Data processing agreement

When Susanoo runs customer operations on your behalf, for example answering your calls, replying to your leads, following up, and booking your appointments, or hosts and runs Custom Software that holds your business records, the personal information of the individuals involved is processed by Susanoo on your instructions and for your purposes.

For that information, you are the controller, and under the Personal Information Protection and Electronic Documents Act ("PIPEDA") the organization responsible for the information. Susanoo is the processor and, under United States state privacy laws, a service provider. Susanoo does not determine the purposes for which Client Personal Information is processed.

You remain responsible for the lawfulness of the information you provide to us and of the instructions you give us.

"Client Personal Information" means personal information about an identifiable individual that Susanoo processes on your behalf under the Terms of Service, including information about your customers, leads, contacts, and prospects.

"Personal information" and "personal data" have the meaning given in applicable Privacy Laws and are used interchangeably in this DPA.

"Privacy Laws" means all privacy and data protection laws applicable to the processing of Client Personal Information, including PIPEDA, Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25 ("Law 25"), other Canadian provincial privacy legislation, and applicable United States federal and state privacy laws, including the California Consumer Privacy Act as amended ("CCPA").

"Confidentiality Incident" has the meaning given in Law 25.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Information, and includes a Confidentiality Incident.

"Services" means the services Susanoo provides to you under the Terms of Service, delivered on the Susanoo platform and through any Custom Software (as defined in the Terms of Service) that Susanoo builds and runs for you.

"Sub-processor" means a third party engaged by Susanoo to process Client Personal Information.

Susanoo processes Client Personal Information only:

a) to provide, maintain, secure, and support the Services;

b) on your documented instructions, which include the Terms of Service, this DPA, the configuration choices you make in the platform, and the operational instructions you give us in the course of running your account; and

c) as required by applicable law, in which case Susanoo will inform you of that requirement before processing unless the law prohibits it.

Susanoo does not sell Client Personal Information, does not share it for cross-context behavioral advertising, and does not use it for its own commercial purposes. Susanoo does not retain, use, or disclose Client Personal Information for any purpose other than performing the Services, except as permitted by applicable law.

Susanoo may create aggregated or de-identified information from Client Personal Information and use it to operate, secure, and improve the Services. Susanoo will not attempt to re-identify that information and will maintain it in de-identified form.

If Susanoo determines that an instruction from you infringes applicable Privacy Laws, Susanoo will inform you without undue delay and may suspend performance of the affected instruction.

You represent and warrant that:

a) you have provided all notices and obtained all consents or established another lawful basis required for Susanoo to process Client Personal Information as contemplated by the Terms of Service and this DPA, including any consent required for calls, text messages, and other communications sent on your behalf;

b) your instructions to Susanoo comply with applicable Privacy Laws, including telemarketing, anti-spam, and messaging rules such as Canada's Anti-Spam Legislation and applicable United States equivalents; and

c) you will not provide Susanoo with special categories of personal information, government-issued identification numbers, payment card data, or health information governed by sector-specific legislation, unless you and Susanoo have agreed in writing to additional safeguards.

You are responsible for the accuracy of the Client Personal Information you provide and for maintaining your own record of consents and preferences.

Susanoo limits access to Client Personal Information to personnel who need it to deliver the Services. Those personnel are bound by written confidentiality obligations or by professional obligations of confidentiality that survive the end of their engagement.

Susanoo maintains technical and organizational measures designed to protect Client Personal Information against a Personal Data Breach, appropriate to the nature of the information and the risk. Those measures are described in Annex 2.

Susanoo reviews its measures periodically and may update them, provided that no update materially reduces the level of protection.

You give Susanoo general authorization to engage Sub-processors to process Client Personal Information in delivering the Services.

The Susanoo platform is a white-labeled version of the GoHighLevel platform provided to Susanoo by LeadConnector LLC. LeadConnector LLC is Susanoo's principal Sub-processor and the underlying processor for the platform on which Client Personal Information is stored and processed. The current list of Sub-processors is set out in Annex 3.

Susanoo enters into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA, and remains responsible to you for each Sub-processor's performance of those obligations.

Susanoo will give you notice before adding or replacing a Sub-processor that processes Client Personal Information, by email to your account contact and by updating Annex 3, at least thirty (30) days before the new Sub-processor begins processing. Where a replacement is needed urgently for security or continuity of the Services, Susanoo will give notice as soon as practicable and your right to object below still applies. If you have a reasonable objection on data protection grounds, tell us within 30 days of the notice and we will work with you in good faith to find an alternative. If no reasonable alternative is available, you may terminate the affected Services in accordance with the Terms of Service.

Individuals may have rights under Privacy Laws to access, correct, delete, port, or object to the processing of their personal information, and to withdraw consent.

Because you are the controller, requests from your customers and leads should be directed to you. If an individual makes such a request to Susanoo about Client Personal Information, Susanoo will not respond to it directly, except to confirm that the request has been received and to direct the individual to you, unless applicable law requires otherwise or you instruct us to respond.

