Data Processing Agreement

Helium Agency Inc.’s commitments when it processes, on behalf of your organization, the personal information entrusted to GENSY.EMAIL.

This agreement (the “DPA”) governs the processing of personal information that Helium Agency Inc. (“Gensy”, “we”) carries out on behalf of the client (the “Client”) as part of the GENSY.EMAIL service (the “Service”). It forms an integral part of the Terms of Use and applies automatically to every Client, with no separate signature required. A signed copy is available on request at vincent@gensy.email.

Capitalised terms not defined here have the meaning given in the Terms of Use.

1. Roles of the parties

The Client is the person responsible for the personal information it entrusts to the Service (within the meaning of Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, and of the federal Personal Information Protection and Electronic Documents Act). Gensy acts as a service provider: we process that information solely to operate the Service, on the Client’s instructions, and never for our own purposes.

The Client’s instructions consist of the Terms of Use, this DPA, and the actions the Client takes in the application (importing staff, enabling the portal, enabling usage tracking, deploying signatures). If we believe an instruction breaches applicable law, we will inform the Client and may suspend its execution.

2. Subject matter, duration and categories

Subject matter and duration — creating, managing and deploying email signatures, for the term of the Client’s subscription and until its account is deleted.

Categories of individuals: the Client’s users and the staff members whose signature is managed.

Categories of information:

• professional identity and contact details: name, title, email address, phone numbers, department;
• photograph or avatar, logo and brand elements;
• custom fields defined by the Client;
• account data: email address, language, authentication log;
• where tracking is enabled by the Client — off by default: each open and each click, attached to the staff member concerned, with the address of the clicked link, the device type, the mail client and the timestamp, which the Client views per staff member; no cookie, no IP address and no data identifying the recipient. Disabling tracking stops measurement immediately.

The Service is not designed for sensitive information (health, biometric data, financial information about individuals) or for information about minors. The Client undertakes not to import any.

3. Confidentiality and personnel

Gensy limits access to the Client’s personal information to those who need it to operate the Service. Those individuals are bound by a confidentiality obligation that survives the end of their engagement.

Support access. Gensy personnel have no standing access to Client workspaces. Support access is named, limited to 72 hours, logged, visible to the Client in its workspace, and expires automatically.

4. Security measures

Gensy implements and maintains the following measures, among others:

• encryption in transit (TLS) and at rest for databases and file storage;
• separate application-level encryption of the Client’s access tokens for third-party services (Google, Microsoft);
• workspace isolation enforced at the database level, so that one client cannot reach another’s data;
• two-factor authentication available, and required for Gensy administrative access;
• logging of sensitive actions and of support access;
• periodic security reviews of code and configuration, with remediation according to severity.

These measures may evolve, but never so as to reduce the agreed level of protection.

5. Subprocessors

The Client authorises Gensy to use the subprocessors listed on the Subprocessors page, which states each one’s function, the categories of information entrusted to it and its hosting country. Each subprocessor is bound by protection obligations at least equivalent to those in this DPA.

Gensy announces any addition or replacement of a subprocessor at least thirty (30) days before it goes live, by email to the workspace owner and by updating that page. A Client who objects on reasonable data-protection grounds may, within that period, terminate its subscription without penalty and receive a pro-rata refund of the period paid in advance.

6. Location of processing and transfers outside Quebec

Service data is hosted in the United States: the database, authentication and file storage are operated by our provider in the AWS us-east-1 region (Northern Virginia). The other subprocessors are established in, or operate from, the United States, as set out on the Subprocessors page, which gives each one’s location.

It follows that any use of the Service involves a communication of personal information outside Quebec. The Client is informed of this by this DPA and by the Privacy Policy (§7), and may inform the individuals concerned accordingly.

In accordance with section 17 of Law 25, Gensy has carried out a privacy impact assessment covering these communications — sensitivity of the information, purpose of its use, technical and contractual protection measures, and the legal regime applicable in the receiving state. That assessment is kept up to date whenever a subprocessor is added or removed, and is made available to the Client on request. Gensy undertakes to use a subprocessor established outside Quebec only under a written agreement providing for confidentiality and protection commitments that meet the requirements of Law 25.

7. Rights of individuals

The Client retains control over its staff’s information and may, at any time and without our involvement, view, correct, export and delete it from the application.

If an individual contacts Gensy directly, we do not answer on the Client’s behalf: we forward the request to the Client without unreasonable delay and assist it, as needed, in responding within statutory timeframes. That assistance is provided free of charge unless its volume becomes manifestly disproportionate.

8. Confidentiality incidents

Gensy maintains a register of confidentiality incidents, as required by Law 25.

In the event of an incident involving the Client’s personal information, Gensy will inform the Client without delay and no later than 72 hours after becoming aware of it, at the workspace owner’s address. The notice describes the nature of the incident, the information involved, the individuals likely to be affected, the measures taken and those the Client may take. Gensy assists the Client in assessing the risk of serious injury and, where applicable, in making its own notifications to the Commission d’accès à l’information, the federal Privacy Commissioner and the individuals concerned. Making those notifications is the Client’s responsibility as the person responsible for the information.

9. Retention and destruction

The retention periods applied automatically by the Platform are detailed in section 9 of the Privacy Policy. In summary: usage statistics 13 months; audit and API-call logs 90 days; support requests 12 months; artificial-intelligence feature logs 12 months; staff data until deleted by the Client.

At the end of the subscription, the Client may export its data from the application. Deleting the account destroys the personal information in the relevant workspaces immediately and permanently; infrastructure backups are purged on our host’s cycle, within a maximum of 30 days.

10. Verification

On reasonable written request, and at most once every twelve (12) months, Gensy will provide the Client with the information needed to demonstrate compliance with this DPA: a description of its security measures, an up-to-date list of subprocessors, and responses to a reasonable security questionnaire.

On-site audits are not provided for; they may be agreed separately, at the Client’s expense, in the event of a confirmed confidentiality incident affecting it or where an authority requires one.

11. Miscellaneous

In the event of a conflict between this DPA and the Terms of Use on a data-protection matter, this DPA prevails. It is governed by the law applicable in Quebec, and any material change is announced in the manner set out in the Terms.

12. Contact

Privacy Officer — Helium Agency Inc., 1640 rue Guillaume-Renaud, Québec (Quebec) G2K 0H7, Canada. vincent@gensy.email