Data Processing Agreement

"Personal Data" means any information relating to an identified or identifiable natural person.

"Data Controller" means the entity that determines the purposes and means of processing Personal Data (typically your organization).

"Data Processor" means the entity that processes Personal Data on behalf of the Data Controller (SyncWork).

"Sub-processor" means any third party engaged by SyncWork to process Personal Data.

This DPA applies when SyncWork processes Personal Data on your behalf in connection with the SyncWork services. This DPA is entered into pursuant to, and forms part of, the Terms of Service ("Agreement").

2.1 Processing Purposes

SyncWork will only process Personal Data for the following purposes:

• Providing, operating, and maintaining the SyncWork platform and its features
• Processing AI-powered features (document analysis, OCR, search, recommendations)
• Sending service-related communications (notifications, alerts)
• Providing customer support and resolving technical issues
• As necessary to comply with applicable laws
• As otherwise agreed in writing with you

2.2 Categories of Data Subjects

• Customer employees and authorized users of the Services
• Customer's own clients, contacts, and end users whose data is uploaded to the Services
• Individuals whose personal data is contained in documents uploaded to the Services

2.3 Categories of Personal Data

• Contact Information: Names, email addresses, phone numbers, mailing addresses
• Account Data: Usernames, profile information, authentication credentials
• Usage Data: Service usage logs, feature interactions, IP addresses
• Content Data: Documents, files, messages, and other content uploaded to the Services
• Financial Data: Invoices, billing records, payment-related information stored within the Services

SyncWork will:

• Process Personal Data only on your documented instructions
• Ensure that personnel processing Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist you in responding to data subject requests
• Delete or return Personal Data upon termination of services
• Make available information necessary to demonstrate compliance

SyncWork engages the following categories of sub-processors to provide the services:

We will notify you at least 30 days in advance of any intended changes to sub-processors by email to your account's billing contact. If you have a reasonable objection to a new sub-processor, you may notify us in writing within 15 days of receiving our notice. We will work with you to find a commercially reasonable alternative. If no resolution is possible, you may terminate the affected Services without penalty.

For the current full list of sub-processors, see our List of Sub-processors.

SyncWork implements the following security measures:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Multi-factor authentication for administrative access
• Ongoing security assessments, including continuous automated security review of every code change
• Access controls based on the principle of least privilege
• Audit logging of system access and data modifications
• Incident response and breach notification procedures

SyncWork will assist you in responding to requests from data subjects exercising their rights under applicable data protection laws, including:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to restrict processing

In the event of a Personal Data breach, SyncWork will notify you without undue delay (and in any event within 72 hours) after becoming aware of the breach. The notification will include:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

Upon reasonable notice and subject to appropriate confidentiality obligations, you may audit SyncWork's compliance with this DPA. SyncWork will make available relevant information and allow for audits conducted by you or an independent auditor.

This DPA is designed to comply with the following data protection laws as applicable:

• GDPR — Regulation (EU) 2016/679 (General Data Protection Regulation)
• UK GDPR — The UK General Data Protection Regulation as incorporated into UK law
• PIPEDA — Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5)
• BC PIPA — Personal Information Protection Act (SBC 2003, c. 63)
• CCPA/CPRA — California Consumer Privacy Act as amended by the California Privacy Rights Act

Where there is a conflict between this DPA and applicable data protection law, the applicable law prevails.

This DPA is governed by the laws of the Province of British Columbia and the federal laws of Canada applicable therein, without regard to conflict of law principles. For data subjects in the EEA, the applicable provisions of the GDPR and the Standard Contractual Clauses take precedence where they offer greater protection.

This DPA is effective for the duration of your use of SyncWork services and forms part of the Terms of Service. Upon termination, SyncWork will delete or return all Personal Data within 30 days, unless retention is required by applicable law.

For questions about this DPA or data protection matters: