Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between Zivly Technologies Inc. (“Zivly,” the “Processor”) and each Merchant subscribing to the Zivly platform (the “Controller”).

This DPA is required because Zivly processes personal information of the Merchant's end customers on behalf of the Merchant to provide the platform services. The Merchant determines the purposes and means of processing Client data (data controller under PIPEDA). Zivly processes Client data under the Merchant's direction (data processor).

1. Definitions

2. Allocation of Roles

The Merchant is the data controller with respect to Client Data. The Merchant determines why and what Client Data is collected (via platform configuration). The Merchant is primarily responsible for compliance with PIPEDA and applicable provincial privacy legislation regarding Client Data.

Zivly is the data processor with respect to Client Data. Zivly processes Client Data only as directed by the Merchant through their use of the Platform and as necessary to provide the platform services. Where Zivly processes data about Merchants and staff for Zivly's own purposes (billing, support, improvement), Zivly acts as data controller for such data, governed by the Privacy Policy.

3. Zivly's Processing Obligations

As data processor, Zivly will:

• Process Client Data only in accordance with the Merchant's documented instructions and only as necessary to provide the Platform services;
• Not process Client Data for any independent purpose, except where required by applicable Canadian law, in which case Zivly will inform the Merchant before processing (unless prohibited by law);
• Implement and maintain appropriate technical and organizational security measures to protect Client Data (see Section 7);
• Ensure all Zivly personnel authorized to process Client Data are subject to binding confidentiality obligations;
• Not engage new sub-processors without providing 14 days' advance written notice to the Merchant;
• Assist the Merchant, to the extent technically feasible, in responding to Client requests under PIPEDA to access, correct, or delete their Personal Information;
• Notify the Merchant without undue delay (and within 72 hours where feasible) upon becoming aware of a confirmed Data Breach affecting Client Data;
• Upon termination of Merchant's account, delete or return Client Data as directed, subject to legal retention obligations;
• Upon reasonable written request, provide information necessary to demonstrate compliance with this DPA (see Section 9).

4. Merchant's Obligations as Data Controller

As data controller, Merchant will:

• Ensure it has a valid lawful basis under PIPEDA for collecting and processing Client Data, including obtaining any required consents;
• Provide Clients with a clear, accessible privacy notice describing how their data is collected and used, including that it flows through the Zivly platform;
• Obtain valid CASL consent from Clients before using Zivly's communication tools to send commercial electronic messages;
• Respond to Client requests to access, correct, or delete their Personal Information under PIPEDA;
• Notify the Office of the Privacy Commissioner of Canada and affected Clients of any Data Breach as required under PIPEDA's mandatory breach reporting provisions;
• Comply with all applicable privacy, data-protection, anti-spam, and consumer-protection legislation in all provinces where the Merchant operates;
• Ensure all instructions given to Zivly regarding processing of Client Data comply with applicable law.

5. Authorized Sub-Processors

Merchant authorizes Zivly to engage the following sub-processors. All are contractually required to maintain data-protection standards equivalent to this DPA:

Zivly will provide at least 14 days' written notice before adding new sub-processors that will process Client Data. If Merchant objects on legitimate grounds, the parties will work in good faith to find a resolution. If no resolution is possible within 30 days, Merchant may terminate their account without early-termination penalty.

6. International Data Transfers

Several sub-processors are located outside Canada. Where Client Data is transferred outside Canada, Zivly ensures transfers are governed by data-processing agreements imposing equivalent obligations, and that each sub-processor maintains appropriate security certifications. Merchant's acceptance of this DPA constitutes consent to such transfers for the purpose of delivering platform services.

7. Security Measures

Zivly implements and maintains:

• Encryption in transit: TLS 1.2 or higher (HTTPS) for all data transmitted between users and Zivly's servers;
• Encryption at rest: Client Data stored in DigitalOcean's managed database and object storage is encrypted at rest;
• Application-layer encryption: Sensitive form inputs encrypted at the application level before storage;
• Access controls: Role-based controls limiting Client Data access to authorized Merchant staff only; Zivly personnel access Client Data only where required for support, security, or legal compliance;
• Authentication: Firebase Authentication with multi-factor authentication support for Merchant accounts;
• Monitoring and logging: Ongoing error monitoring via PostHog, application-level logging, and infrastructure alerting;
• Physical security: DigitalOcean's Toronto data center with ISO 27001 and SOC 2 Type II certifications.

Zivly regularly reviews and updates its security measures. Merchants may request a security summary by contacting [email protected].

8. Data Breach Notification

Upon becoming aware of a confirmed Data Breach affecting Client Data, Zivly will: (a) notify the affected Merchant without undue delay (within 72 hours where feasible); (b) provide available information about the nature of the breach, categories and approximate number of affected individuals, and categories of Client Data involved; (c) describe measures taken or proposed to address the breach; and (d) keep the Merchant updated on material developments.

The Merchant remains solely responsible for: assessing whether the breach triggers mandatory PIPEDA reporting obligations; notifying affected Clients and the Office of the Privacy Commissioner; and maintaining breach records as required by PIPEDA. Zivly's notification obligation is triggered only upon discovery of a confirmed breach.

9. Audit Rights

Upon reasonable written request (no more than once per calendar year, except following a Data Breach), Zivly will provide documentation demonstrating DPA compliance, including: a summary of current security measures, the sub-processor list, and a description of the breach-notification process. On-site audits require 30 days' advance notice, are subject to Zivly's security and confidentiality requirements, and are at the Merchant's cost.

10. Retention and Deletion of Client Data

Upon termination, Zivly retains Client Data for 90 days for export purposes. After 90 days (or earlier on Merchant's written request), Client Data is deleted or irreversibly anonymized from active systems. Zivly may retain transaction records and system logs for up to 7 years as required by Canadian tax and audit law. Backup copies may persist for up to 90 days following deletion from active systems. Zivly will confirm deletion in writing upon request. For a plain-language walkthrough of exporting your data and what happens if you stop paying or close your account, see Your Data: Security, Export, and What Happens If You Cancel.

11. Limitation of Liability

Zivly's liability under this DPA is subject to the limitations in the Terms and Conditions. Zivly is not liable for breaches arising from: (a) Merchant instructions that conflict with applicable law; (b) unauthorized access caused by the Merchant's failure to implement reasonable account security; or (c) independent acts or failures of sub-processors, though Zivly will cooperate with the Merchant to pursue available remedies.

12. Governing Law

This DPA is governed by the laws of Ontario and federal laws of Canada. Disputes are subject to the dispute-resolution provisions in the Terms and Conditions.

13. Contact

Privacy and data-processing inquiries: [email protected]  ·  General support: [email protected]

© 2026 Zivly Technologies Inc. All rights reserved.