RENEWTRACK DATA PROCESSING ADDENDUM

This Data Processing Addendum (the "DPA") forms part of the RenewTrack Enterprise Subscription Terms published at https://www.renewtrack.com/enterpriseterms (the "Agreement") between RenewTrack Solutions Inc. ("RenewTrack") and the customer identified in an Order ("Customer"). Capitalized terms used but not defined here have the meanings given in the Agreement.

This DPA applies where RenewTrack processes Customer Personal Information in providing the Services. Where this DPA conflicts with any other part of the Agreement, this DPA prevails in respect of the processing of Customer Personal Information.

1. DEFINITIONS

1.1 "Applicable Privacy Law" means each law relating to the protection of personal information that applies to a Party in connection with the Services, including the Personal Information Protection and Electronic Documents Act (Canada), provincial privacy legislation in Canada, and United States state privacy legislation including the California Consumer Privacy Act as amended.

1.2 "Customer Personal Information" means personal information contained in Customer Data that RenewTrack processes on Customer’s behalf in providing the Services.

1.3 "Personal Information" means information about an identifiable individual, and includes "personal data" and "personal information" as those terms are defined in Applicable Privacy Law.

1.4 "Processing" means any operation performed on Personal Information, including collection, recording, storage, use, disclosure, transfer, retention and deletion.

1.5 "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Information.

1.6 "Sub-processor" means a third party RenewTrack engages to process Customer Personal Information on its behalf.

2. ROLES AND SCOPE

2.1 Roles. As between the Parties, Customer determines the purposes and means of processing Customer Personal Information and is the controller, and, where the California Consumer Privacy Act applies, the business. RenewTrack processes Customer Personal Information on Customer’s behalf and is the processor, and, where that Act applies, the service provider.

2.2 Customer Account Data. RenewTrack is an independent controller of Customer Account Data as defined in the Agreement, and processes it in accordance with its privacy policy published at https://www.renewtrack.com/privacy This DPA does not apply to Customer Account Data.

2.3 Customer’s Responsibilities. Customer is responsible for the accuracy and legality of Customer Personal Information, for having a lawful basis to collect and use it, for providing any notices and obtaining any consents Applicable Privacy Law requires, and for configuring access permissions within its tenant appropriately.

2.4 Details of Processing. The subject matter, duration, nature, purpose, categories of individuals and categories of Personal Information are set out in Annex A.

3. RENEWTRACK’S OBLIGATIONS

3.1 Instructions. RenewTrack will process Customer Personal Information only to provide, secure and support the Services in accordance with the Agreement, on Customer’s documented instructions, and as required by law. If RenewTrack is required by law to process Customer Personal Information otherwise, it will notify Customer before doing so unless the law prohibits that notice.

3.2 No Sale or Sharing. RenewTrack will not sell Customer Personal Information, will not share it for cross-context behavioural advertising, and will not retain, use or disclose it for any purpose other than performing the Services or as Applicable Privacy Law otherwise permits a service provider to do.

3.3 No Combining. RenewTrack will not combine Customer Personal Information with personal information it receives from any other customer or from any other source, except as necessary to perform a business purpose Applicable Privacy Law expressly permits.

3.4 Personal Information Stays in the Tenant. Customer Personal Information is held within Customer’s tenant. RenewTrack does not extract Customer Personal Information from the tenant for its own purposes, and does not use Customer Personal Information to produce Aggregated Insights or any other cross-customer analytics.

3.5 Confidentiality. RenewTrack will ensure that personnel authorized to process Customer Personal Information are bound by appropriate confidentiality obligations and have received appropriate training, and will limit access to those who need it to perform the Services.

3.6 Certification. RenewTrack certifies that it understands and will comply with the restrictions in Sections 3.1 to 3.4.

4. SECURITY

4.1 RenewTrack will implement and maintain appropriate technical and organizational measures to protect Customer Personal Information against a Security Incident, taking into account the state of the art, the costs of implementation, and the nature, scope and purposes of processing. Those measures are described in Annex B.

