Data Processing Addendum

This addendum applies when Jagassar Group (“Jagassar”, “we”) handles personal information about your customers or visitors on behalf of your business (“you”, the client). It forms part of your agreement with us and our Terms of Service, and applies automatically while we provide those services. If your written agreement with us has its own data terms, those win where they differ.

1. Roles

You decide why and how your customers’ information is used and you remain responsible for it under privacy law. We handle it only to provide the services you’ve asked for. In the language of Canada’s privacy law (PIPEDA), you are the organization in control of the information and we process it on your behalf.

2. What’s covered

This addendum covers personal information we receive through services we run for you, such as:

• Bookings: your customers’ names, emails, time zones, guests and answers to your booking questions.
• Leads and form submissions: names, contact details and messages people send through forms we run for you.
• Files and records containing customer information that you upload to the portal.
• Personal information on websites we build or host for you, including through Studio.

It doesn’t cover information about you and your staff as our client (such as your portal account); our Privacy Policy covers that.

3. How we handle it

• We use it only to provide the services, follow your reasonable written instructions, or as the law requires.
• We don’t sell it or use it for our own marketing.
• Only people who need it to do their work can access it, and they must keep it confidential.
• We protect it with safeguards suited to how sensitive it is, including encrypted connections, access controls and encryption of stored calendar keys.

4. Service providers

You agree that we may use these service providers to deliver the services:

• Cloudflare, Inc.: Runs our websites, portal and Studio, stores our data and files, protects forms from spam, and counts visits. (United States, with servers worldwide)
• Resend, Inc.: Sends our emails: sign-in links, booking confirmations and reminders, and notifications. (United States)
• Google LLC: Calendar and video calls, when a host connects Google Calendar to booking. (United States)
• Anthropic, PBC: The AI provider behind Studio. It processes what you type into Studio and the site it builds. (United States)

Each is bound to protect the information and use it only to provide its service. We’ll update this list before adding or replacing a provider. If you have a reasonable privacy objection to a new provider, tell us and we’ll work with you on an alternative, or you may stop using the affected service.

5. Outside Canada

Our service providers are based in the United States and may store or process information there and elsewhere. You’re responsible for telling your customers about this in your own privacy notice. We’re happy to help with the wording.

6. Your customers’ requests

If one of your customers asks us to see, correct or delete their information, we’ll pass the request to you and won’t answer it ourselves unless you ask us to. We’ll help you respond within the time the law requires.

7. Breaches

If we learn of a breach of security safeguards affecting your customers’ information, we’ll tell you without undue delay with what we know, and keep you updated. We’ll help you assess whether it creates a real risk of significant harm and with any notices you must give to affected people or the Privacy Commissioner.

8. Your responsibilities

• Have a privacy notice for your customers and the consent you need to collect their information.
• Only ask us to collect information you need, and don’t send us sensitive information (such as health or financial details) unless we’ve agreed to handle it.
• Keep your portal access limited to the right people.

9. Information and checks

On reasonable request, we’ll answer your questions about how we protect your customers’ information and give you the information you need to show you’re meeting your obligations.

10. When the service ends

When our services to you end, we’ll give you a copy of your customers’ information on request, then delete it within 90 days, except where the law requires us to keep it. Backups are overwritten on their normal cycle.

Contact

kyle@jagassar.ca, or Jagassar Group, 1855 Ness Ave, Unit 4, Winnipeg, MB R3J 0Y5.