Susanoo will provide reasonable assistance, taking into account the nature of the processing and the information available to us, to help you respond to those requests within the time limits set by Privacy Laws, and to help you meet your obligations relating to privacy impact assessments, security, breach notification, and consultation with regulators.

Susanoo will notify you without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Information.

The notice will describe, to the extent known at the time and as further information becomes available, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, the measures taken or proposed to address the breach, and a contact point for more information.

Susanoo will take reasonable steps to contain and remediate the breach and will cooperate with you in your assessment of the risk of serious injury and in any notification you must make to individuals, to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec, or to any other regulator. As between the parties, you are responsible for determining whether notification is required and for making it, because you are the controller.

Susanoo maintains a register of Confidentiality Incidents as required by Law 25 and will provide you with the entries relevant to Client Personal Information on request.

Susanoo's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

Susanoo operates in Canada and the United States. Client Personal Information may be stored or processed in either country, and by Sub-processors located in either country or elsewhere. As a result, Client Personal Information may be subject to the laws of those countries, including lawful access by courts, law enforcement, and government authorities.

Before transferring Client Personal Information outside the province or country in which it was collected, Susanoo relies on contractual and other appropriate safeguards consistent with PIPEDA, Law 25, and other applicable Privacy Laws, and conducts the privacy impact assessment that Law 25 requires where it applies.

LeadConnector LLC maintains its own certifications and safeguards for the data it processes, which may include certification under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework. Susanoo Inc. is not itself certified under the Data Privacy Framework and relies on contractual measures and on its Sub-processors' safeguards rather than on a Susanoo certification.

Susanoo retains Client Personal Information for as long as needed to deliver the Services to you.

At any time during the term, you may request a copy of your Client Personal Information in a commonly used electronic format, and Susanoo will provide it. Your data is yours and Susanoo will not withhold it as leverage in a commercial dispute.

When your contract ends, Susanoo will delete or anonymize your operational data, including the personal information of your leads and customers, within 90 days. You may request deletion sooner at any time.

Susanoo may retain Client Personal Information beyond that period only where required by law, including financial records such as invoices and payment records, which are retained for the period the law requires and then deleted. Information that has been anonymized so that it can no longer identify an individual is no longer personal information and may be retained.

On your written request, and no more than once in any 12 month period unless a Personal Data Breach has occurred or a regulator requires otherwise, Susanoo will make available the information reasonably necessary to demonstrate compliance with this DPA.

Susanoo may satisfy this obligation by providing a written description of its measures, its own responses to a security questionnaire, or the audit reports and certifications available to it from its Sub-processors. Any information disclosed under this section is Susanoo's confidential information.

Where a regulator with jurisdiction requires an audit that cannot be satisfied in that way, the parties will agree in advance on its scope, timing, and cost, and it will be conducted during business hours, subject to confidentiality obligations, and in a manner that does not disrupt the Services or the data of other Susanoo clients.

This section applies to the extent Client Personal Information is subject to the CCPA or to another United States state privacy law with equivalent requirements.

Susanoo acts as a service provider, and where applicable a processor, and processes Client Personal Information solely for the following specific business purposes, on your behalf:

a) answering, routing, and recording your calls and messages, where you have enabled recording;

b) responding to and following up with leads and contacts you provide or who contact you;

c) scheduling, confirming, and reminding appointments;

d) sending service, reminder, and transactional messages, and marketing messages you have approved and for which you hold the required consent;

e) issuing invoices and following up on them through the platform;

f) requesting and managing reviews;

g) maintaining your customer records and reporting to you on them;

h) running the AI agents configured for your account, with a person reviewing their work;

i) building, hosting, maintaining, securing, and supporting Custom Software, and keeping Your Records available to you and exportable;

j) detecting and responding to security incidents, preventing fraud, and debugging and repairing the Services; and

k) complying with applicable law.

These purposes are described further in Annex 1.

Susanoo does not sell or share Client Personal Information as those terms are defined in the CCPA, does not retain, use, or disclose it for any purpose other than the business purposes specified in the Terms of Service and this DPA, and does not combine it with personal information received from other sources except as permitted for a service provider.

Susanoo certifies that it understands these restrictions and will comply with them. Susanoo will notify you if it determines it can no longer meet its obligations under applicable United States state privacy law, and on notice you may take reasonable and appropriate steps to stop and remediate unauthorized use.

Susanoo has designated a person responsible for the protection of personal information. That person is Emaan Baig, Chief Executive Officer, who can be reached at privacy@susanoo.ai or by mail at Susanoo Inc., 100 King Street West, Suite 5700, Toronto, ON M5X 1C7.

Susanoo maintains governance policies and practices covering the retention, destruction, and security of personal information, the roles and responsibilities of its personnel, and the handling of complaints, as required by PIPEDA and Law 25.

Where Client Personal Information is used to render a decision based exclusively on automated processing, Susanoo will inform you so that you can provide the notice that Law 25 requires. Susanoo does not use Client Personal Information for profiling, identification, or location tracking beyond what is necessary to deliver the Services you have instructed us to deliver.

