Data Processing Addendum

Effective Date: October 17, 2026

This Data Processing Addendum (“DPA”) supplements the Master Service Agreement (“Agreement”) between Cerisano Consulting Services Inc., operating as Bizby (“Processor”, “Bizby”), and the entity identified in the Agreement (“Controller”, “Customer”). This DPA applies where Bizby processes Personal Information on behalf of Customer in providing the Service.

1. Definitions

• “Personal Information” has the meaning given under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, and includes “personal data” as defined under any applicable data protection law.
• “Processing” means any operation performed on Personal Information, including collection, use, storage, disclosure, modification, and deletion.
• “Sub-processor” means a third party engaged by Bizby to process Personal Information on behalf of Customer.
• “Data Breach” means any unauthorized access to, disclosure of, or loss of Personal Information.

2. Roles and Scope

2.1 Roles. Customer is the Controller of Personal Information. Bizby is the Processor, processing Personal Information solely on Customer’s documented instructions to provide the Service.

2.2 Scope of Processing. Bizby processes the following categories of Personal Information:

Category	Data Elements	Purpose
Account Data	Name, email address	Authentication, account management
Collaboration Content	Board content, text, images, files uploaded by users	Providing the collaboration service
Usage Metadata	IP address, session identifiers, feature usage	Service operation, security monitoring

2.3 Data Subjects. Personal Information relates to Customer’s Authorized Users and, where applicable, individuals who interact with boards via shared links.

3. Data Residency

3.1 Canadian Data Residency. Enterprise customers can enable Canadian data residency in their administration settings. While it is enabled: (a) all Customer Data, including Personal Information, is stored at rest exclusively within Canada; (b) all real-time WebSocket communication runs on Fly.io Toronto (YYZ), so board content and user data are processed exclusively within Canada; (c) AI processing runs on Azure OpenAI in Canada East; and (d) Bizby does not transfer Customer Data outside of Canada unless explicitly requested by Customer in writing. Without Canadian data residency, real-time collaboration sessions are relayed through Cloudflare’s edge network, which may process session traffic transiently outside Canada and does not store it. Sign-in identity (email address, name and sign-in records) is handled by a global authentication service and contains no board content; with enterprise single sign-on, credentials stay with Customer’s identity provider.

3.2 Infrastructure. Bizby uses the following infrastructure:

• Real-time collaboration (default): Cloudflare Workers, Eastern North America placement; session traffic only, no Customer Data stored
• Real-time collaboration (Canadian data residency): Fly.io Toronto (YYZ), for enterprise customers that enable it
• Database: Google Cloud Firestore (Montreal, northamerica-northeast1)
• File storage: Firebase Storage (Montreal, northamerica-northeast1)
• AI processing: Azure OpenAI (Canada East, Quebec City) — activated only when Customer explicitly uses AI features

3.3 Jurisdiction and Government Access Requests. Bizby is a Canadian company (Cerisano Consulting Services Inc.) incorporated under Canadian law, and, under Canadian data residency, Customer Data is stored in the Canadian regions of the infrastructure providers listed in Section 3.2. Bizby is not itself subject to the U.S. CLOUD Act. However, some of those infrastructure providers are U.S.-based and may be subject to the CLOUD Act or comparable foreign laws; such a provider could be compelled by a foreign authority to disclose data it processes, independently of Bizby. Bizby does not voluntarily disclose Customer Data in response to foreign government requests, requires valid legal process before any disclosure, and will notify the Customer where legally permitted to do so.

4. Security Measures

Bizby implements and maintains the following technical and organizational measures to protect Personal Information:

• Encryption in transit: TLS 1.2+ for all connections
• Encryption at rest: AES-256 for stored data
• Access control: Role-based access, principle of least privilege, multi-factor authentication for infrastructure
• Audit logging: Comprehensive logging of administrative and data access events
• Vulnerability management: Automated dependency scanning (Dependabot), secret scanning, push protection
• Network security: Cloudflare DDoS protection, WAF, rate limiting
• Code review: All changes require pull request approval and automated checks before deployment
• Incident response: Documented incident response procedure with defined severity levels and escalation paths

Bizby is pursuing SOC 2 Type II certification. Certification status and security documentation are available upon request.

