Data Processing Agreement

1. Background and scope

1.1 This Data Processing Agreement (“DPA”) forms part of, and is incorporated by reference into, the PaperVault Terms of Service (the “Agreement”) between Agilio IT Consulting Inc., a corporation incorporated under the Business Corporations Act (Ontario), operating the PaperVault platform under the “PaperVault” brand at papervault.ca (“PaperVault”), and the customer identified in the Agreement (“Customer”). Capitalized terms not defined in this DPA have the meanings given in the Agreement.

1.2 This DPA applies to the extent PaperVault Processes Personal Information contained in Customer Content on Customer's behalf in the course of providing the Service. It does not apply to Personal Information that PaperVault collects for its own purposes (such as Customer's account, billing, compliance-screening, and usage information), which PaperVault handles as described in its Privacy Policy.

1.3 In the event of conflict between this DPA and the Agreement with respect to the Processing of Personal Information, this DPA prevails. In the event of conflict between this DPA and a Legal Demand as defined in the Agreement, Section 10.5 of the Agreement governs.

2. Definitions

3. Roles and instructions

3.1 Roles. As between the parties, Customer is the organization with control of the Personal Information (and, where GDPR applies, the controller or a processor acting for another controller), and PaperVault Processes Personal Information on Customer's behalf as a service provider (and, where GDPR applies, as a processor).

3.2 Instructions. PaperVault will Process Personal Information only: (a) to provide, maintain, secure, and support the Service in accordance with the Agreement; (b) as documented in this DPA, including Annex A; (c) in accordance with Customer's use and configuration of the Service, which constitute Customer's instructions; and (d) as otherwise instructed in writing by Customer where such instructions are reasonable, technically feasible, and consistent with the Agreement. PaperVault will inform Customer if, in its opinion, an instruction would violate Applicable Privacy Laws, and may suspend the affected Processing until the instruction is confirmed or revised.

3.3 Exceptions. PaperVault may Process Personal Information other than on Customer's instructions where required by applicable law or a Legal Demand, in which case Section 10.5 of the Agreement applies, including its notification provisions.

3.4 Customer obligations. Customer is responsible for: (a) the accuracy, quality, and lawfulness of Personal Information and the means by which it was acquired; (b) establishing and maintaining a lawful basis, and providing all notices and obtaining all consents, required under Applicable Privacy Laws for PaperVault's Processing as contemplated by the Agreement, consistent with Section 5.3 of the Agreement — including, for clarity, the consents and notices required from Customer's own clients, end users, applicants, and screened subjects whose Personal Information Customer submits to the Service; (c) its own compliance obligations as the organization with control of the Personal Information, including responding to individuals and regulators; and (d) configuring and using the Service in a manner appropriate to the sensitivity of the Personal Information, including using available security features.

3.5 Service provider role. PaperVault provides tools that professional organizations — including law firms, accounting firms, immigration consultancies, and other regulated businesses — use to process and screen information concerning their own clients and other individuals. All Processing of such Personal Information is initiated by Customer through its use of the Service and constitutes Customer's instruction. PaperVault does not determine the purposes of that Processing, does not use the Personal Information for its own purposes, and has no direct relationship with the individuals concerned. As between the parties, responsibility for the individuals — including consent, transparency, accuracy, responses to their requests, and the lawfulness of any screening decision or outcome — rests with Customer, except for obligations imposed on PaperVault directly by Applicable Privacy Laws in its role as a service provider.

4. Confidentiality of processing

PaperVault will ensure that all personnel authorized to Process Personal Information are bound by written or statutory obligations of confidentiality, receive appropriate privacy and security training, and Process Personal Information only as needed to perform their roles. As described in Section 10.3 of the Agreement, PaperVault personnel cannot read the contents of Customer's documents in the ordinary course; decryption keys are held exclusively by a limited number of designated executive officers of Agilio and are used only in the circumstances described in Section 10.3(c) of the Agreement, and each decryption event is documented.

5. Security measures

5.1 PaperVault will implement and maintain appropriate administrative, technical, and physical safeguards designed to protect Personal Information against Security Incidents, appropriate to the sensitivity of the information, as required by PIPEDA Principle 7 (Safeguards) and other Applicable Privacy Laws. PaperVault's current measures are described in Annex B. PaperVault may update its measures from time to time, provided the updates do not materially reduce the overall protection of Personal Information.

5.2 Customer acknowledges that the security features of the Service available to Customer (including multi-factor authentication, passkeys, SSO, magic-link sign-in, and access controls) form part of the parties' shared security model, and that Customer is responsible for its configuration choices and credential security as set out in Section 3.2 of the Agreement.

6. Subprocessors

6.1 General authorization. Customer authorizes PaperVault to engage Subprocessors to support the provision of the Service. PaperVault's current Subprocessors are listed on our Subprocessors page (the “Subprocessor List”), which forms Annex C to this DPA.

