Data Processing Addendum

Data Processing Addendum

Version: v1.6 (2026-10-21) Effective Date: 2026-10-21

This Data Processing Addendum ("DPA") is entered into between the customer identified in the Order ("Customer") and 2073166 Alberta Inc., operating as Achieve Business Solutions ("Provider"). This DPA is incorporated into and forms part of the Master Service Agreement ("MSA") between the Parties.

1. Scope and Roles

1.1 Subject matter

This DPA governs the Processing of Personal Information by Provider on behalf of Customer in connection with Provider's operation of the Ultimate Email Management System (the "Service").

1.2 Roles

Under applicable privacy law:

• Customer is the Controller (GDPR) / the collecting Organization (PIPEDA) / the Business (CCPA/CPRA) of the Personal Information in email content, attachments, and knowledge-base documents that Customer makes available to the Service.
• Provider is the Processor (GDPR) / Service Provider (CCPA/CPRA) of that Personal Information, acting on Customer's documented instructions.

For Personal Information about Customer's own account (billing contact, authorized users), Provider is the Controller. Provider's handling of that information is governed by the Privacy Policy, not this DPA.

1.3 Applicable law

This DPA is designed to meet the requirements of:

• Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and provincial privacy laws;
• the EU/UK General Data Protection Regulation ("GDPR") and UK GDPR, to the extent applicable;
• the California Consumer Privacy Act as amended ("CCPA/CPRA"), to the extent applicable.

Where the GDPR or UK GDPR applies to Customer's Processing, the Parties will sign the applicable Standard Contractual Clauses referenced in Appendix B. Where CCPA/CPRA applies, the terms in Section 10 apply.

2. Definitions

Capitalized terms used and not defined here have the meanings in the MSA. Additional definitions:

• "Personal Information" means information about an identified or identifiable individual, as defined under applicable privacy law.
• "Process", "Processing" means any operation performed on Personal Information, including collection, use, disclosure, storage, transfer, and deletion.
• "Subprocessor" means any third party engaged by Provider to Process Personal Information on Customer's behalf.
• "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information transmitted, stored, or otherwise Processed by Provider.

3. Customer Instructions

3.1 Documented instructions

Provider will Process Personal Information only on Customer's documented instructions, which include:

• the MSA and this DPA;
• Customer's configuration of the Service (mode selection, guardrails, mailbox connections);
• Customer's use of in-portal controls (KB uploads, memory edits, deletions).

3.2 Legal compliance

Provider will inform Customer if, in Provider's opinion, an instruction infringes applicable privacy law, unless prohibited from doing so by law. Provider is not obligated to perform legal assessment of Customer's Processing.

3.3 Compelled disclosure

If Provider is required by law to Process Personal Information beyond Customer's instructions, Provider will notify Customer before Processing (where legally permitted) so that Customer can seek a protective order or equivalent.

4. Purposes and Categories

4.1 Purposes

Provider Processes Personal Information solely to provide the Service to Customer, including:

• fetching, classifying, and drafting replies to email;
• retrieving relevant knowledge-base content;
• updating Customer's style profile and memory based on Customer feedback;
• responding to Customer support requests;
• monitoring, securing, and improving the operation of the Service for Customer;
• complying with Provider's legal obligations.

Provider will not Process Personal Information for its own commercial purposes, for advertising, for profiling, for sale, or to train Provider's own general-purpose AI models. Provider does not access the content of Personal Information outside of logged, ticketed support sessions; every such session is recorded in the Customer-visible Support History (actor, ticket identifier, reason, timestamps) and cannot be suppressed by Provider.

Provider engages a third-party AI model Subprocessor (currently listed in Appendix C) to generate draft replies on Customer's behalf. On Provider's standard service tier, that Subprocessor may use the content submitted to it as training data for its own models per the Subprocessor's published terms. Provider does not control that policy. The Subprocessor's identity and terms are linked at achievebs.ca/subprocessors. Customer may elect, at additional cost and via a separate written addendum, an alternate AI model Subprocessor that is contractually committed to not retain or train on Customer Content.

4.2 Categories of Personal Information

Personal Information Processed may include (depending on what appears in Customer's email content and knowledge base):

• identifying data (names, email addresses, phone numbers)
• contact data
• professional and employment information
• customer-service interactions
• attachments that may contain sensitive categories as classified by Customer

4.3 Categories of Data Subjects

Data subjects may include:

• Customer's own employees and contractors;
• Customer's customers (end users);
• Customer's vendors, partners, and other correspondents;
• any individual who emails into or is addressed from a connected mailbox.