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. This DPA does not increase or expand those limits, and nothing in this DPA limits any liability that cannot be limited under applicable law.

This DPA takes effect when you accept the Terms of Service and remains in force for as long as Susanoo processes Client Personal Information on your behalf. The sections that by their nature should survive, including Retention, Return, and Deletion, Confidentiality, and Liability, survive termination.

If you are located in Canada, this DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in that province, and the parties attorn to the courts of Ontario. If you are located in the United States, this DPA is governed by the laws of the State in which your principal place of business is located or, if you are an individual not acting for a business, the State in which you reside, without regard to its conflict of laws rules, and the parties submit to the state and federal courts located in that State. This DPA does not contain an arbitration clause and does not require you to arbitrate any dispute.

Susanoo may update this DPA to reflect changes in the Services, in its Sub-processors, or in Privacy Laws. Where a change materially reduces your rights or Susanoo's obligations, Susanoo will give you notice before it takes effect.

Questions about this DPA, about how Susanoo processes Client Personal Information, or requests to exercise any right under it, can be sent to privacy@susanoo.ai, or by mail to Susanoo Inc., 100 King Street West, Suite 5700, Toronto, ON M5X 1C7.

Subject matter. Delivery of the Services under the Terms of Service, being the operation of customer communication, follow-up, booking, invoicing, and reputation workflows on the Client's behalf, and the building, hosting, and operation of Custom Software that holds the Client's business records.

Duration. For the term of the Terms of Service, plus the retention period described in section 11.

Nature and purpose of processing. Collection, recording, organization, storage, retrieval, consultation, use, transmission, disclosure to Sub-processors, erasure, and destruction of Client Personal Information, for the purpose of answering and routing communications, responding to and following up with leads, scheduling and confirming appointments, sending service and reminder messages, issuing and following up on invoices, requesting and managing reviews, and maintaining the Client's customer records.

Categories of individuals. The Client's customers, prospective customers, leads, contacts, appointment attendees, and the Client's own personnel who use the platform, and the Client's staff and contractors whose records the Client keeps in Custom Software (for example scheduling, hours, and pay records).

Categories of personal information. Identifiers such as name, telephone number, email address, and postal address; communication content and metadata, including call recordings and transcripts where the Client has enabled them, text messages, emails, chat messages, and form submissions; appointment and scheduling information; transaction and invoicing information; review and reputation information; marketing preferences and consent records; and technical information such as IP address and device information collected through the Client's connected properties.

Special categories. None are requested or required. The Client is asked not to submit them without a written agreement on additional safeguards, as set out in section 4.

Susanoo relies on the security measures of its platform provider together with its own operational controls. These include:

a) encryption of Client Personal Information in transit and at rest;

b) role-based access control, with access limited to personnel who need it to deliver the Services, and removal of access when it is no longer needed or when an engagement ends;

c) multi-factor authentication on administrative accounts;

d) written confidentiality obligations for personnel with access to Client Personal Information;

e) logical separation of each client's data within the platform;

f) logging and monitoring of administrative activity within the platform;

g) a documented process for identifying, escalating, containing, and remediating a Personal Data Breach, including the register of Confidentiality Incidents described in section 9;

h) contractual data protection obligations with each Sub-processor; and

i) deletion or anonymization of operational data in accordance with section 11.

• Sub-processor: LeadConnector LLC (GoHighLevel)
• Purpose: The underlying platform: CRM, scheduling, telephony, messaging, tracking, AI agents, and automation
• Client Personal Information involved: All categories in Annex 1
• Processing location: United States

• Sub-processor: Supabase, Inc.
• Purpose: Databases, sign-in, and file storage for Custom Software
• Client Personal Information involved: The Client's records held in Custom Software, including identifiers and the scheduling, hours, and pay records described in Annex 1
• Processing location: Canada

• Sub-processor: Netlify, Inc.
• Purpose: Hosting for Custom Software and websites
• Client Personal Information involved: Technical information such as IP address and device information, and the information passing through the hosted Custom Software
• Processing location: United States

• Sub-processor: Resend
• Purpose: Email sent by Custom Software
• Client Personal Information involved: Names and email addresses of recipients, and the content of those emails
• Processing location: United States

• Sub-processor: Functional Software, Inc. (Sentry)
• Purpose: Error monitoring for Custom Software
• Client Personal Information involved: Technical information in error reports, such as IP address, device information, and the page address
• Processing location: United States

• Sub-processor: Google LLC (Google Maps Platform)
• Purpose: Address suggestions in Custom Software, where enabled
• Client Personal Information involved: The address text typed into the address field
• Processing location: United States

• Sub-processor: Cloudflare, Inc. (Turnstile)
• Purpose: Checks that tell people from automated traffic on Custom Software sign-in pages, where enabled
• Client Personal Information involved: IP address and device information
• Processing location: United States

Susanoo also engages payment, communications, and information technology providers that may incidentally process Client Personal Information in the course of supporting the Services. Susanoo will give notice of a change to this list in accordance with section 7.