Data processing addendum
Effective [to complete: effective]
This Data Processing Addendum (DPA) applies when an organization (the Customer) uses FullStacked Cloud to process personal information of its employees, users or clients, and becomes part of the FullStacked Cloud terms between the Customer and Les Services FullStacked (we).
1. Roles
The Customer decides why and how that personal information is processed and remains responsible for it toward the people concerned. We process it only on the Customer's documented instructions: to provide, secure and support the Service. We do not use it for our own purposes.
2. What is processed
Depending on how the Customer uses the Service: identity and contact details of users (including those received from the Customer's identity provider: user identifier, name, email, groups), content stored in projects and managed data, and the access and security records described in our privacy policy.
3. Confidentiality and security
People who can access the information are bound by confidentiality. We apply the security measures described in our privacy policy: encryption in transit, hashed access tokens, encrypted credentials, access control by permission, access to production limited to the people who operate the service. The Customer remains responsible for its own users, permissions, tokens and backups.
4. Sub-processors
The Customer authorizes the providers listed in our privacy policy (Clerk, Resend, Cloudflare). We will notify the Customer at least 30 days before adding or replacing one; the Customer can object for reasonable grounds and, if we cannot solve the issue, end the affected service.
5. Transfers outside Québec
Our servers are located in Québec, Canada. Some sub-processors operate outside Québec. We assess, before any transfer, that the information will receive adequate protection, and we bind those providers by contract.
6. Confidentiality incidents
We notify the Customer without undue delay after becoming aware of a confidentiality incident affecting its information, with what we know, and we help the Customer meet its obligations (including notifying the Commission d'accès à l'information and the people concerned when there is a risk of serious injury).
7. Assistance
We help the Customer answer requests from the people concerned (access, correction, deletion, portability) and, upon reasonable request, with privacy impact assessments, as far as the nature of the Service allows.
8. End of the service
When the Customer deletes its content or ends the Service, we delete the information within 30 days, except security records we must keep and information the law requires us to keep. The Customer can download its content before then.
9. Audits
We provide the information reasonably needed to demonstrate compliance with this DPA. On-site audits are subject to a reasonable written notice, confidentiality and cost agreement.
10. Order of precedence
For the processing of personal information, this DPA prevails over the FullStacked Cloud terms. The limitations of liability of those terms apply.
Signing
To sign this DPA for your organization, write to [email protected].