4.4 Duration of Processing

Processing lasts for the Subscription Term and the post-termination retention period in the MSA.

5. Provider Obligations

5.1 Confidentiality

Provider will ensure that persons authorized to Process Personal Information are bound by confidentiality obligations.

5.2 Security

Provider will implement and maintain appropriate technical and organizational measures to protect Personal Information, including those described in Appendix A.

5.3 Assistance to Customer

Taking into account the nature of the Processing, Provider will assist Customer by appropriate technical and organizational measures, at Customer's expense for requests beyond standard in-product features, in:

• responding to requests from Data Subjects to exercise rights;
• meeting Customer's obligations regarding Security Incidents, data protection impact assessments, and consultations with supervisory authorities;
• demonstrating compliance with applicable privacy law.

5.4 Deletion and return

At Customer's choice, at the end of the Subscription Term, Provider will return or delete Personal Information in accordance with Section 11.4 of the MSA. Backups are deleted according to Provider's backup rotation schedule (see backup-dr.md §6).

5.5 Records

Provider will maintain records of Processing activities as required by applicable law and will make them available to Customer on reasonable request.

6. Subprocessors

6.1 Authorization

Customer provides general written authorization for Provider to engage Subprocessors, subject to the conditions in this Section.

6.2 Current Subprocessors

The current list of Subprocessors is published at achievebs.ca/subprocessors and includes (at the Effective Date) those listed in Appendix C.

6.3 New Subprocessors

Provider will notify Customer at least 30 days before engaging a new Subprocessor. If Customer reasonably objects to a new Subprocessor on data-protection grounds, the Parties will work together in good faith. If a resolution is not reached, Customer may terminate the affected portion of the Service per the MSA.

6.4 Subprocessor obligations

Provider will impose on Subprocessors, by contract, data-protection obligations materially equivalent to those in this DPA. Provider remains liable for Subprocessors' acts and omissions.

7. International Transfers

7.1 Transfer mechanisms

Personal Information is Processed primarily in the United States. For transfers from:

• Canada: Provider relies on PIPEDA's organization-to-organization transfer provisions with contractual safeguards.
• EEA/UK/Switzerland to the US or Canada: Provider relies on the European Commission's adequacy decision for Canada where applicable, and/or Standard Contractual Clauses for transfers to the US.
• California and other US states: onward transfer provisions are handled under applicable state law; see Section 10.

7.2 Standard Contractual Clauses

Where GDPR or UK GDPR applies, the Parties are deemed to have entered into the relevant Standard Contractual Clauses as attached (or to be attached) in Appendix B. Provider will enter Module Two (Controller-to-Processor) with Customer for Customer's direct transfers, and Module Three (Processor-to-Processor) with Subprocessors where applicable.

8. Audit and Assessments

8.1 Records and reports

Provider will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including SOC 2 reports or equivalent (when available) from Provider or Provider's infrastructure Subprocessors.

8.2 Audits

Customer may, at Customer's expense and at reasonable intervals (no more than once per year, unless required by applicable law or following a Security Incident), audit Provider's compliance with this DPA. Provider may satisfy audit requests by providing up-to-date third-party certifications or attestation reports (SOC 2 Type II, ISO 27001, equivalent). Customer and Provider will agree in advance on the scope, timing, and methodology of any audit. Customer will treat audit findings as Provider's Confidential Information.

8.3 Regulators

Provider will cooperate with reasonable requests from competent regulators regarding Customer's Processing.

9. Security Incidents

9.1 Notification

Provider will notify Customer of a confirmed Security Incident affecting Customer's Personal Information without undue delay and in any case within 72 hours of confirmation.

9.2 Contents of notice

The notice will include, to the extent known at the time:

• the nature of the Security Incident;
• the categories and approximate number of Data Subjects and records concerned;
• the likely consequences;
• measures taken or proposed to address the Incident and mitigate adverse effects.

Updates will follow as information becomes available.

9.3 Assistance

Provider will assist Customer in meeting Customer's own notification obligations to Data Subjects or regulators, at Customer's expense to the extent assistance exceeds standard support.

