Data Processing Agreement

1. Parties, incorporation and priority

This DPA addresses processing by InnuCloud Experts Inc. (“Processor”) on behalf of the Customer identified in the applicable subscription or services agreement (“Controller”). InnuCloud’s address is 2020 Trans-Canada Hwy, Dorval, Montreal, QC H9P 2N4, Canada; privacy contact: info@innucloud.com.

The DPA forms part of the parties’ agreement when incorporated or executed under that agreement. An executed customer DPA prevails over this public presentation. For conflicts about personal-data processing, the applicable DPA prevails over general commercial terms; mandatory law and applicable transfer clauses remain controlling.

2. Roles and documented instructions

The Customer determines purposes, lawful grounds, notices, permissions and authorized recipients. InnuCloud processes personal data only on documented instructions to provide, maintain, secure and support the agreed Service, including authorized transfers, unless applicable law requires otherwise. Where legally permitted, we inform the Customer of such a requirement before processing.

InnuCloud informs the Customer if, in its opinion, an instruction infringes applicable data-protection law. Processing outside the customer’s instructions is not authorized merely by a general reference to product improvement. InnuCloud does not sell the personal data it processes for the Customer.

3. Processing description — Annex I

Subject and duration

Operation of MigiHub during the agreement and the applicable return, deletion or legally required retention period.

Activities

Collection on instruction, hosting, storage, organization, retrieval, transmission, authorized disclosure, support, security review and deletion.

Individuals

Customer administrators, employees, contractors, interpreters, applicants, clients, service recipients and other people whose information is lawfully submitted.

Data categories

Identity/contact details; accounts and permissions; professional, HR and qualification records; projects, bookings, assignments, schedules, time, expenses, approvals and signatures; communications and audit metadata; customer-uploaded files; optional location and integration data.

Sensitive data

Only where necessary, lawful and agreed with appropriate safeguards. Do not upload health details, government identifiers or unrelated sensitive material simply because a field allows it.

Transfer frequency

As required to deliver the configured Service. Exporter, importer, relevant establishment and competent authority must be identified in the applicable executed transfer annex.

4. Personnel and confidentiality

Access is limited to personnel authorized for their duties and bound by confidentiality obligations. We apply least privilege, role-based permissions and access review appropriate to the service. The Customer remains responsible for its own user provisioning and permissions.

5. Security measures — Annex II

Technical and organizational measures are proportionate to processing risks and include, as applicable:

• Security governance, personnel awareness and confidentiality.
• Identity and session controls, SSO support, role-based access and restricted administrative access.
• TLS in transit, encryption for designated production stores and restricted key/secrets access.
• Secure development, code review, dependency and vulnerability management, patching and configuration hardening.
• Logical customer separation, data minimization and restricted non-production use.
• Audit trails, monitoring, alerting and incident-response procedures.
• Protected backups, restoration procedures and continuity planning.
• Supplier due diligence and contractual data-protection controls.

The agreed security schedule specifies the applicable implementation and any additional assurance requirements. No certification or fixed recovery target is created by this public list.

6. Subprocessors — Annex III

Subject to the applicable agreement, the Customer grants general authorization to use subprocessors for infrastructure/storage, communications delivery, support and error monitoring, and service-security telemetry. The current named list, purposes and relevant locations are available on request; categories alone are not a complete vendor register.

We impose data-protection obligations no less protective than the applicable DPA and remain responsible as required by law. We give advance notice of intended additions or replacements and allow reasonable data-protection objections under the agreement. Customer-selected independent integrations must be assessed according to their actual role; they are not automatically InnuCloud subprocessors.

7. Rights, assessments and incidents

Taking account of the processing and information available to us, we reasonably assist with individual-rights requests, impact assessments, consultations and the Customer’s security obligations. Requests received directly are routed to the responsible Customer unless law requires another response.

We notify the Customer without undue delay after becoming aware of a personal-data breach and provide available information about its nature, affected categories, likely consequences, mitigation and contact point. Information may be supplied in stages. The Customer remains responsible for its own regulator and individual notifications.

8. International transfers

A transfer must use a valid mechanism applicable to the actual parties, data and destination. Where an adequacy decision does not cover the transfer, the applicable EU Standard Contractual Clauses and supplementary measures may be required. UK transfers may use the UK IDTA or the UK Addendum to the EU SCCs; Swiss transfers require appropriate Swiss adaptations.

The applicable transfer clauses and completed annexes must be incorporated into the agreement. A reference on this website alone does not execute them. See International Transfers & DPF.

9. Records and audits

We maintain relevant processing records and provide information reasonably necessary to demonstrate compliance. Audits use available documentation and independent reports where appropriate, with confidentiality, security and non-disruption protections.

Unless mandatory law, an applicable transfer clause or a signed agreement requires otherwise, customer audits are on reasonable notice during business hours, normally no more than once in 12 months, with additional review following a confirmed breach where justified. Audit limits must not prevent legally required oversight.

10. Return, deletion and remaining terms

At the end of the Service, personal data is returned or deleted at the Customer’s choice as provided in the applicable DPA. Under the published 90-day arrangement, the Customer submits written instructions promptly so export in a common machine-readable format and deletion can be addressed within 90 days after termination or expiry. A signed DPA may specify a different period and prevails.

Legally required retention and protected backups awaiting scheduled overwrite are exceptions; access remains restricted and the data is not reused for unrelated purposes. Liability, governing law and general contractual provisions follow the agreement, without overriding mandatory data-protection law or applicable transfer clauses. Contact us to obtain an execution-ready DPA and complete the required annexes.