6.2 Requirements. PaperVault will: (a) enter into a written agreement with each Subprocessor imposing data protection obligations materially no less protective than those in this DPA, to the extent applicable to the services provided; (b) restrict each Subprocessor's Processing to what is necessary to provide its services; and (c) remain responsible to Customer for each Subprocessor's performance of PaperVault's obligations under this DPA.

6.3 Changes; objection. PaperVault will provide notice of any new Subprocessor (by updating the Subprocessor List and, for customers subscribed to notifications, by email) at least thirty (30) days before the new Subprocessor Processes Personal Information. Customer may object on reasonable data protection grounds within that period by written notice to legal@agilio.ca. The parties will discuss the objection in good faith; if PaperVault cannot reasonably accommodate it, Customer may, as its sole remedy, terminate the affected subscription on notice and receive a pro-rata refund of prepaid, unused fees.

6.4 AI subprocessors. Subprocessors used to deliver AI Features are identified as such in the Subprocessor List. Consistent with Section 6.2 of the Agreement, PaperVault contractually requires such Subprocessors not to use Personal Information or Customer Content to train, fine-tune, or improve any AI or machine-learning models, and to limit retention to what is necessary to deliver the requested functionality.

7. Assistance with individual rights

7.1 Taking into account the nature of the Processing, PaperVault will provide reasonable assistance to Customer, through the functionality of the Service and, where necessary, additional reasonable measures, to enable Customer to respond to requests from individuals exercising rights under Applicable Privacy Laws, including access, correction, deletion, and, where applicable under Law 25 or GDPR, data portability and cessation of dissemination.

7.2 If PaperVault receives a request directly from an individual relating to Personal Information Processed under this DPA, PaperVault will not respond substantively (except to direct the individual to Customer, or as required by law) and will promptly notify Customer of the request where lawful.

8. Security incident notification

8.1 Notification. PaperVault will notify Customer without undue delay, and in any event within seventy-two (72) hours, after confirming a Security Incident affecting Customer's Personal Information. Notification will be made to the email address associated with Customer's account (or a security contact designated by Customer) and will describe, to the extent known: the nature of the incident; the categories and approximate volume of Personal Information and individuals concerned; the likely consequences; the measures taken or proposed to address the incident and mitigate harm; and a contact point.

8.2 Cooperation. PaperVault will investigate the Security Incident, take reasonable steps to contain and remediate it, and provide Customer with timely updates and reasonable cooperation to support Customer's own obligations under Applicable Privacy Laws, including Customer's assessment of whether the incident creates a real risk of significant harm requiring reporting to the Privacy Commissioner of Canada and notification to affected individuals under PIPEDA, or equivalent obligations under other Applicable Privacy Laws. As between the parties, Customer is responsible for regulator and individual notifications relating to Customer's Personal Information, and PaperVault is responsible for its own record-keeping and any reporting obligations imposed on it directly.

8.3 No fault. PaperVault's notification of, or response to, a Security Incident is not an acknowledgement of fault or liability.

9. Data location and cross-border transfers

9.1 Primary location. PaperVault's primary compute, database, and object storage are hosted with DigitalOcean in its Toronto, Ontario, Canada data centre (region TOR1). All Customer Content persisted at rest — documents, case records, and databases — remains in Canada.

9.2 Processing outside Canada. Certain functions of the Service transmit specific categories of data outside Canada, as identified in the Subprocessor List (Annex C): (a) AI Features transmit document content and related case data to PaperVault's AI service provider in the United States for processing; (b) transactional email content and recipient addresses are transmitted to PaperVault's email delivery provider in the United States; (c) operational telemetry and error diagnostics are transmitted to PaperVault's monitoring provider in the United States; (d) data in transit traverses PaperVault's content delivery network at global edge locations, including Canadian points of presence, where TLS termination occurs; and (e) where Customer uses compliance-screening features, screened-subject names and identifiers are transmitted to the screening data sources and public registries identified in Annex C, located in the European Union, United Kingdom, United States, and Switzerland. Customers requiring strictly Canadian-only Processing should contact PaperVault before enabling these features; such a configuration requires disabling AI Features, email notifications, and compliance screening, and PaperVault does not represent that the Service as fully featured can be delivered on a Canada-only basis.

9.3 Comparable protection. For any Processing of Personal Information outside Canada, PaperVault will: (a) ensure the transfer is subject to a written agreement providing a comparable level of protection to that required by this DPA and Applicable Privacy Laws, consistent with PIPEDA's accountability principle; (b) where Law 25 applies to Customer's Personal Information, provide information reasonably necessary for Customer's assessment of the transfer; and (c) where GDPR applies, implement a valid transfer mechanism (including standard contractual clauses) as required.

