Data Processing Addendum

1. Definitions

• "Customer Personal Information" means personal information about the Customer's clients, prospective clients, dependants, representatives, and team members that the Customer or its users upload to, or collect through, the Service.
• "Privacy Laws" means the Personal Information Protection and Electronic Documents Act (PIPEDA) and any other Canadian privacy law that applies to the processing.
• "Subprocessor" means a third party that RCICMASTER engages to process Customer Personal Information.
• "Security Incident" means a breach of security safeguards that leads to unauthorized access to, or disclosure or loss of, Customer Personal Information in RCICMASTER's systems.

2. Roles

The Customer controls Customer Personal Information and decides why and how it is processed. RCICMASTER processes it as a service provider on the Customer's behalf. The Customer is responsible for complying with Privacy Laws and professional rules, for giving any required notices, and for obtaining all consents needed for RCICMASTER to process Customer Personal Information as described in the Terms and this DPA.

3. Processing instructions

RCICMASTER will process Customer Personal Information only to provide, secure, support, and improve the Service, as described in the Terms, the Privacy Policy, and this DPA, and according to the Customer's instructions given through the Service's settings and features. The Customer's configuration and use of the Service are its complete instructions. RCICMASTER may also process information where required by law, and will tell the Customer where the law allows.

4. Details of processing

• Subject matter: providing the RCICMASTER practice management Service.
• Duration: the term of the Customer's subscription plus the export and deletion period in section 10.
• Types of information: contact details, identity and travel documents, immigration history, education and employment history, family information, financial and payment records, questionnaire answers, case notes, communications, and meeting records.
• People concerned: the Customer's clients, prospective clients, dependants, representatives, and team members.
• Processing activities: storing, organising, displaying, transmitting, generating documents, sending notifications, and other actions the Customer takes in the Service.

5. Confidentiality

RCICMASTER will make sure that its personnel who can access Customer Personal Information are bound by confidentiality obligations and only access it when needed to provide the Service, support the Customer, or keep the Service secure.

6. Security measures

RCICMASTER will maintain reasonable safeguards appropriate to the sensitivity of the information, including:

• Encryption of data in transit using TLS.
• Hosting of primary application servers and databases in Canada.
• Role-based access controls, team permissions, and authentication controls.
• Logging and monitoring of access and activity.
• Regular backups and processes to restore availability.
• Limiting internal access to personnel who need it.

The Customer is responsible for the security measures within its control, including managing user accounts, team permissions, passwords, devices, and what information it chooses to upload.

7. Subprocessors

The Customer authorizes RCICMASTER to use Subprocessors to provide the Service. Current categories include cloud hosting and storage (Amazon Web Services), payment processing (Stripe), email delivery, sign-in and meeting providers (Google, Microsoft, Zoom), messaging providers (WhatsApp, Twilio), AI service providers for AI-assisted features, and error monitoring. RCICMASTER will require Subprocessors to protect Customer Personal Information with safeguards comparable to this DPA. Some Subprocessors may process information outside Canada. RCICMASTER may add or replace Subprocessors and will make an updated list available on request.

8. Security incidents

If RCICMASTER becomes aware of a Security Incident, it will notify the Customer without undue delay and provide the information reasonably available to help the Customer assess the incident and meet its own obligations, including any obligation to report to the Office of the Privacy Commissioner of Canada or to notify affected people. RCICMASTER will take reasonable steps to contain and investigate the incident. Notifying the Customer is not an admission of fault or liability.

9. Assistance with requests

The Service lets the Customer access, correct, export, and delete Customer Personal Information. If RCICMASTER receives a request directly from one of the Customer's clients, it will refer that person to the Customer. RCICMASTER will provide reasonable help with requests the Customer cannot handle through the Service; assistance beyond ordinary support may be charged at our then-current rates.

10. Return and deletion

During the subscription, the Customer can export and delete its information through the Service. After the subscription ends, the Customer may request an export within 30 days. After that period, RCICMASTER may delete Customer Personal Information from active systems, except where it must keep information by law. Backups are deleted on their normal schedule. The Customer is responsible for keeping any records it must retain under CICC or other rules.

11. Information and audits

On written request, no more than once every 12 months, RCICMASTER will provide reasonable written information about its security practices to help the Customer confirm compliance with this DPA. This information is confidential. On-site audits, penetration tests, or custom questionnaires require RCICMASTER's prior written agreement and may be subject to fees.

12. Liability

Each party's liability under or related to this DPA is subject to the exclusions and limitation of liability in the Terms. The Customer will indemnify RCICMASTER for claims arising from the Customer's failure to obtain required consents, give required notices, or otherwise comply with Privacy Laws or professional rules.

13. Term and changes

This DPA stays in effect for as long as RCICMASTER processes Customer Personal Information. RCICMASTER may update this DPA to reflect changes in law, Subprocessors, or the Service by posting a new version on this page. Continuing to use the Service after the update means the Customer accepts it. This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there.

Contact us

Questions about this document can be sent to RCICMASTER:

• Email: info@rcicmaster.ca
• Phone: +1 431 814 0549
• Mail: 145 Church Street, Unit 5, Toronto, Ontario, M5B 1Y4, Canada