Data Processing Agreement (DPA)

Appendix 1 to Overdracht's General Terms and Conditions of Sale, in accordance with Article 28 of the GDPR.

Article 1 - Parties and purpose

This agreement is entered into between:

• The Client: the agency that has taken out a subscription to the Overdracht platform, acting as controller;
• OVERDRACHT SOFTWARE INC., a company incorporated in British Columbia (Canada) under number BC1598323, 7404 King George Boulevard, Suite 200, Surrey, BC V3W 1N6, Canada, acting as processor ("Overdracht").

It governs the processing of personal data carried out by Overdracht on behalf of the Client under the Terms, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR") and applicable Canadian laws (PIPEDA, Quebec's Law 25).

It takes effect upon acceptance of the Terms and remains applicable for as long as Overdracht processes data for the Client.

Article 2 - Description of the processing

Article 3 - Client's obligations

The Client, as controller, undertakes to:

1. Have a legal basis for collecting its customers' data and entering it in the platform.
2. Inform its customers of the processing of their data, in particular the sending of notifications by SMS and email.
3. Enter only the data that is necessary, and no sensitive data.
4. Give Overdracht instructions that comply with the law. Normal use of the platform constitutes a documented instruction.
5. Manage its staff's access (creation, roles, deactivation) and the confidentiality of their login details.
6. Comply with the rules applicable to sending SMS and emails in the countries of its recipients.

Article 4 - Overdracht's obligations

Overdracht undertakes to:

1. Process the data only on the Client's documented instructions and for the purposes described in Article 2. If an instruction appears to it to be contrary to the law, Overdracht informs the Client without delay.
2. Not use the data on its own behalf, not sell it and not exploit it for advertising purposes.
3. Ensure the confidentiality of the data: any person authorized to access it (employees, development and maintenance providers) is bound by a confidentiality obligation.
4. Implement the security measures described in Annex A.
5. Keep a record of the processing carried out on behalf of the Client.
6. Inform the Client of any request for access from a public authority, unless prohibited by law.

Article 5 - Sub-processors

The Client authorizes Overdracht to use the following sub-processors:

Overdracht imposes on each of them protection obligations at least equivalent to those of this agreement and remains liable to the Client for their compliance.

Overdracht informs the Client by email of any addition or replacement of a sub-processor at least 30 days in advance. The Client may object on legitimate grounds within this period. Failing agreement, it may terminate its subscription without penalty.

Article 6 - Security and data breaches

Overdracht implements the technical and organizational measures described in Annex A. It may develop them, provided that the level of protection is not reduced.

In the event of a data breach affecting the Client's data, Overdracht:

1. notifies the Client within 48 hours of becoming aware of it, at the email address of the account administrator;
2. states the nature of the breach, the categories and approximate number of individuals and data concerned, the likely consequences and the measures taken or proposed;
3. supplements this information as its investigation progresses.

This period allows the Client to notify the supervisory authority within the 72 hours required by the GDPR. Notification to the authority and to the individuals concerned is the Client's responsibility, with Overdracht's assistance.

Article 7 - Assistance to the Client

Individuals' rights. The platform allows the Client to consult, correct, export and delete its customers' data. If an individual contacts Overdracht directly, Overdracht forwards the request to the Client within 5 business days, without responding itself unless instructed by the Client.

Impact assessments and authorities. Overdracht provides the Client, on request, with the information reasonably necessary to carry out a data protection impact assessment (DPIA) or to respond to a supervisory authority.

Assistance beyond normal use of the platform may be charged at the current rate, with the Client's prior agreement.

Article 8 - Transfers outside the European Union

The data is hosted in France. However, it may be accessed from Canada by Overdracht and transmitted to certain sub-processors located outside the EU.

These transfers are governed by:

• Canada: the European Commission's adequacy decision for organizations subject to PIPEDA;
• United States: the sub-processor's participation in the EU-US Data Privacy Framework or, failing that, the European Commission's standard contractual clauses;
• Countries of destination of parcels: the transfer necessary to carry out the shipment requested by the end customer, under the Client's responsibility.

Article 9 - Audit

Overdracht provides the Client, on written request, with the information necessary to demonstrate compliance with this agreement (description of security measures, list of sub-processors, certificates from its hosting providers).

If this information is not sufficient, the Client may have an audit carried out, no more than once a year, by an independent auditor bound by confidentiality. It notifies Overdracht at least 30 days in advance. The audit takes place during business hours, without disrupting the service, and does not give access to other clients' data. Its costs are borne by the Client, unless it reveals a serious breach by Overdracht.

Article 10 - End of the contract

At the end of the subscription, whatever the cause:

1. The Client has 3 months to export its data from the platform. Its access is limited to consultation and export during this period.
2. At the end of this period, Overdracht permanently deletes the Client's data, including in backups at the end of their rotation cycle (3 months maximum).
3. Overdracht confirms the deletion in writing on request.

Only data that Overdracht must keep under a legal obligation (subscription invoicing) is retained, for the period required by law.

Article 11 - Liability, governing law and order of precedence

Liability. Each party is liable for the breaches attributable to it. Overdracht's liability under this agreement is subject to the limitations set out in the Terms, except in the event of gross negligence or wilful misconduct.

Order of precedence. In the event of a conflict between this agreement and the Terms on data protection, this agreement prevails.

Governing law. This agreement follows the law applicable to the Terms. For a Client established in the European Union, the obligations arising from the GDPR apply in all cases.

Contact. Joel Temdie, joeltemdie@overdracht.io, OVERDRACHT SOFTWARE INC., 7404 King George Boulevard, Suite 200, Surrey, BC V3W 1N6, Canada.

Annex A - Security measures