5. Sub-processors

5.1 Current Sub-processors. Customer authorizes Bizby to engage the following sub-processors:

Sub-processor	Purpose	Location
Google Cloud (Firebase/Firestore)	Database, file storage	Montreal, Canada
Google (Firebase Authentication)	Sign-in identity (email address, name, sign-in records)	Global; no board content
Cloudflare	Edge compute (default real-time sessions, transient), CDN, DDoS protection	Edge network, Eastern North America placement; no Customer Data stored
Fly.io	Canadian data residency compute	Toronto, Canada
Microsoft Azure (OpenAI)	AI features (opt-in only)	Canada East (Quebec City)
Stripe	Payment processing	Global (payment data only)

5.2 New Sub-processors. Bizby will notify Customer at least thirty (30) days before engaging a new sub-processor that processes Personal Information. Customer may object in writing within the notice period. If Bizby cannot reasonably accommodate the objection, Customer may terminate the affected Service.

5.3 Sub-processor Obligations. Bizby ensures all sub-processors are bound by data protection obligations no less protective than those in this DPA.

6. Data Subject Rights

6.1 Bizby will assist Customer in responding to data subject requests to access, correct, delete, or port their Personal Information, to the extent Bizby’s systems permit.

6.2 If Bizby receives a request directly from a data subject, Bizby will promptly redirect the individual to Customer unless legally compelled to respond.

7. Data Breach Notification

7.1 In the event of a confirmed Data Breach, Bizby will notify Customer without unreasonable delay and in any event within seventy-two (72) hours of confirmation.

7.2 Notification will include: (a) the nature of the breach; (b) categories and approximate number of data subjects affected; (c) likely consequences; (d) measures taken or proposed to mitigate the breach.

7.3 Bizby will cooperate with Customer’s investigation and with any notifications required under applicable privacy legislation, including notifications to the Office of the Privacy Commissioner of Canada.

8. Data Retention and Deletion

8.1 Bizby retains Personal Information only for as long as necessary to provide the Service and comply with legal obligations.

8.2 Upon termination or expiration of the Agreement, Bizby will:

• Make Customer Data available for export for thirty (30) days
• Permanently delete Customer Data from all production systems within sixty (60) days after the end of the export period
• Delete Personal Information from backups within ninety (90) days after termination or expiration, or isolate and protect it until deletion is feasible

8.3 Upon Customer’s written request, Bizby will provide written confirmation of deletion.

9. Audit Rights

9.1 Customer may request, no more than once per year, that Bizby provide evidence of compliance with this DPA through: (a) completion of a security questionnaire; (b) provision of audit reports or certifications (e.g., SOC 2); or (c) a third-party audit at Customer’s expense, subject to reasonable scope and scheduling.

9.2 Bizby will make available all information reasonably necessary to demonstrate compliance and will cooperate with audits or inspections.

10. International Transfers

10.1 For enterprise customers that enable Canadian data residency, Bizby does not store or process Personal Information outside of Canada in the ordinary course of providing the Service, except sign-in identity as described in Section 3.1.

10.2 If a transfer outside Canada becomes necessary (e.g., at Customer’s request), Bizby will ensure appropriate safeguards are in place in accordance with PIPEDA and applicable provincial legislation, and will obtain Customer’s prior written consent.

11. PIPEDA Compliance

Bizby complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including:

• Accountability: Bizby has designated a Privacy Officer responsible for compliance
• Purpose limitation: Personal Information is processed only for the purposes described in this DPA
• Consent: Bizby processes Personal Information based on Customer’s instructions; Customer is responsible for obtaining any required consent from data subjects
• Minimization: Bizby collects and processes only the Personal Information necessary to provide the Service
• Accuracy: Bizby provides tools for Customer and data subjects to update their information
• Safeguards: As described in Section 4
• Openness: This DPA and the Privacy Policy describe Bizby’s data practices

12. Term

This DPA is effective for the duration of the Agreement. Sections relating to data deletion, confidentiality, and audit rights survive termination or expiration.

This DPA is made available in English and French. If the two versions are inconsistent, the English version prevails, to the extent permitted by applicable law.

13. Contact

For questions about this DPA or to exercise data-related rights:

Cerisano Consulting Services Inc. Operating as Bizby Privacy Officer Email: privacy@bizby.ca Web: bizby.ca