4.2 RenewTrack may update the measures in Annex B from time to time, provided that it does not materially reduce the overall level of protection.

4.3 Customer is responsible for its own use of the security features the Services make available, including access control configuration, permission review, and the security of credentials issued to its Authorized Users.

5. SECURITY INCIDENTS

5.1 RenewTrack will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Information.

5.2 The notification will describe, to the extent known, the nature of the incident, the categories and approximate volume of Personal Information affected, the likely consequences, and the measures taken or proposed. Where information is not available at the time of notification, RenewTrack will provide it as it becomes available.

5.3 RenewTrack will take reasonable steps to contain and remediate the incident and will provide Customer with the assistance Customer reasonably requires to meet its own notification and record-keeping obligations under Applicable Privacy Law.

5.4 Where Customer purchased through a Reseller, RenewTrack may provide notification to the Reseller in addition to Customer.

5.5 RenewTrack’s notification is not an acknowledgement of fault or liability.

6. SUB-PROCESSORS

6.1 Customer authorizes RenewTrack to engage the Sub-processors listed in Annex C.

6.2 RenewTrack will impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remains responsible to Customer for the performance of each Sub-processor’s obligations.

6.3 RenewTrack will give Customer at least thirty (30) days’ notice before adding or replacing a Sub-processor that processes Customer Personal Information. Customer may object on reasonable data protection grounds within that period. If the Parties cannot resolve the objection, Customer may terminate the affected Subscription and receive a refund of prepaid Fees for the unexpired portion of the Subscription Term.

6.4 Customer may subscribe to notifications of Sub-processor changes by writing to privacy@renewtrack.com.

7. LOCATION OF PROCESSING

7.1 Customer Personal Information is hosted in Canada, in Amazon Web Services region ca-central-1, across multiple availability zones.

7.2 RenewTrack will not transfer Customer Personal Information outside Canada for hosting without giving Customer at least thirty (30) days’ notice and the opportunity to object under Section 6.3.

7.3 RenewTrack personnel located in Canada may access Customer Personal Information remotely for support and administration purposes, subject to the access controls described in Annex B.

7.4 Traffic to the RenewTrack application at app.renewtrack.com is not proxied through a content delivery network. Customer Personal Information does not transit or reside on Cloudflare’s network.

8. ASSISTANCE AND INDIVIDUAL RIGHTS

8.1 The Services provide functionality that allows Customer to access, correct, export and delete Customer Personal Information within its tenant. Customer will use that functionality to respond to requests from individuals in the first instance.

8.2 Where Customer cannot respond to a request using that functionality, RenewTrack will provide reasonable assistance, to the extent Applicable Privacy Law requires and permits, taking into account the nature of the processing and the information available to RenewTrack.

8.3 If RenewTrack receives a request directly from an individual concerning Customer Personal Information, it will not respond substantively, and will refer the individual to Customer and notify Customer promptly.

8.4 RenewTrack will provide Customer with reasonable assistance in conducting a privacy impact assessment or in consulting a regulator, where Applicable Privacy Law requires that of a processor.

9. AUDIT AND INFORMATION

9.1 On written request, and no more than once in any twelve (12) month period unless Applicable Privacy Law or a Security Incident requires otherwise, RenewTrack will provide Customer with the information reasonably necessary to demonstrate compliance with this DPA. RenewTrack may satisfy this obligation by providing a current third-party audit report, security certification, or completed security questionnaire.

9.2 Where the information provided under Section 9.1 is not sufficient to demonstrate compliance, Customer may request an audit. Any audit will be at Customer’s expense, on at least thirty (30) days’ notice, during business hours, subject to reasonable confidentiality and security requirements, and conducted so as not to unreasonably disrupt RenewTrack’s operations. An auditor must not be a competitor of RenewTrack.

