This Data Processing Agreement (the “Agreement”) forms part of NeXafe’s Terms of Service (the “Terms”) between NeXafe Solutions Corp. (“NeXafe”) and the Customer. It applies to personal information NeXafe processes on the Customer’s behalf in providing the Service. It is the written contract required when a business entrusts personal information to an agent or service provider (Québec Act respecting the protection of personal information in the private sector, s. 18.3). It is accepted with the Terms, without a separate signature. Terms defined in the Terms have the same meaning here.
2.1 Roles. The Customer is the person in charge (controller) of Customer Personal Information. NeXafe acts as its service provider and processes that information on its behalf, as described in Annex I.
2.2 Authorized Purposes. NeXafe processes Customer Personal Information only: (a) to provide, secure and support the Service under the Terms; (b) according to actions taken by Authorized Users in the Service; (c) where required by law, after notifying the Customer if permitted; (d) according to other written instructions agreed by both parties. NeXafe does not sell this information, does not use it for its own commercial or advertising purposes and does not combine it with other information, except to provide the Service.
2.3 Customer Obligations. The Customer: (a) informs the individuals concerned and obtains the required consents, including express consent for Sensitive Information; (b) ensures its instructions comply with Applicable Laws; (c) limits information to what is necessary; (d) responds to requests from individuals as the controller; (e) carries out its own privacy impact assessments and, for any biometric feature, makes the filings required with the Commission d’accès à l’information.
2.4 Non-Compliant Instructions. NeXafe promptly notifies the Customer if it believes an instruction violates Applicable Laws. Such notice is not legal advice.
3.1 Security Measures. NeXafe applies the measures in Annex II, appropriate to the sensitivity of the information. It may update them without reducing the overall level of protection.
3.2 Personnel. People authorized to process Customer Personal Information are bound by a written confidentiality undertaking, have access only where their duties require it and are trained in privacy protection.
3.3 Confidentiality Incidents. As soon as it becomes aware of a Confidentiality Incident, NeXafe: (a) notifies the Customer without undue delay and no later than 72 hours after confirming it; (b) provides, as it becomes available, the information the Customer needs to assess the risk of serious injury, keep its register and notify the Commission d’accès à l’information, other authorities and the individuals concerned: nature of the incident, information and approximate number of individuals affected, likely consequences, measures taken; (c) takes reasonable steps to reduce the risk and prevent recurrence. Notice is sent to the Account Administrator. It is not an admission of liability.
3.4 Customer Responsibilities. The Customer protects its Authorized Users’ credentials, configures their permissions and notifies NeXafe of any suspected compromise of its Account.
4.1 General Authorization. The Customer authorizes NeXafe to use the Subprocessors in Annex III, whose current list is published at nexafe.com.
4.2 Obligations. NeXafe enters into a written contract with each Subprocessor imposing protection obligations at least equivalent to this Agreement. It remains responsible to the Customer for their compliance.
4.3 New Subprocessors. NeXafe publishes the updated list and notifies the Customer by email at least 15 days before authorizing a new Subprocessor, except for emergency replacements. The Customer may object in writing within that period on reasonable data-protection grounds. If no solution is found, the Customer may terminate the affected Service without penalty and receive a refund of prepaid fees for the unused period.
5.1 Locations. Customer Personal Information is hosted and processed in the locations listed in Annex III. NeXafe notifies the Customer under section 4.3 before any change in hosting country.
5.2 Assessment. Before communicating information, NeXafe assesses, with each Subprocessor concerned, whether the information will receive adequate protection, and governs the communication by contract. On request, it provides the Customer with information useful for the Customer’s own privacy impact assessment.
6.1 Information. On reasonable request and no more than once a year, NeXafe provides the Customer with the information needed to demonstrate compliance with this Agreement, including by completing a security questionnaire, subject to a confidentiality undertaking.
6.2 On-Site Audit. Where required by law or an authority, or after a Confidentiality Incident, the Customer may conduct an audit on 30 days’ notice, no more than once every 12 months, during business hours, at its own cost and without disrupting NeXafe’s operations or the confidentiality of other customers.
7.1 Tools. The Service allows the Customer to view, correct, export and delete information to respond to access, rectification and portability requests, at no charge.
7.2 Assistance. Where those tools are not sufficient, NeXafe assists the Customer to a reasonable extent. Significant assistance may be billed according to the Price List, with the Customer’s approval.
7.3 Requests Sent to NeXafe. If an individual contacts NeXafe directly about Customer Personal Information, NeXafe acknowledges receipt, directs the individual to the Customer and forwards the request to the Customer within 5 business days.
7.4 Requests from Authorities. NeXafe refuses any disclosure request that is not legally binding. Faced with a binding request, it invites the authority to contact the Customer, notifies the Customer before disclosure where the law permits and limits disclosure to what is required.
7.5 Assessments. NeXafe provides the information reasonably needed for the Customer’s privacy impact assessments, including on security measures and Subprocessors.
When the subscription ends, Customer Personal Information is returned by export and then destroyed under section 3.5 of the Terms. NeXafe keeps no information after that period unless required by law; information so retained remains protected by this Agreement. NeXafe confirms destruction in writing on request.
NeXafe may use Service Data under section 3.6 of the Terms. Anonymized information is anonymized irreversibly, according to the criteria recognized by Applicable Laws.
10.1 Liability. The parties’ liability under this Agreement is subject to section 11 of the Terms.
10.2 Term. This Agreement applies for as long as NeXafe processes Customer Personal Information.
10.3 Precedence. In case of conflict with the Terms regarding the processing of personal information, this Agreement prevails.
10.4 Governing Law. This Agreement is governed by section 13 of the Terms.
10.5 Acceptance. Accepting the Terms constitutes acceptance of this Agreement. A countersigned copy is provided on request at support@nexafe.com.
Item | Description |
Controller | The Customer, as identified in its Account |
Service provider | NeXafe Solutions Corp., [address TO CONFIRM], confidentialite@nexafe.com |
Subject and purposes | Providing the health, safety and compliance management platform: hosting, storage, display, notifications, reports, backups and support |
Duration | Subscription Period, plus the periods in section 3.5 of the Terms |
Individuals concerned | The Customer’s employees and Authorized Users, workers of its contractors and partners, visitors to its workplaces, incident witnesses, other individuals the Customer registers |
Categories of information | Identity and contact details; employer and position; training, certifications and qualifications; site entries and exits (date, time, location); photos and signatures; incident, inspection and safety meeting reports; technical connection data |
Frequency | Continuous during the subscription |
Subprocessor | Service | Data location |
Google Cloud Platform | Hosting of the Service | Canada or United States] |
MongoDB | Database |
|
Twilio SendGrid | Notification emails | United States |
Dadatech | Development and maintenance of the Service | Canada |
Stripe processes NeXafe’s payments but does not receive Customer Personal Information; it is listed in the Privacy Policy.
