Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Retrolux Terms of Service (the "Terms") between 1333701 BC Ltd., doing business as Retrolux ("Retrolux"), and the customer that agreed to the Terms ("Customer"). It applies automatically whenever Retrolux processes Customer Personal Data in providing the Service. No separate signature is required. Customer can request a countersigned copy at support@retrolux.com. Capitalized terms not defined here have the meanings given in the Terms.

1. Definitions

• Customer Personal Data: personal information contained in Customer Data. Information about Authorized Users' accounts, usage and support requests is not Customer Personal Data; Retrolux handles it as a controller under its Privacy Policy.
• Data Protection Laws: all privacy and data protection laws that apply to the processing of Customer Personal Data under the Terms. Depending on the data, these may include Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the personal information protection acts of British Columbia and Alberta, Quebec's Act respecting the protection of personal information in the private sector, US state privacy laws such as the California Consumer Privacy Act (CCPA), the EU General Data Protection Regulation (GDPR) and the UK GDPR.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Subprocessor: a third party that Retrolux engages to process Customer Personal Data.
• "Controller", "processor", "data subject" and "processing" have the meanings given in the GDPR, and include the equivalent terms in other Data Protection Laws, such as "business" and "service provider" under the CCPA.

2. Roles and instructions

Customer is the controller of Customer Personal Data, and Retrolux is its processor. If Customer is itself a processor for its own clients, Retrolux is its subprocessor, and Customer confirms that its instructions are authorized by the relevant controller.

Retrolux will process Customer Personal Data only on Customer's documented instructions. Those instructions are the Terms, this DPA, the Order Forms, Customer's use and configuration of the Service, and any other written instructions both parties agree to. Retrolux will tell Customer if it believes an instruction violates Data Protection Laws. If the law requires Retrolux to process data otherwise, Retrolux will inform Customer first unless the law prohibits it.

Customer is responsible for having a lawful basis, and for giving the notices and obtaining the consents, needed for Retrolux to process Customer Personal Data under this DPA.

3. Retrolux's obligations

• Confidentiality. Everyone Retrolux authorizes to process Customer Personal Data is bound by confidentiality obligations, and access is limited to those who need it.
• Security. Retrolux will implement and maintain the technical and organizational measures in Annex 2. It may update them, provided the overall level of protection does not decrease.
• No AI training. Retrolux will not use Customer Personal Data to train or fine-tune artificial intelligence or machine learning models. It will use only Subprocessors whose terms do not allow them to do so, and will opt out of any such use where a Subprocessor offers the choice.
• Permitted purposes. Retrolux may process Customer Personal Data only to provide, secure, support, maintain and improve the Service, and to create the aggregated, de-identified data described in the Terms, in each case as Data Protection Laws permit.

4. US state privacy law terms

Where the CCPA or a similar US state law applies to Customer Personal Data, Retrolux will:

• not sell or share Customer Personal Data, as those laws define the terms;
• not retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than the permitted purposes in Section 3;
• not combine it with personal information from other sources, except as those laws permit;
• comply with those laws and provide the same level of privacy protection they require of Customer;
• notify Customer if it determines that it can no longer meet its obligations under those laws; and
• allow Customer, on notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

5. Subprocessors

Customer gives Retrolux general authorization to engage Subprocessors. The current list is on our subprocessors page, under "Platform subprocessors". Retrolux will:

• impose data protection obligations on each Subprocessor, in a written contract, that are at least as protective as this DPA;
• remain responsible for each Subprocessor's performance of those obligations; and
• add any new Subprocessor to the subprocessors page at least 30 days before it begins processing Customer Personal Data. That page is how Retrolux gives notice, and its "Updated" date changes whenever the list does.

Customer may object to a new Subprocessor on reasonable data protection grounds by emailing support@retrolux.com within that 30-day period. The parties will discuss the objection in good faith. If Retrolux cannot offer a reasonable alternative, Customer may terminate the affected part of the Service before the change takes effect and receive a refund of prepaid Fees for the remainder of the Subscription Term. In an emergency, such as an unexpected provider failure, Retrolux may replace a Subprocessor sooner. It will give notice as soon as possible, and the same objection right applies.

