This Data Processing Addendum ("DPA") applies where a proposal, statement of work, master services agreement, or other written agreement (the "Agreement") between Aurora Digital Solutions Inc., operating as Aurora Designs ("Aurora"), and the client named in it ("Client") incorporates this DPA by reference. It governs Aurora's Processing of Client Personal Data in providing the Services.
A countersigned copy of this DPA is available on request from [email protected]. Aurora will also consider a Client's own data processing terms in place of this DPA.
1. Definitions
Capitalized terms not defined in this DPA have the meanings given in the Agreement. In this DPA:
- "Applicable Data Protection Law" means the privacy and data protection laws that apply to the Processing of Client Personal Data under the Agreement, which may include the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 ("PIPEDA"); the Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, as amended (the "Quebec Privacy Act"); the Personal Information Protection Act of Alberta and of British Columbia; United States state privacy laws, including the California Consumer Privacy Act of 2018 as amended (the "CCPA"); and the EU and UK General Data Protection Regulation.
- "Client Personal Data" means personal information, as defined by Applicable Data Protection Law, that Client provides to Aurora or that Aurora accesses or Processes on Client's behalf in providing the Services.
- "Personnel" means Aurora's employees and officers, and individuals Aurora engages as independent contractors to perform the Services under its direction.
- "Process" or "Processing" means any operation performed on Client Personal Data, including collection, access, recording, storage, use, analysis, disclosure, transfer, and deletion.
- "Security Incident" means a breach of security safeguards resulting in the loss of, or unauthorized access to or disclosure of, Client Personal Data in Aurora's possession or control.
- "Services" means the services Aurora provides to Client under the Agreement.
- "Sub-processor" means any person, other than Personnel, that Aurora engages to Process Client Personal Data.
2. Scope and roles
2.1 As between the parties, Client is the organization in control of Client Personal Data and Aurora Processes Client Personal Data on Client's behalf as its service provider, including as a "processor" or "service provider" where those terms are used in Applicable Data Protection Law.
2.2 The subject matter, nature, purpose, and duration of the Processing, and the categories of personal information and individuals concerned, are described in Annex A.
2.3 Client is responsible for the lawfulness of the Client Personal Data it provides or makes available to Aurora, including any consent or notice required for Aurora to Process it under this DPA. Client will not provide Aurora with sensitive personal information, including health, financial account, government identifier, or biometric information, unless the parties have first agreed in writing on how it will be handled.
2.4 Personal information that Aurora collects for its own business purposes, including business contact and billing information about Client personnel, is governed by Aurora's Privacy Policy and not by this DPA.
3. Processing on instructions
3.1 Aurora will Process Client Personal Data only to provide the Services, in accordance with the Agreement, this DPA, and Client's other documented instructions, unless otherwise required by law. Where the law requires other Processing, Aurora will inform Client before Processing unless the law prohibits it.
3.2 The Agreement and this DPA constitute Client's instructions as at the date of the Agreement. Additional instructions must be given in writing, which may be by email, and must be consistent with the scope of the Services.
3.3 Aurora will inform Client if, in Aurora's opinion, an instruction contravenes Applicable Data Protection Law.
4. Confidentiality
4.1 Aurora will limit access to Client Personal Data to Personnel who require it to perform the Services, and will ensure that such Personnel are bound by written confidentiality obligations. Aurora is responsible for the acts and omissions of its Personnel in Processing Client Personal Data.
4.2 Aurora will not sell, rent, or license Client Personal Data, and will not disclose it to any third party except to Sub-processors in accordance with section 5 or as required by law.
5. Sub-processors
5.1 Client authorizes Aurora to engage the Sub-processors listed at aurora-designs.ca/subprocessors (the "Sub-processor Page") as at the date of the Agreement.
5.2 Before a new Sub-processor begins Processing Client Personal Data, Aurora will update the Sub-processor Page and, if Client has asked in writing to receive notice of changes, notify Client by email. Client may object to a new Sub-processor on reasonable grounds relating to the protection of Client Personal Data. The parties will discuss any objection in good faith and, if they cannot resolve it, either party may terminate the affected Services on written notice.
5.3 Aurora engages each Sub-processor under that provider's applicable terms of service and privacy terms, and selects Sub-processors whose terms include safeguards for the information they process. Aurora remains responsible to Client for the Processing of Client Personal Data by its Sub-processors, subject to section 15.
6. Security
6.1 Aurora will maintain physical, organizational, and technological safeguards appropriate to the sensitivity of Client Personal Data, designed to protect it against loss, theft, and unauthorized access, disclosure, copying, use, or modification. The safeguards in place at the date of this DPA are summarized in Annex B.
