Data Processing Addendum

1.1 "Data Protection Laws" means the privacy and data protection laws applicable to a Party's processing of Personal Information under the Agreement, including the Personal Information Protection and Electronic Documents Act (Canada) and substantially similar provincial legislation. "Processing" means any operation performed on Personal Information. "Security Incident" means a breach of security safeguards affecting Customer Data, as that expression is used in section 15.2 of the Agreement. "Controller" and "Processor" have the meanings given in section 10 of the Privacy Policy, and include the equivalent terms "business" and "service provider" under United States state law.

1.2 Under section 2.3 of the Agreement this DPA ranks below the Order Form and the body of the Agreement and its Schedules. On the processing of Personal Information this DPA prevails over Schedule C, as Schedule C provides, and over the Privacy Policy, the Terms of Use and the Acceptable Use Policy. The jurisdictions in which Customer Data is processed and stored are governed by section 11 of the Privacy Policy, which section 8.3 of the Agreement makes the master statement.

1.3 Where a person uses the Services under the Terms of Use without a signed Agreement or Order Form, this DPA applies as section 14 of the Terms of Use provides, references to the Agreement are to the Terms of Use, provisions that depend on an Order Form apply only to the extent one is in place, and liability is governed by section 11 of the Terms of Use.

2.1 For Personal Information contained in Customer Data, the Customer is the Controller and Scallor is the Processor, as section 10 of the Privacy Policy states. Customer Data routinely contains Personal Information about the Customer's own clients and their personnel; the Customer is the Controller of that information for the purposes of this DPA. Where the Customer processes Personal Information in Customer Data as a Processor on behalf of its own client, the Customer is a Processor, that client is the Controller, and Scallor is a Sub-processor. The obligations in this DPA apply to Scallor in that capacity, and the Customer confirms it has that client's authority to give the instructions in clause 2.2.

2.2 Scallor will process Personal Information in Customer Data only on the Customer's documented instructions, which are: the Agreement, the Order Form, this DPA, the Customer's configuration and use of the Services, and any further written instruction agreed by the Parties. The operational, feedback and aggregated-improvement uses described in section 8 of the Privacy Policy and sections 8.4 and 8.5 of the Agreement form part of those instructions.

2.3 Scallor will inform the Customer if, in its opinion, an instruction would breach Data Protection Laws, and may suspend the instruction until it is confirmed or withdrawn. Scallor is not obliged to review Customer Data for lawfulness.

2.4 Account and profile information about the Customer's administrators and Users, and enquiries, billing records, executed agreements and signing records, are handled by Scallor as an organisation under sections 4 to 6 of the Privacy Policy and are not Customer Data for the purposes of this DPA.

3.1 The Customer is responsible, as section 8.8 and the warranty in section 12.4 of the Agreement provide, for the lawfulness of the Personal Information it submits and of the Processing it instructs, including the notices, consents and authorisations required from its own clients and their personnel, and for its own back-up of Customer Data.

3.2 The Customer will not submit Personal Information that is subject to the General Data Protection Regulation (EU) 2016/679 or the UK GDPR unless terms have been agreed under clause 4.3. Where it does so, it does so at its own risk; this is not of itself a breach of the Agreement.

4.1 Canada. Each Party will comply with the Data Protection Laws applicable to it. Where Quebec's Law 25 or the Personal Information Protection Act of British Columbia or Alberta applies to the Customer, this DPA is read consistently with it, and clauses 9.4 and 11.3 state the commitments Scallor gives for that purpose. Scallor remains accountable for Personal Information under its control, including Personal Information transferred to a Subprocessor. Nothing in this clause is a representation that any particular law applies to the Customer, and nothing in this DPA converts a roadmap item recorded in section 18 of the Privacy Policy into a present obligation.

4.2 United States. Where the Customer is subject to the California Consumer Privacy Act as amended (the "CCPA") in respect of Personal Information in Customer Data, Scallor acts as a service provider and: (a) processes that information only for the business purposes in Annex 1; (b) will not sell or share it, retain, use or disclose it outside the direct business relationship with the Customer, or combine it with personal information received from another source except as the CCPA permits; (c) will comply with the CCPA and provide the same level of privacy protection it requires; (d) will notify the Customer if it can no longer meet its obligations under the CCPA; (e) grants the Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use; and (f) will flow the obligations in this clause down to any Subprocessor. Where the Customer is subject to the privacy law of another United States state, the obligations in this DPA are the processor terms for that law, and the Parties will agree in writing any additional term that law requires.

4.3 European Union and United Kingdom. This DPA does not address the GDPR, the UK GDPR or the Data Protection Act 2018 (UK), and no transfer mechanism under those laws has been adopted. The Parties may agree terms for those laws by written addendum or in an Order Form without amending the Agreement.

4.4 Other jurisdictions. For a Customer subject to the Australian Privacy Act 1988, the Singapore Personal Data Protection Act 2012, or any other law that requires an overseas recipient to be contractually bound to comparable protection, the obligations in this DPA are those contractual protections, and the Parties may agree any jurisdiction-specific term by written addendum or in an Order Form without amending the Agreement.

