Data Processing Agreement

1.Definitions

1.1. The following definitions apply in this DPA:

“Broker” means the organization that has entered into the Principal Agreement which incorporates this DPA by reference.

“Business Purpose” means the services described in the Principal Agreement.

“Data Subject” means an individual who is the subject of Personal Information.

“Party” means the Broker or the Provider, as applicable, and “Parties” means the Broker, collectively with the Provider.

“Principal Agreement” means the Broker Onboarding Agreement, the SaaS Subscription Agreement or the Order Form, as applicable, that has been entered into between the Parties.

“Personal Information” means any information the Provider collects, uses, processes or maintains for the Broker that is about or relates to an identifiable individual or identifies or can be used to identify that individual, directly or indirectly, either alone or in combination with other information.

“Processing,” “processes,” or “process” means any activity that involves the use of Personal Information or that the relevant Privacy and Data Protection Laws may otherwise include in the definition of processing, processes, or process. It includes collecting, using, disclosing, or carrying out any operation or set of operations on Personal Information.

“Provider” means Automata Intelligence Inc. (operating as Autowrite).

“Privacy and Data Protection Laws” means all applicable federal, provincial, and foreign laws and regulations relating to the processing, protection, or privacy of Personal Information, as each may be amended or replaced from time to time.

“Security Breach” means any act or omission that materially compromises the security, confidentiality, or integrity of Personal Information or the physical, technical, administrative, or organizational safeguards put in place to protect it.

1.2. This DPA forms part of and is incorporated into the Principal Agreement. In the case of conflict or ambiguity between any of the provisions of this DPA and the provisions of the Principal Agreement, the provisions of this DPA will prevail.

2.Broker Responsibilities

2.1. The Broker remains at all times accountable for and in control of the Personal Information, and responsible for its compliance obligations under the applicable Privacy and Data Protection Laws, providing any required notices and obtaining any required consents, and for the processing instructions it gives to the Provider.

2.2. The Broker represents and warrants that the Provider’s expected use of the Personal Information for the Business Purpose and as specifically instructed by the Broker under this DPA will comply with all Privacy and Data Protection Laws.

3.Provider Obligations

3.1. The Provider will only process Personal Information to the extent, and in such a manner, as is necessary for the Business Purposes. The Provider will not process the Personal Information in a way that does not comply with this DPA, the Broker’s instructions, or the Privacy and Data Protection Laws.

3.2. The Provider will promptly comply with any Broker request or instruction requiring the Provider to amend, transfer, or delete Personal Information, or to stop, mitigate or remedy any unauthorized processing.

3.3. The Provider will maintain the confidentiality of all Personal Information and will not disclose Personal Information to third parties unless the Broker or this DPA specifically authorizes such disclosure in compliance with Privacy and Data Protection Laws, or as otherwise required by applicable law. If a law requires the Provider to process or disclose Personal Information, the Provider will first notify the Broker of the legal requirement and give the Broker an opportunity to object or challenge the requirement at the Broker’s sole cost and expense, unless applicable law prohibits such notice.

3.4. The Provider will reasonably assist the Broker with meeting the Broker’s compliance obligations under the Privacy and Data Protection Laws, considering the nature of the Provider’s processing and the information available to the Provider. The Broker acknowledges that the Provider is under no duty to investigate the completeness, accuracy, or sufficiency of any specific Broker instructions or the Personal Information other than as required under the Privacy and Data Protection Laws.

3.5. The Provider will limit Personal Information access to those employees who require it to meet the Provider’s obligations under this DPA and the Principal Agreement.

3.6. The Provider will implement and maintain appropriate technical and organizational measures designed to safeguard Personal Information against unauthorized or unlawful processing, access, copying, modification, storage, reproduction, display, or distribution, and against accidental loss, destruction or damage.

