Data processing agreement

Purpose and roles

This agreement forms part of the terms of use. The organization is responsible for the personal information of its staff, volunteers, members, donors and applicants ("the data"). Michoozon Inc. acts as a service provider (processor): it processes the data on the organization's behalf and according to its instructions, within the meaning of section 18.3 of Québec's Act respecting the protection of personal information in the private sector and of PIPEDA's accountability principle.

Instructions

• The organization's instructions are this agreement, its settings in the application and the actions of its authorized users.
• We use the data for no other purpose: no advertising, no sale, no training of artificial intelligence models.
• If an instruction seems unlawful to us, we tell the organization.

Data and people concerned

• People: employees, volunteers, board and organization members, applicants, donors, people reimbursed without an account.
• Data: identity and contact details, employment and pay, SIN and bank accounts (payroll), leave and time, training, documents, messages, donations, and whatever the organization chooses to add.
• Sensitive information: the organization avoids entering medical diagnoses; Samwell asks for accommodation needs, never diagnoses.

Security measures

• Database, files and authentication hosted in Canada (ca-central-1 region); encryption in transit and at rest.
• Each organization isolated by access rules in the database; role-based permissions; nobody manages their own file.
• SIN and bank accounts encrypted with a key kept in a vault; every read is logged.
• Two-step verification for all users; tamper-proof audit log.
• Michoozon Inc. staff: need-to-know access, confidentiality undertaking.

Sub-processors

The organization authorizes the service providers on the published list (see "Service providers"). We bind them in writing to protection obligations at least equivalent to these. We announce any new service provider at least 30 days in advance; an organization that objects on reasonable grounds can close its account at no cost.

Communication outside Québec and Canada

The database, files and authentication are hosted in Canada. When a service provider processes it elsewhere, we first carry out the privacy impact assessment required by Law 25 and govern it by contract. We provide these assessments to the organization on request.

Help to the organization

• Access, correction and portability requests: Samwell's export and correction tools; we forward to the organization, without answering ourselves, any request we receive about it.
• Privacy impact assessments: we provide the relevant information about the service.
• Consent register and audit log available in the application.

Confidentiality incidents

We notify the organization of any incident affecting its data no later than 72 hours after becoming aware of it: nature, data and people concerned, measures taken, contact person. We help it assess the risk of serious injury and notify the Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada and the people concerned. The organization remains responsible for these notices unless agreed otherwise.

End of the agreement

• The organization exports its data before closing (full export in the settings).
• The data is removed from the application 30 days after closing, kept 100 more days in an encrypted archive to repair a fraudulent closure, then deleted; backups are deleted as they rotate.
• We keep nothing else, except what the law requires to be kept: subscription invoices, and the organization's payroll (registers, slips, remittances), encrypted separately until January 1 of the 7th year after the last pay.
• The organization's retention obligations (for example, payroll records) remain its own: the export is there to meet them.

Audits

On written request, at most once a year, we answer a security questionnaire and provide the information needed to show compliance with this agreement. An on-site audit is agreed in writing, at the organization's expense.