Data processing agreement
This agreement forms part of the terms of service between Quateria Inc. ("Processor") and the Customer. It applies whenever the Processor handles personal information in Customer Data.
1. Roles
1.1 The Customer is the organization in control of Customer Data and decides why and how it is processed. The Processor is a service provider acting only on the Customer's behalf.
1.2 The Customer's instructions are these terms, the Customer's use and configuration of the Service, and any further written instructions the parties agree.
2. What is processed
| Item | Detail |
|---|---|
| People | The Customer's employees, contractors, volunteers, students and other users |
| Information | Account details, workplace profile, personnel contact and emergency contact details, supervision relationships, performance records, scorecards, credentials and continuing education, competency sign-offs, recognition and the points ledger, rewards, weekly check-ins, policy acknowledgements, poll counts, birthdays people chose to share, fidelity checks, identity cards, supervision feedback and upward ratings, sign-in and activity logs |
| Purpose | Providing, securing and supporting the Service |
| Duration | The subscription, plus the deletion period in the customer data export and deletion policy |
| Excluded | Client or patient health information and other information the acceptable use policy forbids |
3. Processor obligations
The Processor will:
- Process Customer Data only on documented instructions, and tell the Customer if an instruction appears to break the law.
- Make sure everyone who can access Customer Data is bound by confidentiality and has access only as their work needs.
- Keep the security measures in the security policy, and not reduce their overall protection during the term.
- Use only the subprocessors on the subprocessors page, under written terms at least as protective as this agreement, and give 30 days' notice of changes with a right to object.
- Help the Customer answer requests from individuals to access or correct their information, and pass on any request it receives directly within 5 business days.
- Notify the Customer without undue delay, and in any case within 72 hours of confirming a breach of security safeguards affecting Customer Data, with what is known, and keep the Customer updated. The Customer decides whether to notify regulators and individuals; the Processor will provide the information the Customer needs to do so.
- Keep a record of every breach of security safeguards involving Customer Data for at least 24 months.
- Help the Customer with privacy impact assessments, including for transfers outside Quebec or Canada, by providing information about the Service.
- Return and delete Customer Data at the end of the subscription as the deletion policy describes, unless the law requires keeping it.
- Make available the information reasonably needed to show compliance with this agreement, and answer a written security questionnaire once a year. On-site audits may be agreed separately at the Customer's cost.
- Not sell Customer Data, use it for its own purposes, combine it with other data except to provide the Service, or use it to train AI models.
4. Customer obligations
The Customer will:
- Have a lawful basis and give any notices required to collect and use Customer Data, including any written electronic monitoring policy the law requires.
- Keep user roles accurate and remove people who leave.
- Keep excluded information out of the Service.
- Tell the Processor promptly of any concern about how Customer Data is handled.
5. Location and transfers
Customer Data is hosted and processed by the subprocessors listed, in the locations listed, including the United States. The Customer accepts these locations by subscribing, and can review them before every change. Where the Customer is subject to a law that requires a transfer assessment, such as Quebec's Act respecting the protection of personal information in the private sector, the Processor will provide what the assessment needs.
6. Legal requests
If a government or court asks the Processor for Customer Data, the Processor will refer it to the Customer, notify the Customer unless the law forbids it, and disclose only what it is legally compelled to.
7. United States customers
For customers subject to United States state privacy laws, the Processor is a "service provider" or "processor" as those laws define it, and will not retain, use or disclose Customer Data outside the direct business relationship.
8. Order of precedence
If this agreement conflicts with the terms of service on the handling of personal information, this agreement wins.