9.4 Foreign access. Customer acknowledges that Personal Information Processed in a foreign jurisdiction may be subject to lawful access by courts, law enforcement, and national security authorities of that jurisdiction.

10. Audits and information

10.1 PaperVault will, upon Customer's reasonable written request (no more than once per twelve (12) month period, absent a Security Incident or regulator requirement), make available information reasonably necessary to demonstrate compliance with this DPA, which may include responses to security questionnaires, summaries of PaperVault's security practices, and, when available, third-party audit reports or certifications.

10.2 If the information provided under Section 10.1 is not reasonably sufficient, Customer (or an independent auditor on its behalf that is not a competitor of PaperVault and is bound by confidentiality) may conduct an audit of PaperVault's relevant controls, subject to: at least thirty (30) days' notice; agreement on scope, timing, and duration; performance during business hours without disruption to PaperVault's operations or other customers; no access to other customers' data or to PaperVault's source code; and Customer bearing its own costs and reimbursing PaperVault's reasonable costs of support. Findings are PaperVault's Confidential Information.

11. Retention, return, and deletion

11.1 PaperVault will retain Personal Information only for as long as necessary to provide the Service and as permitted by the Agreement. Export and deletion upon expiry or termination are governed by Section 12.5 of the Agreement: Customer may export Customer Content for thirty (30) days following termination (subject to the exceptions stated there), after which PaperVault will delete Customer Content, including Personal Information, within ninety (90) days, except as retained in routine backups (which are overwritten in the ordinary course) or as retention is required by applicable law or a preservation demand under Section 10.5 of the Agreement.

11.2 Deletion is performed so that Personal Information is rendered inaccessible and irrecoverable in active systems, with backup copies expiring in accordance with PaperVault's backup rotation schedule described in Annex B.

12. Liability, term, and general

12.1 Liability. The liability of each party under or in connection with this DPA is subject to the exclusions and limitations of liability in the Agreement, and liability under this DPA and the Agreement is aggregated, not additive.

12.2 Term. This DPA takes effect upon Customer's acceptance of the Agreement and remains in force for as long as PaperVault Processes Personal Information under it, including any post-termination retention period.

12.3 Updates. PaperVault may update this DPA in accordance with Section 18.1 of the Agreement, provided updates do not materially reduce the protection of Personal Information.

12.4 Governing law. This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, and is subject to the dispute resolution provisions of the Agreement.

Annex A — Details of processing

Annex B — Security measures

• Encryption of Customer Content in transit (TLS 1.2+) and at rest using industry-standard encryption.
• Decryption keys for Customer Content held exclusively by a limited number of designated executive officers, with documented use restricted to the circumstances in Section 10.3(c) of the Agreement.
• Access controls on a least-privilege, need-to-know basis, with logging of access to production systems; personnel cannot read Customer document contents in the ordinary course.
• Authentication options for Customer accounts: multi-factor authentication, passkeys, single sign-on (SSO), and magic-link sign-in.
• Network and application security controls, including segregation of environments, vulnerability management, and secure development practices.
• Backups performed on a defined schedule with encrypted storage.
• Personnel confidentiality obligations and privacy/security training.
• Subprocessor due diligence and contractual flow-down of data protection obligations.
• Incident response procedures, including detection, containment, investigation, and the notification commitments in Section 8.
• Business continuity and disaster recovery procedures reviewed periodically.

Annex C — Subprocessor list

The current Subprocessor List is published on our Subprocessors page. As of the effective date it comprises the following. Legal entity names and cross-border transfer mechanisms are subject to confirmation against executed agreements.

C.1 Active subprocessors

Engaged in the ordinary operation of the Service:

C.2 Feature-dependent subprocessors

Engaged only where Customer enables the corresponding feature:

C.3 Public data sources

Where Customer uses compliance-screening features, screened-subject names are also submitted as queries to public registries and data sources that are not contracted Subprocessors but are disclosed for transparency, currently: GLEIF (Global Legal Entity Identifier Foundation, Switzerland — legal entity identifier lookups) and The GDELT Project (United States — global news index for adverse-media screening). These sources receive only the queried names and identifiers, and their handling of queries is governed by their own published terms.

C.4 Payment processing

Payment processors (currently Helcim Inc., Calgary, Canada) act as independent organizations, not Subprocessors, in respect of payment card data. Card data is captured directly by the processor's hosted payment interface and does not transit or reside on PaperVault systems. Payment processing is described in the Privacy Policy.

C.5 Excluded

Vendors that do not Process Personal Information contained in Customer Content — including source-code hosting and CI/CD tooling — are not Subprocessors and are not listed. Screening data sources for which integration exists in code but which are not commercially engaged (including commercial risk-intelligence and credit-bureau providers) are not Subprocessors unless and until activated, in which case the notice process in Section 6.3 applies.