10. RETENTION, RETURN AND DELETION

10.1 RenewTrack retains Customer Personal Information for as long as Customer maintains it in its tenant. Customer controls retention within its tenant and may delete Customer Personal Information at any time using the functionality the Services provide.

10.2 On expiry or termination of the Subscription Term, Section 6.9 of the Agreement governs export and deletion. RenewTrack will delete Customer Personal Information following the export period, except to the extent applicable law requires it to be retained.

10.3 Copies held in routine backups will be deleted in accordance with RenewTrack’s backup retention schedule, and remain subject to this DPA until deleted.

11. GENERAL

11.1 Liability. Each Party’s liability under this DPA is subject to the exclusions and limitations set out in Section 11 of the Agreement.

11.2 Term. This DPA takes effect when the Agreement does and continues until RenewTrack has ceased all processing of Customer Personal Information.

11.3 Changes. RenewTrack may update this DPA in accordance with Section 14.12 of the Agreement, provided that no update will reduce the protections afforded to Customer Personal Information. The current version is published at https://www.renewtrack.com/dpa

11.4 Governing Law. This DPA is governed by the law stated in Section 14.1 of the Agreement.

ANNEX A — DETAILS OF PROCESSING

Subject matter. Provision of the RenewTrack renewal tracking and alerting Services.

Duration. The Subscription Term, plus the export and deletion periods described in Section 10.

Nature and purpose. Hosting, storage, organization, retrieval, display and deletion of records Customer maintains in its tenant; generation of alerts and notifications derived from dates recorded in those records; provision of support.

Categories of individuals. Customer’s personnel and Authorized Users; individuals named by Customer as internal owners of tracked contracts; individuals named by Customer as vendor or supplier contacts.

Categories of Personal Information. Name, business email address, business telephone number, job title, employer, and role assignments; authentication and audit records associated with Authorized Users.

Sensitive Personal Information. None. The Acceptable Use Policy prohibits Customer from submitting special categories of sensitive personal information to the Services without RenewTrack’s written agreement.

Frequency. Continuous for the duration of the Subscription Term.

ANNEX B — TECHNICAL AND ORGANIZATIONAL MEASURES

The measures described below are those in place as at the version date of this DPA. RenewTrack may update them in accordance with Section 4.2.

Encryption in transit. Customer Personal Information is encrypted in transit using TLS 1.2 or higher.

Encryption at rest. Customer Personal Information is encrypted at rest.

Authentication. Multi-factor authentication is required for personnel access to production systems.

Access control. Access to production systems and to customer tenants is granted on a role basis and limited to personnel who require it. Access is revoked when RenewTrack becomes aware that an individual no longer requires it, including on departure from RenewTrack or from a customer organization.

Tenant isolation. Customer Data is logically separated so that a customer can access only its own tenant.

Resilience. The Services are deployed across multiple availability zones. Database backups are taken automatically on a scheduled basis.

Vulnerability handling. Vulnerabilities identified in the Services or their dependencies are triaged and prioritized according to severity.

Change management. Changes to application code are reviewed before release, and releases can be rolled back.

Sub-processor assessment. Sub-processors are assessed before engagement and are bound by written data protection obligations.

Hosting. Customer Personal Information is hosted in Canada as described in Section 7.

ANNEX C — SUB-PROCESSORS

Amazon Web Services, Inc. — cloud infrastructure hosting — Canada (ca-central-1).

Publication action required[COMPLETE BEFORE PUBLICATION. Add every third party that processes Customer Personal Information on RenewTrack’s behalf, with the processing purpose and location. Likely candidates include transactional and alert email delivery, error and performance monitoring, and customer support tooling. Cloudflare is not listed because the application is not proxied through it and Customer Personal Information does not transit its network; if that changes, Cloudflare must be added.]

Privacy enquiries: privacy@renewtrack.com. Attention: Privacy Officer, RenewTrack Solutions Inc., 901 King Street West, Suite 400, Toronto, Ontario M5V 3H5.