Data Processing Agreement

Effective date: [to be set at launch]

This Data Processing Agreement ("DPA") forms part of the My Company Whiteboard Terms of Service between IT Support 101 Inc. ("Provider") and the organisation that subscribes to My Company Whiteboard ("Customer"). It applies when Provider processes personal information contained in Customer Content on Customer's behalf. Words defined in the Terms of Service have the same meaning here.

1. Roles

Customer decides what personal information is placed in My Company Whiteboard and why. Provider processes that information only to provide the service to Customer. Customer is responsible for having a lawful basis, and any consent needed, for the personal information it and its users put into the service.

2. Processing on instructions

Provider will process Customer's personal information only:

• to provide, secure, support and back up the service as described in the Terms of Service;
• on Customer's other documented instructions, including those given through the service's settings; and
• where the law requires it, in which case Provider will tell Customer first unless the law forbids it.

Annex 1 describes the processing.

3. Confidentiality

Provider will make sure that anyone it authorises to process Customer's personal information is bound by a duty of confidentiality. Provider's staff will only access Customer Content when Customer's owner has granted support access, or where needed to keep the service secure or to meet a legal obligation.

4. Security

Provider will maintain the technical and organisational measures in Annex 2, appropriate to the risk. Provider may improve them over time but won't reduce the overall level of protection.

5. Sub-processors

Customer authorises Provider to use the sub-processors listed in Annex 3. Provider will:

• require each sub-processor, in writing, to protect the information to at least the standard in this DPA;
• remain responsible to Customer for its sub-processors' work; and
• give Customer at least 30 days' notice, by email to its owners, before adding or replacing a sub-processor. If Customer reasonably objects on data protection grounds, the parties will discuss it in good faith; if they can't resolve it, Customer may end its subscription and receive a refund of fees prepaid for the period after the change.

6. Where information is processed

Customer's personal information is stored and processed in the United States by the sub-processors in Annex 3. Customer acknowledges this transfer. Where Customer is subject to laws that need further transfer terms (for example in Quebec, the European Union or the United Kingdom), the parties will put those terms in place on request.

7. Helping Customer

Taking into account the nature of the processing, Provider will reasonably help Customer:

• respond to requests from individuals to access, correct or delete their personal information;
• meet its own security and breach notification obligations; and
• carry out any privacy impact assessment it is required to do.

If Provider receives such a request directly, it will pass it to Customer and won't respond itself except to say it has done so, unless the law requires otherwise.

8. Security breaches

If Provider becomes aware of a breach of security safeguards affecting Customer's personal information, it will tell Customer without undue delay, and where possible within 72 hours, with the information Customer reasonably needs to assess the breach and meet its obligations. Provider will take reasonable steps to contain the breach and limit harm.

9. Return and deletion

At Customer's request while its subscription is active, Provider will provide a copy of Customer Content in a commonly used format. After the subscription ends, Provider will delete Customer's personal information as described in the Terms of Service, and it will be removed from backups as they're replaced, within about 12 months, unless the law requires it to be kept.

10. Audits

Provider will make available, on request and no more than once a year (or after a breach), the information reasonably necessary to show it complies with this DPA, such as written answers to a security questionnaire. Any further audit will be agreed in advance, at Customer's cost, on reasonable notice and subject to confidentiality.

11. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms of Service. This DPA lasts as long as Provider processes Customer's personal information.

Annex 1: Description of processing

• Subject matter and duration: providing My Company Whiteboard for the length of Customer's subscription and any deletion period after it.
• Nature and purpose: storing, displaying, sharing between authorised users, scanning files for malware, backing up and deleting Customer Content.
• Kinds of personal information: whatever Customer and its users put on boards, which may include names, contact details, images and other information in drawings, notes, files and chat; plus users' names, email addresses and activity records.
• People concerned: Customer's members and guests, and anyone Customer includes in its content.
• Sensitive information: Customer should not upload sensitive personal information (such as health or financial account information) unless it has assessed that the service's safeguards are appropriate.

Annex 2: Security measures

• Encryption of all connections (TLS), with browsers required to use it.
• Each organisation's data separated, with access checked on every request.
• Optional authenticator app (two-factor) sign-in, which organisation owners can require; rate limits on sign-in attempts; secure, HTTP-only session cookies.
• Passwords stored hashed; authenticator secrets encrypted.
• Every uploaded file scanned for malware; images re-saved to remove hidden location data.
• Guests limited to named individuals on single boards, with optional expiry; confidential boards that block guest downloads and watermark the board.
• Audit log of significant actions.
• Nightly backups, encrypted before they leave the server, stored with a separate provider, with tested restores.
• Servers kept up to date, with a firewall, key-only administrator access and automatic blocking of repeated failed logins.
• Access to production systems limited to authorised IT Support 101 Inc. staff.

Annex 3: Sub-processors

• Contabo GmbH and its affiliates: hosting, St. Louis, Missouri, United States.
• Backblaze, Inc.: encrypted backup storage, United States.
• Microsoft Corporation: sending account emails (Microsoft 365).
• Stripe, Inc. and its affiliates: payment processing and subscription billing.
• Cloudflare, Inc.: bot protection on the sign-up and contact pages (Turnstile).

Contact

IT Support 101 Inc., 91 King Street East, Suite 135, Bowmanville, Ontario L1C 5E2, Canada. Privacy: privacy@itsupport101.com.