Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the agreement between Taskploy Technologies Inc. (“Taskploy,” “Processor,” “we,” “us,” or “our”) and the entity that accepts the Taskploy Terms of Service or a related Order Form (“Customer,” “Controller,” or “you”).
This DPA applies where Taskploy processes Personal Information on behalf of the Customer in connection with the Taskploy services (“Services”).
This DPA supplements the Terms and Privacy Policy. If there is a conflict between this DPA and the Terms regarding the processing of Personal Information on behalf of the Customer, this DPA controls. An executed enterprise agreement or Order Form referencing this DPA may contain additional or different terms, which control in case of conflict.
1. Definitions
In this DPA:
- “Applicable Data Protection Law” means privacy and data-protection laws applicable to the processing of Personal Information under this DPA, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial legislation, and where applicable, the EU/UK GDPR, and other laws governing Customer’s use of the Services.
- “Customer Data” has the meaning given in the Terms and includes Personal Information processed by Taskploy on behalf of the Customer through the Services.
- “Personal Information” means information about an identifiable individual that is processed by Taskploy on behalf of the Customer through the Services.
- “Sub-processor” means a third party engaged by Taskploy to process Personal Information on behalf of the Customer.
- “Security Incident” means a breach of security safeguards leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information processed by Taskploy on behalf of the Customer.
Terms such as “process,” “processing,” “controller,” and “processor” have the meanings given under Applicable Data Protection Law.
2. Roles of the Parties
The parties acknowledge that, for Customer Data containing Personal Information submitted to the Services by or on behalf of the Customer, the Customer is the controller (or equivalent) and Taskploy is the processor (or equivalent).
Taskploy processes Personal Information only on documented instructions from the Customer, as described in the Terms, this DPA, the Customer’s configuration of the Services, and applicable Order Forms.
For Personal Information that Taskploy processes for its own purposes—such as account administration, billing, website analytics, or direct marketing to Customer representatives—the Privacy Policy describes Taskploy’s independent role.
3. Scope and Details of Processing
Subject matter
Provision of the Taskploy business operations platform and related support.
Duration
For the term of the Customer’s subscription and any applicable retention period thereafter.
Nature and purpose
Hosting, storage, retrieval, organization, transmission, analysis, support, backup, security, and other processing necessary to provide the Services as configured by the Customer.
Categories of data subjects
Individuals whose Personal Information the Customer chooses to process through the Services, which may include employees, contractors, customers, leads, vendors, and other business contacts.
Types of Personal Information
Contact details, employment and workforce information, financial and transaction records, communications content and metadata, support records, and other categories uploaded or generated by the Customer through enabled modules.
The Customer determines which modules are used and what Personal Information is submitted.
4. Customer Instructions and Responsibilities
The Customer is responsible for:
- determining the lawful basis for processing Personal Information;
- providing required privacy notices to data subjects;
- obtaining consents and authorizations where required;
- ensuring instructions to Taskploy comply with Applicable Data Protection Law;
- configuring roles, permissions, and retention appropriately; and
- not instructing Taskploy to process Personal Information unlawfully.
The Customer’s use of the Services, account configuration, and documented support requests constitute the Customer’s instructions to Taskploy, except where Taskploy is required by law to process Personal Information differently—in which case Taskploy will inform the Customer unless prohibited by law.
5. Taskploy Obligations
Taskploy will:
- process Personal Information only on documented Customer instructions, unless required by law;
- ensure personnel authorized to process Personal Information are subject to appropriate confidentiality obligations;
- implement appropriate technical and organizational measures designed to protect Personal Information, as described in Section 8 and our Security page;
- engage Sub-processors in accordance with Section 9;
- assist the Customer with certain data-subject requests and compliance obligations, as described in Section 10, taking into account the nature of processing;
- notify the Customer of Security Incidents in accordance with Section 11; and
- delete or return Personal Information as described in Section 13, subject to legal retention requirements.
6. Confidentiality
Taskploy will treat Personal Information as confidential and limit access to personnel and Sub-processors who need access to perform the Services. This obligation survives termination of the agreement between the parties.
7. Personnel
Taskploy will take reasonable steps to ensure that employees and contractors with access to Personal Information are informed of confidentiality requirements and receive appropriate training regarding data protection and security.
8. Security Measures
Taskploy maintains administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, and loss.
Measures may include, as appropriate to the Services:
- encryption in transit and at rest for supported data;
- access controls and role-based permissions;
- authentication and session management;
- logging and monitoring;
- vulnerability management;
- backup and recovery processes;
- secure development practices; and
- incident-response procedures.
No method of transmission or storage is completely secure. The Customer is responsible for securing its accounts, credentials, and user permissions.