5.1 Scallor will maintain the technical and organisational measures required by section 15.1 of the Agreement. Those measures are described further in Annex 2, which is the description contemplated by section 15.1. Annex 2 describes the controls listed in section 12 of the Privacy Policy in more detail and creates no security commitment additional to section 15.1. A failure to meet a measure described in Annex 2 is assessed against the commercially-reasonable standard in section 15.1.

5.2 Scallor will ensure that Scallor Personnel with access to Customer Data are bound by confidentiality obligations and receive access on a least-privilege basis. Scallor is responsible for the acts and omissions of Scallor Personnel in performing this DPA; a deliberate act of a contractor or adviser is not, by that responsibility alone, Scallor's own wilful misconduct for the purposes of section 13.4(a) of the Agreement.

5.3 Scallor holds no third-party security certification. On reasonable written request, not more than once in any twelve-month period, Scallor will complete the Customer's reasonable security questionnaire and provide the documentation reasonably available to it, and will provide the certificate of insurance under section 15.4 of the Agreement.

6.1 The Customer authorises Scallor to engage the Subprocessors listed in Annex 3, which is the list referred to in sections 1.1, 8.6 and 8.7 of the Agreement and is kept consistent with Schedule C. Scallor remains responsible for its Subprocessors as section 8.6 provides.

6.2 Notice of a new or replacement Subprocessor, the Customer's 15-day right to object and the Customer's remedy are governed by section 8.7 of the Agreement. Scallor will give that notice by updating Annex 3 at the address stated in the front matter and by email to the Customer's notice address. Silence is not acceptance for the purposes of the objection right.

6.3 Scallor engages each Subprocessor under that Subprocessor's standard data processing terms and, before engagement, satisfies itself that those terms protect Personal Information at a level comparable to the protection it would receive in Canada, as section 11 of the Privacy Policy provides. Scallor will instruct each Subprocessor to delete Customer Data when clause 10 requires.

7.1 OpenAI, Anthropic and any other Model Provider are Subprocessors engaged on their standard application-programming-interface terms. Scallor has no bespoke, enterprise or zero-retention arrangement with any Model Provider. Section 8.4 of the Agreement governs training: neither Scallor nor a Model Provider uses Customer Data or Input to train, fine-tune or improve a model. Under each Model Provider's published policy at the date of this DPA, Input and Output are retained for up to 30 days for abuse monitoring and are then deleted, except where the provider retains content for longer to enforce its usage policy or where applicable law requires. Scallor has not elected a reduced-retention or zero-retention option, and will record in Annex 3 if it does so.

7.2 Where Scallor's advisory sessions under section 7.6 of the Agreement are recorded, the recording provider named in Annex 3 processes the recording and transcript. Scallor will not enable recording with a provider unless that provider's model-improvement setting is disabled for Scallor's account, or the provider has confirmed in writing that session recordings, transcripts and derived data are excluded from training or improving any model.

7.3 Output is generated by probabilistic models and is designed to support human decisions. The Customer will not use the Services or Output to make a decision about an individual that produces legal or similarly significant effects without human review.

7.4 Scallor does not use Customer Data, Input, Output, or Aggregated Data derived from them, to train, fine-tune or improve any foundation or generative artificial-intelligence model. Aggregated Data may be used for analytics and benchmarking that does not identify the Customer or any individual, as section 8.5 of the Agreement provides.

8.1 Advisory sessions under section 7.6 of the Agreement are recorded or transcribed only where the Order Form so provides or the Customer agrees in writing. Scallor will announce a recording at the start of each session and obtain the participants' agreement before it begins. The Customer will obtain the agreement of any participant who is not its own personnel before admitting them to a recorded session.

8.2 Recordings and transcripts are Customer Data, are subject to the confidentiality obligations of Article 11 of the Agreement, and are deleted under clause 10.

9.1 Notification of a Security Incident is governed by section 15.2 of the Agreement: without undue delay and in any event within 48 hours after Scallor confirms the Security Incident. Notice is given to the Customer's notice address and, on request, Scallor will provide the information reasonably available to it on the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken.

9.2 From the time Scallor becomes aware of circumstances reasonably indicating a Security Incident, it will investigate without undue delay and will not unreasonably delay confirmation. Where confirmation is expected to take longer than five business days, Scallor will inform the Customer that an investigation is under way.

9.3 Scallor will keep a record of each Security Incident for 24 months and provide a copy to the Customer on written request, so the Customer can maintain its own record under section 10.3 of PIPEDA.

9.4 Where the Customer has informed Scallor in writing that Law 25 applies to it, Scallor will also notify the Customer of an attempted breach of security safeguards by a person who has or is seeking access to that Customer's Customer Data. Any notification to the Commission d'accès à l'information or to affected individuals is the Customer's responsibility; Scallor will assist as clause 11.2 provides. Section 16 of the Privacy Policy describes the notifications Scallor makes in respect of personal information it handles as an organisation. For Personal Information in Customer Data, notification to a regulator or to individuals is the Customer's responsibility.

