Data Processing Addendum

1. Scope and roles

You determine the purposes and means of processing the personal information you put into the service. We process it only to provide, secure and support the service, and only on your documented instructions, which include the instructions implicit in your configuration and use of the features.

You are responsible for having a lawful basis to put the information into the service in the first place, for giving any notice and obtaining any consent that requires, and for the accuracy of what you enter. We have no visibility of whether an owner agreed to be contacted or whether a record is correct.

If we believe an instruction from you would breach applicable data protection law, we will tell you and may pause that processing.

2. What is processed

The service is not designed to hold special category or sensitive personal information, government identifiers, or payment card numbers, and you agree not to put them into free-text fields or uploaded documents unless a feature is specifically provided for that purpose.

• Categories of individuals: owners, residents, tenants, board members, committee members, employees of a management company, vendors and their personnel, and people who contact an association through the service.
• Categories of information: identity and contact details, unit and ownership details, account balances and payment history, violation and architectural request records, maintenance requests, communications, meeting and voting records, documents you upload, and access and audit logs.
• Purpose: operating the association's administration as you have configured it.
• Duration: for as long as you instruct, and the wind-down period in section 7.

3. Confidentiality and personnel

We keep the information confidential, limit access to personnel who need it to provide or support the service, bind those personnel to confidentiality, and train them on their obligations. Administrative access to production data is restricted, logged and reviewed.

4. Security

We implement technical and organisational measures appropriate to the risk, which include encryption in transit, encryption at rest for stored data and backups, role-based access control with separation between customers, audit logging of actions in an account, regular backups with restoration testing, dependency and vulnerability monitoring, and change control for production releases.

We will not represent that we hold a SOC 2, ISO 27001 or equivalent certification, because we do not. You should assess whether our measures meet your own obligations before putting information into the service.

5. Sub-processors

You authorise us to use sub-processors to provide the service. We impose data protection obligations on them no less protective than those in this addendum, and we remain responsible for their performance.

We use sub-processors in the following categories: cloud hosting and compute, managed database and backup, transactional email delivery, payment processing, error monitoring, product analytics, and customer support tooling. We maintain a current list naming each one, available on request from info@fourcents.ca.

We will give you notice before adding or replacing a sub-processor that processes association data. If you reasonably object on data protection grounds, tell us within fifteen days and we will work with you in good faith; if we cannot resolve it you may terminate the affected part of the service and receive a refund of the unused prepaid portion.

6. Individuals' requests, assistance and transfers

Where an individual contacts us directly about information you control, we will not respond on your behalf beyond telling them to contact you, and we will forward the request to you promptly.

We will assist you, at your cost where the assistance is substantial, in responding to access, correction, deletion and portability requests, in carrying out a data protection impact assessment, and in consulting a regulator, to the extent you cannot do so yourself through the service's own export and administration tools.

Where processing involves transferring information out of its home jurisdiction, we rely on appropriate safeguards, which depending on the destination may include standard contractual clauses or an adequacy decision, and we will provide the relevant details on request.

7. Breach notification, return and deletion

If we become aware of a personal data breach affecting information we process for you, we will notify you without undue delay and in any event within seventy-two hours of becoming aware, describe what we know including the categories and approximate number of individuals and records affected, the likely consequences and the measures taken or proposed, and keep you updated. We will not make a public statement identifying you without consulting you first unless legally required to.

During your subscription you can export your data at any time through the service. On termination we will retain it for thirty days so you can export it, then delete or irreversibly anonymise it, except where we are legally required to retain it or where it exists in a backup, in which case it is deleted on that backup's ordinary expiry cycle. We will confirm deletion in writing on request.

8. Audit

On reasonable written request, and no more than once in a twelve-month period unless a regulator or a breach requires otherwise, we will provide the information reasonably necessary for you to assess our compliance with this addendum. Where that is not sufficient for your obligations, we will discuss an audit, conducted on reasonable notice, during business hours, without unreasonable disruption, subject to confidentiality, and at your cost.

9. Order of precedence

Where this addendum conflicts with the terms of service, this addendum governs for the processing of association personal information. Where it conflicts with a mandatory requirement of applicable data protection law, that law governs.