Data Processing Addendum (DPA)

This Addendum (the “DPA”) supplements the Terms of Service entered into between the Client identified in Annex I and Conformaze, operator of the Conformaze platform (“Conformaze”).

It governs Conformaze’s processing of personal information for which the Client is controller, in accordance with article 18.3 of Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and article 28 of the General Data Protection Regulation (GDPR).

Article 1 — Definitions

The terms “personal information”, “data subject”, “controller”, “processor”, “breach” have the meaning ascribed by Law 25 and the GDPR. “Sub-processor” means any third party engaged by Conformaze to perform a portion of the processing.

Article 2 — Scope, duration and purposes

Conformaze processes the Client’s personal information for the purposes of hosting, operating, supporting and logging the features described in the Terms and further detailed in Annex I, throughout the duration of the main contract.

Article 3 — Client instructions

Conformaze processes personal information only on the documented instructions of the Client, including for transfers outside Quebec or Canada. Conformaze promptly informs the Client if it considers that an instruction infringes Law 25 or the GDPR.

Article 4 — Confidentiality

Conformaze ensures that any person with access to personal information is bound by a written confidentiality undertaking and has received appropriate training.

Article 5 — Security measures

Conformaze implements the technical and organizational measures described in Annex II, proportionate to the sensitivity of the data.

Article 6 — Sub-processors

The Client authorizes the sub-processors listed in Annex III. Any change to that list is notified at least 30 days before its effective date. The Client may object on legitimate grounds; failing agreement, either party may terminate the main contract.

Article 7 — Data subject rights

Conformaze provides the Client with the features needed to respond to data subject requests within the legal deadlines. Conformaze promptly forwards to the Client any request it receives directly.

Article 8 — Incident notification

Conformaze notifies the Client without undue delay upon becoming aware of a confidentiality incident affecting its data, and no later than 48 hours, so that the Client can meet its CAI notification obligation within the 72-hour deadline.

Article 9 — Audit

The Client may, once per year and on reasonable notice, audit compliance with this DPA, either directly or through an independent third party. Conformaze may satisfy this obligation by providing audit reports or equivalent certifications.

Article 10 — Fate of data at the end of the contract

Upon expiration or termination of the main contract, Conformaze returns or destroys all of the Client’s personal information per the Client’s choice, within 30 days, subject to mandatory legal retention.

Article 11 — Governing law and jurisdiction

This DPA is governed by the laws in force in the Province of Quebec. Any dispute falls within the exclusive jurisdiction of the courts of the judicial district of Montreal.

Annex I — Parties and scope

Annex II — Security measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Multi-factor authentication (TOTP, email) for user accounts.
• Role-based access control (RBAC) with multi-tenant isolation (database-level RLS).
• Immutable audit logging signed by hash chain, scheduled integrity verification.
• Periodic PITR restore tests, documented business continuity plan.
• Continuous dependency audit and static application security testing (SAST).
• Regular backups retained per the retention policy.

Annex III — Authorized sub-processors

The list of authorized sub-processors is published and kept up to date on the Subprocessors page of the Conformaze website.