6.2 Aurora may change its safeguards from time to time, provided that the overall level of protection of Client Personal Data is not materially reduced.
7. Security Incidents
7.1 Aurora will notify Client without undue delay after becoming aware of a Security Incident.
7.2 The notice will describe, to the extent then known, the nature of the Security Incident, the Client Personal Data and individuals affected, and the steps Aurora has taken or proposes to take in response. Aurora will provide further information as it becomes available.
7.3 Aurora will take reasonable steps to contain and remediate each Security Incident, and will provide reasonable cooperation so that Client can determine whether the Security Incident creates a real risk of significant harm under PIPEDA or a risk of serious injury under the Quebec Privacy Act, and meet any resulting obligation to report or notify. Unless required by law, Aurora will not notify regulators or affected individuals of a Security Incident without Client's prior approval.
7.4 Notice of a Security Incident is not an acknowledgement of fault or liability by Aurora.
8. Assistance to Client
8.1 Individual requests. If Aurora receives a request from an individual to access, correct, or delete Client Personal Data, or to withdraw consent, Aurora will promptly forward it to Client and will not respond to it except on Client's instructions. Aurora will provide reasonable assistance to enable Client to respond within the time required by law.
8.2 Assessments. Aurora will provide information reasonably required by Client to complete a privacy impact assessment relating to the Services, including an assessment required by the Quebec Privacy Act.
8.3 Regulators. Aurora will cooperate reasonably with Client in any inquiry by a privacy regulator concerning the Processing of Client Personal Data.
9. Client Platforms
9.1 Aurora may build and operate automations within software platforms licensed by Client ("Client Platforms"). Client Platforms are engaged by Client under its own agreements with their providers, and their providers are not Aurora's Sub-processors.
9.2 Aurora will access Client Platforms only with the credentials and permissions Client provides and only to perform the Services, in accordance with Client's reasonable security policies communicated to Aurora in writing.
9.3 On completion or termination of the Services, Aurora will return to Client any Client Platform credentials and remove its own access. Client is responsible for revoking credentials it issued to Aurora.
10. AI tools
10.1 This section applies to the AI tools that Aurora engages as Sub-processors, which are identified on the Sub-processor Page. It does not apply to AI services provided within Client Platforms, which are governed by Client's agreements with their providers.
10.2 Aurora will not use Client Personal Data to train or fine-tune AI models, and will not Process Client Personal Data with an AI tool it engages unless model training on customer content is disabled for Aurora's use of that tool.
10.3 Aurora does not itself use Client Personal Data to make decisions about individuals based exclusively on automated processing. Automations that Aurora builds or operates for Client run on Client's instructions. Client is responsible for reviewing AI-generated output and for decisions made using it, including any related notice or review obligations under Applicable Data Protection Law. Aurora does not warrant the accuracy or completeness of AI-generated output.
10.4 This DPA does not restrict Aurora's use of the general knowledge, skills, experience, and know-how it gains in providing the Services, including to develop and improve its methods, processes, and tools, or its use of information that has been aggregated or de-identified so that it does not identify Client or any individual, provided that Aurora does not disclose Client Personal Data or attempt to re-identify such information.
11. Cross-border transfers
11.1 Client acknowledges that Aurora and its Sub-processors may Process Client Personal Data outside the province or territory in which it was collected, including in the United States and the other locations identified on the Sub-processor Page. While outside Canada, Client Personal Data is subject to the laws of the jurisdiction in which it is held and may be accessible to that jurisdiction's courts, law enforcement, and national security authorities.
11.2 Aurora uses contractual and other means to provide a level of protection comparable to that required by Applicable Data Protection Law.
11.3 Where the EU or UK General Data Protection Regulation applies to Client Personal Data and requires a transfer mechanism, the parties will put the required mechanism in place on Client's request.
12. Return and deletion
12.1 Within a reasonable period after the Services end, Aurora will, at Client's election, return Client Personal Data to Client or delete it using commercially reasonable efforts, including from Aurora's storage systems, source-code repositories, and Sub-processor services. If Client does not make an election, Aurora will delete it.
12.2 Aurora may retain Client Personal Data to the extent required by law; to the extent contained in correspondence and business records kept in accordance with Aurora's Privacy Policy; and in backups or version history until deleted in the ordinary course. Aurora will continue to protect retained Client Personal Data in accordance with this DPA.
12.3 On Client's written request, Aurora will confirm deletion in writing.
13. Audits and information
13.1 On Client's reasonable request, Aurora will make available the information reasonably necessary to demonstrate its compliance with this DPA.
13.2 Where that information is not sufficient to demonstrate compliance, Client, or an independent auditor bound by confidentiality and reasonably acceptable to Aurora, may audit Aurora's compliance with this DPA. Audits are limited to once in any twelve-month period, except following a Security Incident or at the direction of a regulator, require at least thirty (30) days' written notice, must take place during normal business hours, and must not unreasonably interfere with Aurora's business or compromise the confidentiality of other clients' information. Client will bear its own costs of any audit.
13.3 Aurora does not currently hold SOC 2 or ISO/IEC 27001 certification.
14. US state privacy laws
To the extent the CCPA or a comparable United States state privacy law applies to Client Personal Data, Aurora:
- will not sell or share Client Personal Data, as those terms are defined in the CCPA
- will not retain, use, or disclose Client Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in the Agreement, or outside the direct business relationship between Aurora and Client
- will not combine Client Personal Data with personal information Aurora receives from or on behalf of another person, except as permitted by law
- will comply with its applicable obligations under the CCPA and provide the same level of privacy protection the CCPA requires
- will notify Client if it determines that it can no longer meet its obligations under the CCPA
- grants Client the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Client Personal Data
15. Liability
Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement or, if the Agreement contains none, in Aurora's Terms of Service.
16. Term, precedence, and law
16.1 This DPA remains in effect for as long as Aurora Processes Client Personal Data, and survives termination of the Agreement until all Client Personal Data has been returned or deleted in accordance with section 12.
16.2 In the event of a conflict, the following order of precedence applies: (a) any transfer mechanism put in place under section 11.3; (b) a provision of the Agreement that expressly refers to and overrides a provision of this DPA; (c) this DPA, with respect to the Processing of Client Personal Data; (d) the remainder of the Agreement; and (e) Aurora's Terms of Service.
16.3 This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario, without regard to conflict-of-laws principles. The parties attorn to the exclusive jurisdiction of the courts of Ontario sitting in Toronto, except where Applicable Data Protection Law requires otherwise.
16.4 Aurora may update this DPA from time to time. The version in effect on the date of the Agreement applies to that Agreement, except that Aurora may apply an update on thirty (30) days' written notice where the update is required to comply with Applicable Data Protection Law and does not materially reduce the protection of Client Personal Data.
Annex A: Processing details
| Subject matter | Provision of the Services under the Agreement, which may include AI audits, workflow and AI automation builds, AI operating systems, tool selection and setup, and maintenance and support. |
|---|---|
| Duration | The term of the Agreement and the return and deletion period in section 12. |
| Nature of Processing | Receiving, storing, analyzing, and transforming data; interviewing Client personnel and recording or transcribing meetings with notice to participants; designing, building, testing, and operating automations in Client Platforms; and providing support. |
| Purpose | Solely to perform the Services for Client. |
| Individuals concerned | Client's employees and contractors, and Client's customers, prospects, suppliers, and other contacts whose information is contained in Client's systems or materials. |
| Categories of personal information | Identification and business contact details; job and organizational information; meeting recordings, transcripts, and notes; and business records, communications, and other content contained in Client's systems or supplied by Client. |
| Sensitive personal information | None, unless agreed in writing under section 2.3. |
| Sub-processors | As listed on the Sub-processor Page. |
Annex B: Security measures
The following summarizes the safeguards in place at the date of this DPA, subject to section 6.2.
Storage
- Client Personal Data held by Aurora is stored primarily on an encrypted volume on Aurora-owned and Aurora-managed hardware
- Client Personal Data may also be held in other encrypted storage controlled by Aurora and in Sub-processor services, subject to the access controls below
- Private source-code repositories contain primarily code and configuration, and may contain limited Client Personal Data where the Services require it
- Aurora's practice is not to commit credentials or secrets to repositories, and not to store Client Personal Data in folders that synchronize to consumer cloud services
Access control
- Access limited to Personnel who require it to perform the Services and who are bound by written confidentiality obligations
- Two-factor authentication enabled on accounts used to access Client Personal Data, where the service supports it
- Individual credentials; access revoked when no longer required
Network
- Primary storage hardware on a private work network with no inbound ports forwarded from the internet
- Remote access through an end-to-end encrypted private network (Tailscale) restricted to devices authorized by Aurora
Endpoint
- Operating system integrity protection and application verification enabled
- Operating system updates applied regularly; screen lock when idle; automatic login disabled
AI tools
- Model training on customer content disabled in AI tools used to Process Client Personal Data