Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“you,” the customer) and Keepr, operated by 9433-7656 Québec inc. (“Keepr,” “we”). It applies whenever you connect a tool and Keepr processes personal information about your clients on your behalf (“Connected Data”). For that Connected Data, you are the controller and Keepr is your processor (sub-contractor). For your own account information, Keepr is the controller, as described in our Privacy Policy.

Keepr processes Connected Data only on your documented instructions: namely, to provide the Service as described in the Terms, the Privacy Policy, and your configuration of Keepr. We will not use Connected Data for any other purpose, and never to sell it or to train third-party or foundation AI models. If we believe an instruction violates applicable privacy law, we will tell you.

Anyone we authorize to process Connected Data is bound by a duty of confidentiality and may access it only as needed to provide the Service.

We maintain technical and organizational security measures appropriate to the risk, including encryption in transit, access controls and least-privilege access, reputable infrastructure, and logging. We review these measures as the Service evolves.

You authorize Keepr to engage sub-processors (for hosting and database, AI processing, email and SMS delivery, payments, and the platforms you connect) to help provide the Service. We bind each sub-processor by written contract to data-protection obligations no less protective than this DPA, and we remain responsible for their performance. A current list is available at privacy@keepr.now; we will give reasonable notice of any intended change so you can object.

Connected Data may be processed outside Québec and Canada, including in the United States and the European Union. Before relying on a provider outside Québec, we assess whether the information would receive adequate protection (considering its sensitivity, the purposes, the safeguards in place, and the destination’s legal framework) and we put appropriate contractual protections in place (such as standard contractual clauses).

If we become aware of a confidentiality incident affecting your Connected Data, we will notify you without undue delay, give you the information you reasonably need, take reasonable steps to reduce the risk of injury, and assist you with any notifications you must make to the Commission d’accès à l’information du Québec, other regulators, or affected individuals.

If one of your clients asks to access, correct, delete, port, or de-index their information, or to withdraw consent, we will provide reasonable assistance, including the tools or information you need, so you can respond within the timeframes the law requires.

When you disconnect a tool or close your account, or on termination of the Terms, we will delete or de-identify the relevant Connected Data within the period described in our Privacy Policy, except where law requires us to keep certain records longer. On request, we can return a copy first in a commonly used format.

On reasonable request, we will give you the information needed to demonstrate compliance with this DPA, and we will cooperate with a reasonable audit (which may be satisfied by up-to-date documentation or third-party reports) at a mutually agreed time and scope.

For matters of personal-information protection relating to Connected Data, this DPA prevails over any conflicting term in the Terms of Service. In all other respects the Terms continue to apply, including the limitations of liability. This DPA stays in force for as long as Keepr processes Connected Data on your behalf.

Questions about this DPA, or to make a request, contact our Privacy Officer at privacy@keepr.now, 9433-7656 Québec inc., 251-251 boul. Taschereau, Brossard (Québec) J4Z 1A7, Canada.