Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, the Master Services Agreement ("Agreement") between 11384422 Canada Inc. d/b/a fonoUC ("fonoUC," "Processor") and the customer ("Customer," "Controller"). It governs fonoUC's processing of Personal Data on Customer's behalf in connection with the QVOICE hosted service. Where this DPA conflicts with the Agreement on data-protection matters, this DPA controls.

1. Roles & Scope

• For Customer Personal Data processed through the Service, Customer is the controller (or business) and fonoUC is the processor (or service provider). For fonoUC's own account, billing, and security data, fonoUC is an independent controller.
• fonoUC processes Personal Data only to provide, secure, and support the Service, on Customer's documented instructions (which include the Agreement and Customer's use/configuration of the Service), and as required by applicable law.
• This DPA covers obligations under PIPEDA, Quebec Law 25 and other Canadian provincial laws, the EU/UK GDPR (where applicable), and US state privacy laws (CCPA/CPRA and similar).

2. Details of Processing

• Subject matter / duration: provision of the Service for the term of the Agreement plus deletion periods.
• Nature / purpose: hosting, transmission, routing, recording (where enabled), transcription, analytics, support.
• Data subjects: Customer's personnel, end users, and call/communication participants.
• Data types: contact/account data, call and message metadata (CDRs), recordings/voicemails/transcripts (where enabled), and configuration data. Customer must not submit special-category data except as agreed.

3. fonoUC (Processor) Obligations

• process only on documented instructions; notify Customer if an instruction infringes applicable law;
• ensure personnel authorized to process are bound by confidentiality;
• implement the technical and organizational security measures described in Section 6;
• not sell or share Personal Data, and not retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the Service (CCPA/CPRA service-provider commitments);
• assist Customer, taking into account the nature of processing, with data-subject requests, security, breach notification, and data-protection impact assessments;
• make available information reasonably necessary to demonstrate compliance and allow for audits subject to Section 7.

4. Sub-Processors

Customer provides general authorization for fonoUC to engage the sub-processors listed at the Sub-Processor List. fonoUC imposes data-protection obligations on each sub-processor that are substantially equivalent to this DPA and remains responsible for their performance. fonoUC will give notice of material changes to sub-processors per that page, and Customer may object on reasonable data-protection grounds.

5. International & Cross-Border Transfers

Core platform data is hosted on Canadian infrastructure. Certain transient processing (e.g., optional AI features, payment authorization, message delivery) may involve providers located in the United States, as described in the Privacy Policy and Sub-Processor List.

Where fonoUC operates a United States service node or otherwise processes data in the US, and where required for transfers of EU/UK Personal Data, the parties incorporate the applicable Standard Contractual Clauses (and the UK Addendum) by reference, with fonoUC as data importer; for Canadian data, fonoUC applies comparable protection consistent with PIPEDA and Quebec Law 25. The choice of service-node region for a Customer is governed by the Agreement and Service Order.

6. Security Measures

• encryption in transit (TLS 1.2+, SRTP for media) and at rest (AES-256);
• role-based access, least privilege, and MFA for administrative access;
• network security (SIP firewalling, rate limiting, toll-fraud and DDoS mitigation);
• logging, monitoring, anomaly detection, vulnerability management, and patching;
• a documented incident-response plan.

7. Breach Notification & Audits

fonoUC will notify Customer without undue delay (and, where feasible, within seventy-two (72) hours) after becoming aware of a Personal Data breach affecting Customer Personal Data, with information reasonably available to assist Customer's own notification obligations (including to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, EU/UK supervisory authorities, or US state regulators, as applicable).

Customer may audit fonoUC's compliance no more than once per year (or following a breach) on reasonable prior notice, during business hours, subject to confidentiality; fonoUC may satisfy audit requests by providing current third-party reports or certifications where available.

8. Return & Deletion

On termination, fonoUC will, at Customer's choice, delete or return Customer Personal Data and delete existing copies within the periods stated in the Privacy Policy (Data Retention), except where retention is required by law.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits rights that cannot be limited under applicable data-protection law.