9.5 Notices to Scallor under this clause are sent to [email protected].

10.1 The return, retention, export and deletion of Customer Data are governed by Article 17 of the Agreement, which this clause does not vary. The Article 17 periods begin on termination or expiry of the Subscription, on non-continuation of the Pilot under sections 6.5 and 6.6 of the Agreement, or, for a person under the Terms of Use, on closure of the account under section 13 of the Terms of Use.

10.2 Where the Customer confirms continuation after a deemed non-continuation under section 6.7 of the Agreement and the Parties agree to resume, the Article 17 periods cease to run from the date of that agreement and Scallor will not delete Customer Data it still holds. Scallor is not obliged to restore Customer Data already deleted.

10.3 Export under section 17.1 is provided in CSV and JSON formats together with the original documents the Customer uploaded, or in such other format as the Services then support. Deletion under section 17.2 is initiated by an authorised Scallor person after confirming that the trigger has occurred and the export window has closed. Within the same period Scallor will delete Customer Data held by any Subprocessor, using the deletion functionality that Subprocessor provides and otherwise by instructing it to delete, including session recordings, transcripts and correspondence held by the conferencing, recording and collaboration providers identified in Annex 3, subject to sections 17.3 to 17.5 of the Agreement and to each Subprocessor's own back-up cycle.

10.4 On written request within 30 days after the end of the back-up period in section 17.3, Scallor will confirm in writing that deletion has been carried out.

11.1 Where an individual makes a request to Scallor concerning Personal Information in Customer Data, Scallor will refer it to the Customer within five business days and will not respond substantively except as the Customer instructs or the law requires, as section 10 of the Privacy Policy provides.

11.2 Scallor will provide the assistance reasonably necessary for the Customer to respond to requests from individuals, to notify a regulator or individuals of a Security Incident, and to conduct a privacy impact assessment where Data Protection Laws require one, within fifteen business days of request. Assistance beyond what is reasonable in the context of the Services may be charged where the Parties agree the scope and charge in writing in advance; that discussion will not delay the Customer's own statutory deadline.

11.3 Where Law 25 applies to the Customer, the Customer's person in charge of the protection of personal information may verify Scallor's compliance with this DPA by the documentary means in clause 5.3.

11.4 Scallor will maintain a record of the categories of Processing it carries out on the Customer's behalf and will make it available on request.

11.5 Where Scallor receives a request from a law enforcement, government or other third party for Customer Data, it will notify the Customer before responding unless legally prohibited, will not disclose more than is legally required, and will seek to redirect the request to the Customer.

The limitations and exclusions of liability in Article 13 of the Agreement, including the Security Super-Cap in section 13.3, apply to this DPA. This DPA creates no liability separate from or in addition to the Agreement. Only the Customer entity that is party to the Agreement may bring a claim under this DPA, and any claim by its Affiliates or its clients must be brought through that entity.

13.1 This DPA takes effect on the later of the Effective Date of the Agreement and Day 0 under Schedule B, and continues for as long as Scallor processes Personal Information in Customer Data. Clauses 9, 10 and 12 survive.

13.2 Section 1.1 of the Agreement defines the DPA as made available by Scallor, as updated from time to time. Scallor may update this DPA by publishing a new version at the address stated in the front matter and giving the Customer at least 30 days' notice by email. An update will not reduce the protection of Personal Information under this DPA during the Subscription Term without the Customer's written agreement.

13.3 This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in it, as Article 18 of the Agreement provides. Notices under this DPA are given as section 18.5 of the Agreement provides, with Security Incident notices to [email protected].

This Annex is the description of measures contemplated by section 15.1 of the Agreement. Each measure describes Scallor's current design and configuration and is assessed under section 15.1. It creates no commitment additional to section 15.1.

Annex 3, version 1.1, 30 October 2026. This is the list referred to in sections 1.1, 8.6 and 8.7 of the Agreement and is kept consistent with Schedule C. Notice, objection and remedy are governed by clause 6 and section 8.7. This Annex is the controlling list; the current list is also published at https://scallor.com/trust as a public copy, which does not itself amend this Agreement.

Back-up and deletion cycles (clause 10.3).

Row 6, Jotform. Executed agreements and signing records are Scallor's own contract records under clause 2.4 and section 17.4 of the Agreement. They are not deleted under clause 10.3.

Row 7, Zoom. Cloud recording is not enabled on Scallor's account, so Zoom does not retain session recordings. Meeting metadata is deleted on the provider's ordinary cycle.

Row 8, Fathom. Recordings and transcripts are retained until deleted. Scallor deletes them on instruction under clause 10.3. Under the provider's published policy, deletion is completed within 30 days and deleted data is removed from its back-ups within a further 7 days.

Row 9, Google Workspace. Deleted content is removed from active and back-up systems within 180 days under the provider's published deletion policy.

Not Subprocessors. Hostinger (scallor.com hosting), Google Analytics and Microsoft Clarity (scallor.com analytics, after consent) and Apollo.io (sales prospecting) process personal information for the marketing website or Scallor's own sales activity only, do not process Customer Data, and are listed in section 9 of the Privacy Policy for transparency.

See also our Privacy Policy, Terms of Use and Trust and Compliance Centre, which carries the public copy of the subprocessor list in Annex 3.