Data Processing Terms

These Data Processing Terms govern personal information about other people that you put into MinuteKeep (the "Service") — the directors, officers, shareholders, members, and others whose names, residential addresses, and holdings appear in corporate records. They form part of, and are incorporated into, the Terms of Service. Capitalized terms not defined here have the meanings given in the Terms and the Privacy Policy.

1. Scope and Roles

These terms apply to Third-Party Personal Information — personal information about any individual other than you that you, your team members, or anyone acting on your behalf enters, uploads, or causes to be collected through the Service, including through a questionnaire link you send.

• You are the responsible organization. You determine why and how Third-Party Personal Information is collected and used. Under PIPEDA and equivalent provincial legislation, you are the organization accountable for it. In terminology used elsewhere, you are the controller.
• We act on your behalf. We process Third-Party Personal Information as a service provider, on your instructions, to provide, secure, support, and maintain the Service. In terminology used elsewhere, we are the processor.
• Your own account information — your name, email address, billing details, and usage data — is not Third-Party Personal Information. We handle that in our own right under the Privacy Policy.

These terms do not make us your agent, do not give us any duty to the individuals concerned beyond what applicable law imposes on a service provider, and do not create any professional or fiduciary relationship (see Terms, Section 2).

2. Your Instructions

Your instructions to us are: process Third-Party Personal Information as necessary to provide the Service as described in the Terms and the Privacy Policy. That includes storing it, generating documents from it, transmitting it to the sub-processors listed at minutekeep.ca/subprocessors, backing it up, and processing it for security, abuse prevention, support, and product improvement as described in the Privacy Policy.

Your use of the Service constitutes those instructions. We will not process Third-Party Personal Information for any materially different purpose, except where required by law, or to establish, exercise, or defend a legal claim. We may process de-identified and aggregated data that does not identify any individual for any lawful purpose.

3. Your Obligations and Warranties

You represent, warrant, and undertake, on a continuing basis, that:

1. you have the authority, lawful basis, and any required consent to collect each item of Third-Party Personal Information, to enter it into the Service, and to have it processed as described;
2. you have given each individual every notice required by law, including notice that their information will be stored and processed outside Canada, that it may be subject to foreign law and to access by foreign authorities, and that Canadian data residency is not guaranteed (see Privacy Policy, Section 8);
3. the information is accurate, is limited to what is necessary for the purpose, and is lawfully obtained;
4. you have a lawful basis for retaining it for as long as it remains in the Service, and you will remove what you no longer need;
5. you will not enter special categories of information the Service is not designed for, including Social Insurance Numbers and other government identifiers, health information, biometric information, or payment card numbers;
6. you will distribute questionnaire, invitation, badge, and download links only to people entitled to them, and you accept that anyone holding such a link may be able to view or submit the associated information;
7. you will apply appropriate safeguards on your side, including access control, device security, and multi-factor authentication (see Terms, Section 9); and
8. where you act for a client — as a lawyer, accountant, corporate services provider, or otherwise — you have your client's authority to use the Service for their records, you have made any disclosure your professional or contractual obligations require, and you remain solely responsible to that client.

4. Our Commitments

Subject to the disclaimers in Section 8, we will:

• process Third-Party Personal Information only as described in Section 2;
• not sell, rent, or trade it, and not disclose it to any third party for that party's own independent purposes;
• apply the security measures described in Privacy Policy, Section 10, as those measures stand from time to time;
• restrict access to personnel who need it, subject to confidentiality obligations;
• engage sub-processors only under terms that require them to protect the information, and remain responsible to you for their performance of the processing we entrust to them, subject to Terms, Section 17;
• assist you, so far as reasonably practicable and at your cost for anything beyond routine assistance, in responding to individuals' access, correction, and deletion requests and in meeting your own breach-notification obligations;
• notify you without undue delay after we become aware of a breach of security safeguards affecting Third-Party Personal Information in your account, with the information reasonably available to us; and
• delete Third-Party Personal Information on the schedule in Privacy Policy, Section 9, or earlier on your instruction, subject to legal retention requirements and to residual copies in backups and logs that expire on their normal cycle.

5. Sub-processors

You authorize us to engage the sub-processors listed at minutekeep.ca/subprocessors, and any replacement or additional sub-processor we appoint. We may change sub-processors at any time without notice, and we do not operate an objection, approval, or consent process. If a change is unacceptable to you, your remedy is to stop using the Service and close your account.

6. Individuals' Requests

If an individual whose information you entered contacts us to exercise a right — access, correction, deletion, or withdrawal of consent — we will ordinarily refer them to you as the responsible organization and notify you, unless applicable law requires us to respond directly. You are responsible for responding. We will not delete or alter records within your account on a third party's instruction without your involvement, except where legally required. You must respond within the time your obligations require and must tell us if a request requires us to act.

7. Cross-Border Transfer

You expressly instruct and authorize us to transfer, store, and process Third-Party Personal Information outside Canada, including in the United States, as described in Privacy Policy, Section 8. You accept sole responsibility for determining whether that transfer is permissible for you and for the individuals concerned, for conducting any assessment your obligations require — including a privacy impact assessment under Quebec's Law 25 where applicable — and for making any required disclosure or obtaining any required consent. We give no assurance that any transfer meets any adequacy, equivalence, or comparable-protection standard.

8. Disclaimers and Liability

Our commitments in Section 4 are contractual undertakings to you as to how we handle data. They are not warranties of security, privacy, confidentiality, availability, or compliance, and they do not displace Terms, Section 16. In particular:

• we do not warrant that the Service, our infrastructure, or our sub-processors are or will be secure, or that Third-Party Personal Information will not be accessed, disclosed, lost, or corrupted;
• we do not warrant Canadian data residency, and we do not warrant against access by foreign courts, regulators, or law enforcement;
• we do not warrant that your use of the Service will make you compliant with PIPEDA, Law 25, provincial privacy legislation, or any professional or contractual obligation; and
• any liability arising under or in connection with these Data Processing Terms is subject in full to the exclusions and the aggregate liability cap in Terms, Section 17.

9. Indemnity

You indemnify us in respect of Third-Party Personal Information on the terms of Terms, Section 18, including any claim, complaint, investigation, order, or penalty brought by an individual, by a privacy commissioner, or by any regulator arising from information you entered or caused to be collected, from a notice or consent you did not obtain, from a link you distributed, or from your breach of these terms.

10. Term, Deletion, and Return

These terms apply while you use the Service and while we hold Third-Party Personal Information for you. On termination you may export your data as provided in Terms, Sections 12.5 to 12.7, after which we delete it on the stated schedule. Deletion is permanent and cannot be reversed.

11. Conflicts and Changes

On the allocation of responsibility for Third-Party Personal Information, these terms prevail over the Terms of Service and the Privacy Policy. On all other matters the Terms of Service prevail. We may update these terms; material changes are notified in accordance with Terms, Section 22.1.

These terms are our standard data processing terms. We do not negotiate bespoke data processing agreements and we do not sign customer-supplied DPAs, security addenda, or vendor questionnaires. If your obligations require a negotiated agreement, the Service is not suitable for you.

Questions: support@minutekeep.ca.