3.7. The Provider will promptly notify the Broker if it becomes aware of any Security Breach and will take steps to contain and mitigate the Security Breach. The Provider will reasonably cooperate with the Broker in the Broker’s handling of the matter, including making available all relevant information to the extent required to comply with all Privacy and Data Protection Laws. The Provider will not inform any third party of any Security Breach without first obtaining the Broker’s prior written consent, except when Privacy and Data Protection Laws, or other applicable laws or regulations, require it. The Provider agrees that the Broker has the sole right, to the extent permitted by applicable laws, to determine whether to provide notice of the Security Breach to any Data Subjects, regulators, law enforcement agencies or any other third parties, as required by Privacy and Data Protection Laws.

4.Cross-Border Transfers

The Broker acknowledges and agrees that the Provider may process the Personal Information on a global basis as necessary for the Business Purpose, and in particular that Personal Information may be transferred to and processed by Provider in Canada, the United States and other jurisdictions where Provider affiliates and subprocessors have operations. Wherever the Personal Information is transferred outside its jurisdiction of origin, each Party will ensure such transfers are made in compliance with the requirements of applicable Privacy and Data Protection Laws.

5.Subprocessors

5.1. The Broker agrees that the Provider may engage subprocessors to process Personal Information on the Broker’s behalf, provided the Provider enters into a written contract with the subprocessor that imposes data protection terms that require the subprocessor to protect the Personal Information to the standard required by applicable Privacy and Data Protection Laws. The Provider will provide a list of current subprocessors to the Broker upon reasonable prior written notice.

6.Complaints, Data Subject Requests and Third Party Rights

6.1. The Provider will promptly notify the Broker if it receives any complaint, notice, or communication that directly or indirectly relates to the Personal Information processing or to either Party’s compliance with the Privacy and Data Protection Laws.

6.2. The Provider will promptly notify the Broker if it receives a request from a Data Subject for access to their Personal Information or a request to correct, delete, or withdraw its consent from any use by the Broker or the Provider of same.

6.3. The Provider will reasonably cooperate with the Broker in responding to any complaint, notice, communication, or Data Subject request.

6.4. The Provider will not directly disclose the Personal Information to any Data Subject or to a third party unless the disclosure is required by applicable law.

7.Term and Termination

7.1. This DPA will remain in full force and effect until the expiry or termination of the Principal Agreement (the “Term”).

7.2. If a change in any Privacy and Data Protection Law prevents either Party from fulfilling all or part of its Principal Agreement obligations, the Parties will suspend the processing of Personal Information until that processing complies with the new requirements. If the Parties are unable to bring the Personal Information processing into compliance with the applicable Privacy and Data Protection Law by making commercially reasonable efforts, either Party may terminate the Principal Agreement upon written notice to the other Party, without prejudice to any fees incurred by the Broker prior to suspension or termination.

8.Data Return and Destruction

8.1. On termination of the Principal Agreement for any reason or expiration of its term, the Provider will securely destroy or, if directed in writing by the Broker, return and not retain, all or any Personal Information related to this DPA in its possession or control, unless applicable law permits or requires retention by Provider.

8.2. If any law, regulation, or government or regulatory body requires the Provider to retain any documents or materials that the Provider would otherwise be required to return or destroy, to the extent permitted by applicable law the Provider will notify the Broker in writing of that retention requirement and, to the extent determinable, when the retention requirement ends.

8.3. The Provider will certify in writing that it has destroyed the Personal Information upon the Broker’s written request.

9.Audit

The Provider will permit the Broker and its third-party representatives to audit the Provider’s compliance with its DPA obligations, upon reasonable prior written notice. The Provider will give the Broker and its third-party representatives access to such information as needed to conduct such audits in compliance with Privacy and Data Protection Laws. To the extent physical access to Provider’s records or premises is required to conduct such audits in compliance with Privacy and Data Protection Laws, (i) such access will only be provided during regular business hours and will be limited strictly to such records or premises as required to comply with Privacy and Data Protection Laws; and (ii) the Broker and its third-party representatives agree to be accompanied by the Provider’s representatives at all times and each shall execute confidentiality agreements as required by the Provider. Under no circumstances will the Broker be provided with access to information concerning, or the records or data of, other customers of the Provider.

10.Limitation of Liability

The limitations of liability set forth in the Principal Agreement will apply to this DPA.