Data Processing Agreement

1. Definitions

For purposes of this DPA:

• "Personal Data" means any information relating to an identified or identifiable individual that is processed by RegistryZen on behalf of Customer in connection with the Services.
• "Processing" means any operation performed on Personal Data, including collection, use, storage, disclosure, and deletion.
• "Data Subject" means the individual to whom Personal Data relates.
• "Sub-processor" means any third party engaged by RegistryZen to process Personal Data on behalf of Customer.
• "Security Incident" means any unauthorized access, acquisition, use, or disclosure of Personal Data.
• "Applicable Data Protection Laws" means PIPEDA and any other applicable Canadian federal or provincial privacy legislation.

2. Scope and Roles

2.1 Roles. For the purposes of this DPA, Customer is the Controller and RegistryZen is the Processor of Personal Data. Customer determines the purposes and means of Processing, while RegistryZen processes Personal Data only on Customer's documented instructions.

2.2 Scope. This DPA applies only where Customer has executed an Order Form or other agreement that expressly incorporates this DPA by reference. When applicable, this DPA governs the Processing of Personal Data by RegistryZen in connection with providing registry search, filing, and due diligence services to Customer.

2.3 Categories of Data. Personal Data processed may include:

• Names of individuals (debtors, secured parties, directors, officers)
• Business contact information
• Addresses
• Government-issued identification numbers (as required for registry searches)
• Corporate registration information

3. Processing Instructions

3.1 Customer Instructions. RegistryZen shall process Personal Data only in accordance with Customer's documented instructions, unless required to do otherwise by Applicable Data Protection Laws. Customer instructs RegistryZen to process Personal Data to provide the Services described in the Terms of Service.

3.2 Compliance with Laws. RegistryZen shall comply with Applicable Data Protection Laws in its Processing of Personal Data. RegistryZen shall promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.

3.3 Confidentiality. RegistryZen shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Sub-processors

4.1 Authorization. Customer authorizes RegistryZen to engage Sub-processors to process Personal Data on Customer's behalf. RegistryZen maintains a list of current Sub-processors available upon request.

4.2 Sub-processor Categories. RegistryZen uses the following categories of Sub-processors:

• Cloud infrastructure providers (data hosting and storage)
• Payment processors
• Customer support tools
• Analytics services
• Email delivery services

4.3 Sub-processor Obligations. RegistryZen shall enter into written agreements with Sub-processors imposing data protection obligations substantially similar to those in this DPA.

4.4 New Sub-processors. RegistryZen shall notify Customer of any new Sub-processors at least 30 days before the Sub-processor begins Processing Personal Data. Customer may object to a new Sub-processor by notifying RegistryZen within 14 days of receiving notice.

5. Security Measures

5.1 Security Program. RegistryZen shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, or damage.

5.2 Security Controls. Such measures include:

• Encryption of Personal Data in transit (TLS 1.3) and at rest (AES-256)
• Access controls and authentication mechanisms
• Regular security testing and vulnerability assessments
• Secure development practices
• Employee security awareness training
• Incident response procedures
• Business continuity and disaster recovery capabilities

5.3 Data Location. Personal Data shall be stored and processed in Canada unless Customer provides explicit written authorization for processing in other jurisdictions.

6. Data Subject Rights

6.1 Assistance. RegistryZen shall assist Customer in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws, including rights of access, rectification, erasure, and data portability.

6.2 Notification. RegistryZen shall promptly notify Customer if it receives a request from a Data Subject directly, unless prohibited by law from doing so.

7. Security Incident Notification

7.1 Notification. RegistryZen shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Personal Data.

7.2 Incident Details. Such notification shall include, to the extent known:

• Description of the nature of the Security Incident
• Categories and approximate number of Data Subjects affected
• Categories and approximate number of Personal Data records affected
• Likely consequences of the Security Incident
• Measures taken or proposed to address the Security Incident

7.3 Cooperation. RegistryZen shall cooperate with Customer in investigating and remediating Security Incidents and shall provide reasonable assistance in Customer's communications with regulators and affected Data Subjects.

8. Audit Rights

8.1 Information. RegistryZen shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA.

8.2 Audits. Upon reasonable notice and no more than once per year (unless required by a regulatory authority), Customer may audit RegistryZen's compliance with this DPA, subject to appropriate confidentiality obligations. Customer shall bear its own costs of any audit.

8.3 Third-Party Reports. RegistryZen may satisfy audit requests by providing relevant third-party audit reports or certifications.

9. Data Return and Deletion

9.1 Upon Termination. Upon termination of the Services, RegistryZen shall, at Customer's election:

• Return all Personal Data to Customer in a commonly used format; and/or
• Delete all Personal Data, unless retention is required by Applicable Data Protection Laws

9.2 Certification. Upon request, RegistryZen shall provide written certification of the deletion of Personal Data.

9.3 Retention. Where RegistryZen is required by law to retain Personal Data, it shall inform Customer of such requirement and limit Processing to that required by law.

10. Liability

10.1 Limitations. Each party's liability under this DPA is subject to the limitations of liability set forth in the Terms of Service.

10.2 Customer Responsibility. Customer is responsible for the lawfulness of its Processing instructions and for ensuring it has appropriate legal basis and consents for the Processing of Personal Data.

11. Term and Termination

11.1 Term. This DPA shall remain in effect for the duration of the underlying Order Form or agreement that incorporates it, and for as long as RegistryZen processes Personal Data on behalf of Customer thereafter.

11.2 Survival. Provisions that by their nature should survive termination shall survive, including data deletion obligations, confidentiality, and liability provisions.

12. Governing Law

This DPA shall be governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of law principles.

13. Contact

For questions about this DPA or to request a signed copy for your records, please contact:

RegistryZen Inc.
Attention: Privacy Officer
Email: [email protected]