9.4 Customer's obligations

Customer is responsible for assessing whether Customer must notify Data Subjects or regulators under applicable law, and for making such notifications if required.

10. CCPA / CPRA Specific Terms (for California residents)

Where Personal Information within the scope of the CCPA/CPRA is Processed under this DPA:

10.1 Service Provider status

Provider acts as a "Service Provider" (as defined by the CCPA/CPRA) and not a "Third Party."

10.2 Prohibitions

Provider will not:

• sell Personal Information;
• share Personal Information for cross-context behavioral advertising;
• retain, use, or disclose Personal Information for any purpose other than the business purposes specified in the MSA and this DPA;
• retain, use, or disclose Personal Information outside the direct business relationship with Customer;
• combine Personal Information received from Customer with Personal Information received from another source, except as permitted by law and necessary to provide the Service to Customer.

10.3 Certification

Provider certifies that it understands and will comply with the restrictions in this Section 10.

10.4 Customer rights

Customer may, on reasonable notice, take steps to stop or remediate unauthorized use of Personal Information.

11. Miscellaneous

11.1 Order of precedence. In case of conflict between this DPA and the MSA, this DPA controls for matters of Personal Information Processing.

11.2 Fees for compliance assistance. Provider's cooperation with Customer's compliance activities is included in the Service at no additional charge for standard in-product functions. Requests that require meaningful engineering work (e.g., non-standard export formats, targeted deletions across backups) may incur reasonable fees, quoted in advance.

11.3 Changes. Provider may update this DPA by 30 days' prior notice where needed to reflect changes in applicable law, the Service, or its Subprocessors. Material changes that negatively affect Customer's rights will be treated as material changes to the MSA under MSA Section 2.3.

11.4 Acceptance. By signing this DPA (electronically or otherwise), each Party agrees to the terms above.

Appendix A: Technical and Organizational Measures

Access control

• MFA required for all privileged accounts (TOTP minimum; WebAuthn for super-admin)
• Role-based access (support:view / support:diagnose / support:impersonate / super-admin)
• Time-bounded, ticket-scoped admin impersonation sessions; client-visible audit log of all admin activity
• IP-bound sessions; idle timeout for admin sessions

Encryption

• TLS 1.2+ for all data in transit
• AES-256 at rest for customer content
• Envelope encryption with per-user data keys wrapped by a key encryption key in AWS KMS
• OAuth refresh tokens stored only in encrypted form; decrypted in memory during use

Operational security

• Append-only audit log for all privileged actions, streamed to an external immutable store with object-lock
• Structured logging with trace IDs across the request-to-reply pipeline
• Per-tenant and per-user rate limits; per-tenant LLM cost budgets
• Secrets management via AWS KMS and a dedicated secrets store (Infisical or equivalent)

Secure development

• Typed contracts at every service boundary (TypeScript / Zod, Python / Pydantic)
• Input validation at every system boundary
• Dependency vulnerability scanning (Dependabot, Socket.dev, OSV Scanner)
• Patch SLA: CRITICAL within 72 hours, HIGH within 30 days
• Software bill of materials (SBOM) generated per release

AI safety

• Structured prompt templates with trust-tagged inputs
• Separate drafting vs admin tool surfaces (agent cannot invoke admin operations)
• Second-pass safety review on all auto-sent drafts
• Eval suite run on every change; injection_refusal ≥98%, cross-tenant leak = 0

Tenant isolation

• Postgres row-level security + application-layer scope checks (company_id / user_id)
• pgvector queries scoped and RLS-protected
• Per-tenant RAG / memory stores; no shared pools

Business continuity

• Daily Postgres backups retained 35 days; monthly retained 12 months
• Cross-region object-storage replication
• Documented disaster-recovery playbooks with RPO 24h / RTO 4h targets
• Quarterly restore drills

Personnel

• Confidentiality obligations for all personnel
• Role-based access minimization
• Annual security and privacy training (when headcount warrants)

Provider may update these measures over time, provided the overall level of protection is not materially reduced.

Appendix B: Standard Contractual Clauses (placeholder)

For transfers subject to GDPR or UK GDPR, the applicable modules of the Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum will be attached here and signed by both Parties. (To be populated when the first EEA/UK customer signs.)

Appendix C: Current Subprocessors

The following Subprocessors are authorized at the Effective Date. A current list is maintained at achievebs.ca/subprocessors.