Data Processing Addendum

This Data Processing Addendum (the “DPA”) is between Zero Touch Integrations, operated by Chaley Consulting (“we”, “us”, “our”), and the customer named in the Customer Agreement (“you”, “your”). Words defined in the Customer Agreement have the same meaning here.

“Privacy laws” means the privacy and data protection laws that apply to the processing under this DPA. In Canada, these include the Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial private sector privacy laws that apply. In the United States, these include the state consumer privacy laws that apply, such as the California Consumer Privacy Act.

1. Scope and roles

• This DPA forms part of the Customer Agreement. It applies whenever we process personal data on your behalf.
• You are the controller (called the “business” under some US state privacy laws). We are the processor (called the “service provider” under some US state privacy laws).
• The personal data in scope is the records our integrations read from and write to your apps: for example names, email addresses, phone numbers, employee or driver identifiers, locations and the content of business records. Account data about your own users who sign in to our customer portal is covered by our privacy policy instead.
• We do not agree to process payment card data, health information or government issued identifiers (Customer Agreement section 9).

2. Instructions

• We process personal data only on your documented instructions. The SOW (its scope, acceptance criteria and examples) and this DPA are those instructions.
• We tell you if we believe an instruction breaks privacy laws or any other law, and we may refuse it.
• We do not sell or share personal data (as those terms are used in US state privacy laws), use it for our own purposes, or combine it with other customers’ data. It is never used to train AI models. We understand these restrictions and will comply with them.

3. Details of processing

Item	Position
Purpose	Moving and transforming records between your apps as the SOW describes; testing, trial runs, monitoring and repair of that integration
Duration	The term of the Customer Agreement, then deletion under section 9
Categories of data subjects	Your employees, contractors, customers and suppliers whose records are in the connected apps
Location	Main database in Canada; other stores as listed for each kind of data at www.zerotouchintegrations.com/security

4. Confidentiality and personnel

• Everyone who can access personal data is bound by confidentiality.
• Our operators’ access to your records is limited to what a task needs, requires a stated reason for sensitive views, and is recorded in an audit log.

5. Security

• We keep the technical and organizational measures described at www.zerotouchintegrations.com/security. They include encryption in transit and at rest, isolation of each customer, credentials held only by specialist secret stores, row level isolation in the database, an audit log that can only be added to, a kill switch that pauses writes, and recordings of exchanges with app vendors kept for 30 days.
• We may update these measures as long as the overall level of protection does not go down.

6. Subprocessors

• You authorize the subprocessors listed at www.zerotouchintegrations.com/legal/subprocessors, which is generated from our vendor register.
• We give at least 30 days’ notice by email before we add or replace a subprocessor that handles your personal data.
• You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may end the affected SOW, or the whole Customer Agreement, without penalty before the change takes effect.
• We put data protection terms on each subprocessor that are no less protective than this DPA, and we remain responsible for them.

7. Breach notification

• We notify you of a personal data breach affecting your data without undue delay, and no later than 72 hours after we confirm it.
• The notice says what happened, the data and people likely affected, what we have done to contain it, and who to contact. We add details as they become known.
• We help you meet your own notification duties, and we keep a record of every breach.
• Our internal incident procedure uses the same 72 hour clock.

8. Assistance

• Data subject requests: we help you answer requests for access, correction and deletion that concern data we hold, at no charge for reasonable volumes, within 30 days. If a person sends such a request to us directly, we forward it to you.
• Assessments: we give reasonable help with privacy impact assessments and with enquiries from regulators.

9. Return and deletion

• When the Customer Agreement ends, we delete your personal data under our offboarding process and the retention table at www.zerotouchintegrations.com/security: recordings at once, and other data about your organization 30 days after your account is closed.
• We keep only what the law requires (consent records, invoices and the audit log). These hold no record content.
• Data from trial runs (shadow trial rows) is deleted 90 days after go live.
• You may export your data before you close your account.

10. Audit

• Audit is by written security questionnaire, which we answer within 30 days, at most once a year unless a breach or a regulator requires more.
• We share summaries of independent assessments (for example a penetration test summary, and a SOC 2 report when one exists) under confidentiality.
• There are no on site audits.

11. Liability

• Liability under this DPA is subject to the limits in Customer Agreement section 8. This DPA has no separate cap.

12. Versions and acceptance record

• Each version of this DPA has a version number and a sha256 fingerprint of its text. The fingerprint is printed on the SOW and recorded in your acceptance record.
• Every past version stays published at /legal/dpa/v<n> on our website.
• New versions follow the change rule in Customer Agreement section 12: they apply at once to new SOWs, and to running customers 30 days after notice.