Data Processing Addendum (overview)

This page summarizes how CertiTrack processes Customer personal information. A signed DPA is available for enterprise customers on request at legal@espyads.net or security@espyads.net.

1. Roles

• Customer determines the purposes and means of processing employee, broker, and related compliance data uploaded to the tenant.
• Provider (EspyAds / CertiTrack) processes that data on Customer’s documented instructions to provide the Service.

2. Nature and purpose of processing

Hosting, storage, retrieval, display, backup, security monitoring, support, and features Customer enables (OCR, email ingestion, exports, integrations). Categories of data subjects typically include Customer’s staff, contractors, and licensed individuals whose records Customer manages.

3. Instructions and confidentiality

We process Customer personal information only to provide the Service, as configured by Customer, or as required by law. Personnel with access are bound by confidentiality obligations.

4. Security

Measures include access control, encryption in transit, Canadian primary hosting, logging, and MFA options. See Security Policy.

5. Subprocessors

We use subprocessors listed at /subprocessors. Material changes will be communicated as described in the signed DPA.

6. International transfers

Primary production data resides in Canada. Where a subprocessor processes outside Canada, contractual and technical safeguards are applied consistent with Canadian privacy expectations.

7. Assistance with individual requests

Customer remains responsible for responding to individuals. We will reasonably assist Customer with access, correction, or deletion requests related to data in the Service, subject to technical feasibility and fees if extraordinary.

8. Breach notification

We will notify Customer without undue delay after becoming aware of a personal information breach affecting Customer Data, and provide information reasonably available to help Customer meet its notification duties under PIPEDA, Law 25, or other applicable law.

9. Return and deletion

Upon termination, Customer may export available data during the window described in the order form or product documentation. Thereafter we delete or de-identify Customer Data from active systems within a commercially reasonable period, subject to legal retention holds and backup cycles.

10. Audit

Enterprise customers may request security documentation or questionnaires under NDA. On-site audits, if agreed, are limited to once per year and scheduled to avoid disruption.