admission of liability.
Taking account of the processing and information available to us, we will reasonably assist with required privacy assessments, regulatory enquiries, and breach notifications. Additional work outside the Services may be charged at rates disclosed in advance, except work needed to remedy our own breach. Each party is responsible for the reporting and other duties that apply to it by law.
9. Return and Deletion
When the Services end, we will return or delete Client Personal Information at your choice and delete remaining working copies, subject to legally permitted retention. We will confirm the available export and a reasonable completion period through the offboarding process. Additional migration or transition services are scoped separately.
Copies required by law may be retained for the required period. Where permitted by law, backup copies may remain until their normal replacement cycle, protected and unavailable for ordinary use. If restored for recovery, relevant deletion instructions will be reapplied before ordinary use where reasonably practical. Our own business records follow the Privacy Policy.
10. Compliance Information
On reasonable request, we will provide information needed to demonstrate compliance with this DPA, using existing documentation where suitable. We will allow and reasonably assist with audits and inspections where required by Applicable Privacy Laws or the Order. Reviews must use reasonable notice, confidentiality, and security arrangements that protect other clients’ information. Intrusive testing requires prior coordination.
Additional questionnaires, certifications, or assessments outside those requirements may be scoped and priced separately. These arrangements do not prevent legally required oversight.
11. Relationship to the MSA
The MSA governs commercial terms, remedies, and liability. Its Section 14 liability limits and exclusions apply to this DPA, including delegated processing, to the extent permitted by law. This DPA does not create a separate or additional liability allowance. Mandatory legal duties, rights, and liabilities remain applicable.
This DPA governs processing obligations where it conflicts with the MSA, subject to the MSA’s Clutch Guarantee provisions for matters covered by that guarantee. Updates do not automatically change an accepted Order; changes follow MSA Section 16.1. Protection of retained information and obligations intended to survive continue after the Services end.
For processing questions, contact your project contact or [email protected]. Formal notices follow the MSA.
