Data Processing Agreement

Effective Date: January 1, 2025

This Data Processing Agreement ("Agreement") is entered into between GrowthSpan Inc. ("Processor", "GrowthSpan", "we", "our") and the client entity that has executed a Master Services Agreement or Statement of Work with GrowthSpan ("Controller", "Client", "you"). This Agreement governs the Processing of Personal Data by GrowthSpan on behalf of the Client pursuant to applicable privacy laws.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable individual that is processed by GrowthSpan on behalf of the Client.

"Processing" means any operation performed on Personal Data, whether automated or not, such as collection, storage, use, transfer, or deletion.

"Subprocessor" means a third party engaged by GrowthSpan to process Personal Data.

2. Scope and Roles

• The Client is the Data Controller and GrowthSpan is the Data Processor.
  
  
• GrowthSpan will process Personal Data only on documented instructions from the Client and only to the extent required to provide the services described in the applicable agreement.
  
  

3. Categories of Data and Data Subjects

Categories of Personal Data may include:

• Contact information (e.g., name, email, phone number, address)
  
  
• Property transaction information
  
  
• Government-issued identifiers (e.g., SIN, license ID)
  
  
• Uploaded personal identification documents
  
  

Data Subjects may include:

• Client employees or staff
  
  
• Client customers and prospects
  
  
• Other individuals interacting with Client systems
  
  

4. Obligations of the Processor

GrowthSpan agrees to:

• Process Personal Data only on the Client's lawful instructions;
  
  
• Maintain the confidentiality of Personal Data;
  
  
• Implement appropriate technical and organizational security measures;
  
  
• Ensure personnel with access to Personal Data are bound by confidentiality obligations;
  
  
• Assist the Client in fulfilling its obligations with respect to data subject requests and regulatory compliance;
  
  
• Notify the Client without undue delay in the event of a data breach.
  
  

5. Subprocessing

• GrowthSpan may engage Subprocessors for hosting, analytics, storage, and support.
  
  
• A list of current Subprocessors is available upon request.
  
  
• GrowthSpan will ensure Subprocessors are bound by obligations equivalent to those in this Agreement.
  
  
• The Client will be notified of any intended changes to Subprocessors and may object on reasonable grounds.
  
  

6. Security

GrowthSpan implements industry-standard security measures, including:

• Data encryption in transit and at rest;
  
  
• Access controls and authentication;
  
  
• Regular vulnerability assessments;
  
  
• Use of reputable cloud infrastructure providers.
  
  

7. Assistance and Cooperation

GrowthSpan will:

• Cooperate with the Client in responding to data subject access, correction, deletion, or portability requests;
  
  
• Support the Client with regulatory inquiries or investigations;
  
  
• Assist in conducting data protection impact assessments, as applicable.
  
  

8. International Transfers

• Personal Data may be processed in jurisdictions outside of the Client’s home country.
  
  
• GrowthSpan will ensure that appropriate safeguards (e.g., contractual clauses) are in place for cross-border transfers.
  
  

9. Data Retention and Deletion

• Personal Data will be retained only as long as necessary to fulfill the purposes of processing or as required by law.
  
  
• Upon termination of services or upon request, GrowthSpan will return or securely delete all Personal Data, except as legally required to retain.
  
  

10. Audit Rights

• The Client may request reasonable information necessary to demonstrate GrowthSpan's compliance with this Agreement.
  
  
• If required by law or contract, the Client may conduct an audit (or use a third-party auditor) with reasonable notice and during business hours.
  
  

11. Liability and Indemnity

• Each party shall be liable for its own acts and omissions.
  
  
• GrowthSpan shall not be liable for damages arising from compliance with Client instructions.
  
  

12. Term and Termination

• This Agreement remains in effect for the duration of GrowthSpan’s processing of Personal Data for the Client.
  
  
• Provisions that by their nature should survive termination shall survive (e.g., confidentiality, security, deletion obligations).
  
  

13. Governing Law

• This Agreement is governed by the laws of the Province of Ontario and applicable federal Canadian laws.
  
  

14. Contact

For questions related to this Agreement:

GrowthSpan Inc.
Email: hello@growthspan.ca
Website: www.growthspan.ca

‍