Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service and applies to the processing of Personal Data by Altergy on behalf of Customers in connection with lead generation and appointment setting Services.

• "Controller" means the Customer, who determines the purposes and means of processing Personal Data.
• "Processor" means Altergy, who processes Personal Data on behalf of the Controller.
• "Personal Data" means information about an identifiable individual as defined by PIPEDA and applicable provincial privacy legislation.
• "Sub-processor" means a third-party engaged by Altergy to assist in processing Personal Data.

The Customer is the Controller of Personal Data collected during lead generation and appointment setting campaigns. Altergy acts as Processor, processing Personal Data only on documented instructions from the Customer and for the sole purpose of delivering the agreed Services.

The Customer warrants that it has obtained all necessary consents and has complied with all applicable laws (including CASL and the National Do Not Call List rules) before providing contact data to Altergy for processing. The Customer is responsible for maintaining records of consent for contacts provided to Altergy.

Altergy implements the following technical and organizational measures to protect Personal Data:

• Encryption of data in transit (TLS 1.2+) and at rest (database-level encryption).
• Row-level security policies enforcing data isolation between Customers.
• Role-based access control with principle of least privilege for all staff.
• Audit logging of all administrative actions involving Personal Data.
• Secure, time-limited signed URLs for file access.
• Regular security reviews and prompt remediation of identified vulnerabilities.

Altergy engages the following sub-processors for processing Personal Data: Supabase (cloud hosting and authentication), Resend (email delivery), and Twilio (telephony). The Customer acknowledges and agrees to the use of these sub-processors.

Altergy remains liable for the acts and omissions of its sub-processors to the same extent it would be liable if performing the processing itself. Altergy will notify the Customer of any intended addition or replacement of a sub-processor, giving the Customer a reasonable opportunity to object.

Altergy will notify the Customer of any personal data breach affecting the Customer's Personal Data without undue delay and in any case within seventy-two (72) hours of becoming aware of the breach. The notification will include the nature of the breach, the likely consequences, and the measures taken or proposed to address it and mitigate its effects.

Altergy will cooperate with the Customer in fulfilling the Customer's breach notification obligations under applicable law, including notifications to the Privacy Commissioner of Canada and affected individuals.

Upon termination of the Services or at the Customer's written request, Altergy will return or delete all Personal Data processed on behalf of the Customer, except where retention is required by applicable law. Deletion will be completed within thirty (30) days of the request or termination date.

If Personal Data must be retained to comply with a legal obligation, Altergy will securely store the data and process it only for the purpose of complying with that obligation until the retention period expires.

Altergy will make available to the Customer, upon reasonable notice and subject to confidentiality obligations, information necessary to demonstrate compliance with this DPA. The Customer may audit Altergy's data processing practices once per calendar year, provided that the audit does not unreasonably interfere with Altergy's business operations.