6. Assistance

Taking into account the nature of the processing, Retrolux will help Customer meet its obligations under Data Protection Laws:

• Data subject requests. Customer can view, correct and export Customer Data through the Service. When Customer asks, Retrolux will permanently delete specific Customer Personal Data or provide it in a portable format. If Retrolux receives a request directly from a data subject about Customer Personal Data, it will forward the request to Customer promptly. It will not respond itself, except to direct the requester to Customer.
• Assessments and regulators. Retrolux will provide information reasonably needed for Customer's data protection impact assessments and consultations with regulators.
• Government requests. If a public authority asks Retrolux for access to Customer Personal Data, Retrolux will redirect it to Customer where possible, and notify Customer unless the law prohibits it. It will disclose only what the law requires.

7. Security Incidents

Retrolux will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident. It will send the notice to Customer's account administrators or the contact in the Order Form. The notice will describe, as far as Retrolux then knows, the nature of the incident, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed. Retrolux will update Customer as it learns more. It will take reasonable steps to contain and remediate the incident, and cooperate with Customer's own notifications to regulators and individuals. Retrolux keeps a record of Security Incidents for at least 24 months. Notifying Customer is not an admission of fault.

8. Return and deletion

For 30 days after the Terms or an Order Form ends, Customer may export Customer Data. Within 90 days after it ends, Retrolux will permanently delete Customer Personal Data from production systems. Backups are overwritten on their normal rotation and stay protected under this DPA until then. Retrolux may keep data the law requires it to retain, and will continue to protect it under this DPA.

9. Audits

On written request, no more than once a year, Retrolux will answer Customer's reasonable security and privacy questionnaires. It will also provide documentation that demonstrates its compliance with this DPA, under the confidentiality terms of the Terms. If that information is not enough to meet a requirement of Data Protection Laws or a regulator, Customer may conduct an audit at its own cost. It must give at least 30 days' notice, agree the scope with Retrolux in advance, and audit during business hours without disrupting operations.

10. International transfers

Retrolux is based in Canada and processes Customer Personal Data in Canada and the United States. Some Subprocessors process data in the other countries shown on the subprocessors page. Customer authorizes those transfers. For personal data subject to the GDPR or UK GDPR, Canada benefits from an adequacy decision. For onward transfers to Subprocessors outside an adequate country, Retrolux will rely on an adequacy mechanism, such as the EU-US Data Privacy Framework, or on Standard Contractual Clauses with the Subprocessor.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, including the Data Protection Cap. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA controls. This DPA lasts as long as Retrolux processes Customer Personal Data. Retrolux may update it under the change process in the Terms, but no update will reduce the overall protection of Customer Personal Data during a Subscription Term unless the law requires it.

Annex 1: Details of processing

Annex 2: Technical and organizational measures

• Encryption: connections between users and the Service are encrypted with TLS. Our managed database providers encrypt databases at rest.
• Access control: access to production systems and Customer Data is limited to authorized personnel who need it for their work, and is removed when no longer needed.
• Authentication: user passwords are stored with a one-way adaptive hash (bcrypt), and accounts lock after repeated failed sign-in attempts.
• Logical separation: Customer Data is associated with each customer's account in the application.
• Backups: production databases are backed up by our managed database providers.
• Monitoring and logging: application errors are monitored, and the application keeps an audit trail of changes to records.
• Change management: code changes are made through version control, and the application has an automated test suite.
• Vendor management: Subprocessors are bound by written data protection terms.
• Personnel: staff and contractors with access to Customer Data are bound by confidentiality obligations.
• Incident response: Security Incidents are investigated, contained, recorded and notified as set out in Section 7.
• Data minimization: session replays mask form inputs.

Annex 3: Subprocessors

The authorized Subprocessors are those listed under "Platform subprocessors" on our subprocessors page, as updated under Section 5.