9. Sub-processors
The Customer authorizes Taskploy to engage Sub-processors to support the Services, including cloud hosting, email and messaging delivery, payment processing, analytics, customer support tools, and AI providers where enabled.
Taskploy will impose data-protection obligations on Sub-processors by contract that are substantially similar to those in this DPA, to the extent applicable to the services provided.
A current list of key Sub-processors is available on request at privacy@taskploy.com or through your account representative for Enterprise Customers.
Taskploy will notify Customers of intended changes to Sub-processors that materially affect processing of Personal Information by posting an updated list or sending notice to account administrators. Customers may object on reasonable grounds relating to data protection by contacting privacy@taskploy.com within 30 days of notice. If the parties cannot resolve a legitimate objection, the Customer may terminate the affected Services as its sole remedy.
Taskploy remains responsible for Sub-processor performance of data-protection obligations to the extent required by Applicable Data Protection Law.
10. Data Subject Requests
Where Taskploy receives a request from a data subject to exercise rights under Applicable Data Protection Law relating to Personal Information processed on behalf of the Customer, Taskploy will, to the extent legally permitted, direct the individual to the Customer unless the Customer has authorized Taskploy to respond directly.
Taskploy will provide reasonable assistance to the Customer in responding to such requests, taking into account the nature of the processing and the information available to Taskploy.
The Customer is responsible for responding to data-subject requests within applicable legal timeframes.
11. Security Incidents
Taskploy will notify the Customer without undue delay after becoming aware of a Security Incident affecting Personal Information processed on behalf of the Customer.
Notification will, to the extent known at the time, include:
- a description of the nature of the incident;
- categories of data potentially affected;
- likely consequences; and
- measures taken or proposed to address the incident.
Taskploy will take reasonable steps to investigate, mitigate, and remediate the Security Incident. The Customer remains responsible for determining whether notification to data subjects or regulators is required and for making any legally required notifications, except where Applicable Data Protection Law requires Taskploy to notify directly.
12. Assistance With Compliance
Taking into account the nature of processing and information available to Taskploy, we will provide reasonable assistance to the Customer with:
- data protection impact assessments where required and where the Customer does not otherwise have the information;
- consultations with regulators where required and where the Customer does not otherwise have the information; and
- implementing appropriate technical and organizational measures, to the extent Taskploy’s Services support them.
Additional assistance beyond standard support may be subject to reasonable fees for Enterprise-level requests requiring substantial effort.
13. Return and Deletion of Data
Upon termination or expiry of the Services, the Customer may export Customer Data using available tools before access ends.
Following termination, Taskploy will delete or anonymize Personal Information processed on behalf of the Customer within a reasonable period, except where retention is required by law, necessary to resolve disputes, or necessary for backup systems that are overwritten in the ordinary course.
Deletion requests for active accounts should be submitted through account settings or support channels.
14. International Transfers
Personal Information may be processed in Canada, the United States, and other countries where Taskploy or its Sub-processors operate.
Where Applicable Data Protection Law requires safeguards for cross-border transfers, Taskploy will implement appropriate mechanisms such as contractual clauses, adequacy decisions, or other lawful transfer tools.
Enterprise Customers with specific data-residency requirements should discuss available options before purchase.
15. Audits and Information
Taskploy will make available information reasonably necessary to demonstrate compliance with this DPA, which may include summaries of security practices, responses to security questionnaires, and available third-party audit reports where applicable.
Except where required by Applicable Data Protection Law or an enterprise agreement, on-site audits are available no more than once per twelve-month period upon 30 days’ written notice, during normal business hours, subject to confidentiality, safety, and operational constraints. The Customer bears its own audit costs unless an audit reveals a material breach by Taskploy of this DPA.
16. Restricted Transfers and Government Requests
If Taskploy receives a legally binding request from a public authority for disclosure of Personal Information processed on behalf of the Customer, Taskploy will, where legally permitted:
- review the request for validity;
- challenge overly broad requests; and
- notify the Customer unless prohibited by law.
17. Liability
Each party’s liability arising from or relating to this DPA is subject to the limitations and exclusions in the Terms or applicable Order Form, except where liability cannot be limited under Applicable Data Protection Law.
18. Term and Precedence
This DPA remains in effect for as long as Taskploy processes Personal Information on behalf of the Customer. Provisions that by nature should survive termination will survive, including confidentiality, deletion, and incident-related obligations.
This DPA is incorporated into the agreement between the parties by reference when the Customer accepts the Terms or executes an Order Form referencing it. No separate signature is required unless requested for Enterprise procurement.
Enterprise Customers requiring a countersigned DPA may request one at legal@taskploy.com.
19. Contact
Data protection enquiries:
Taskploy Technologies Inc.
Attn: Privacy Officer
privacy@taskploy.com
Legal and DPA execution requests: