Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between your business ("Customer") and Evan Korial ("EzyCrm"). It applies automatically when you agree to the Terms, which you do by ticking the agreement box; you don't need to sign anything separately, and we keep a record of when you agreed. If the DPA and the Terms conflict on how personal information is processed, this DPA wins.

Scope and roles

This DPA covers personal information that Customer and its users put into their workspace about Customer's own contacts, such as leads, customers and the people at companies Customer works with. For that data, Customer is the controller (the organization that decides why and how it is used) and EzyCrm is the processor or service provider acting on Customer's behalf.

It does not cover EzyCrm's own account data (such as user names, emails and sign-in records), which is handled as described in our Privacy Policy.

Processing on instructions

EzyCrm processes Customer personal data only on Customer's documented instructions, unless the law requires otherwise (in which case we will tell Customer first, if the law allows). Customer's use and configuration of the service, including turning on integrations or the AI add-on, are its instructions. We will not sell Customer personal data or use it for our own purposes beyond running, securing and supporting the service.

Customer is responsible for having a lawful basis, including consent where required, for the personal data it puts into EzyCrm.

Confidentiality

Anyone EzyCrm authorizes to access Customer personal data is bound by confidentiality obligations and accesses it only as needed to provide or support the service.

Security measures

• HTTPS encryption for all traffic.
• Passwords stored only as secure hashes.
• Microsoft access tokens encrypted at rest.
• Per-workspace isolation enforced in the data layer.
• Rate limiting on sign-in and password reset.
• File downloads served with nosniff and sandbox security headers.

Sub-processors

Customer authorizes EzyCrm to use the sub-processors listed in the Privacy Policy. We require each sub-processor to protect the data in line with this DPA, and we remain responsible for them. Before adding a new sub-processor, we will notify workspace owners and give them a chance to object. If Customer reasonably objects and we can't address it, Customer may stop using the affected feature or close its workspace.

Help with individuals' requests

If someone asks to access, correct, delete or get a copy of their data, Customer can usually do this directly in the app, for example by editing or deleting records, exporting contacts to CSV, or downloading attachments. Where Customer needs more help, we will provide reasonable assistance. If we receive a request directly about Customer's data, we will pass it to Customer rather than answer it ourselves, unless the law requires otherwise.

Breach notification

If we become aware of a breach of security affecting Customer personal data, we will notify the workspace owner without undue delay, share what we know, and take reasonable steps to contain it. We will provide information Customer reasonably needs to meet its own notification duties, such as those under PIPEDA.

Deletion and return at the end

Customer can export its data at any time. When a workspace is deleted, its data, including attachments, is removed from the live database immediately, and backup copies are overwritten within 30 days, unless the law requires us to keep it longer.

International transfers

EzyCrm and its main sub-processors store data in the United States. Where the law requires safeguards for transfers, such as for data from the EU or UK, we rely on Standard Contractual Clauses or equivalent mechanisms. For Canadian data, we remain accountable for it when it is processed outside Canada.

Audits and information

On reasonable written request, we will provide information needed to show that we meet this DPA, such as answers to security questionnaires. Requests should be made no more than once a year unless there has been a breach or a regulator requires it.

Contact

Questions about this DPA: scanified@gmail.com.