Data Processing Agreement

Template · Governed by Law 25 (Quebec) / PIPEDA · Version 5.0.0 — November 7, 2026

Between Solutions iCivic inc. ("iCivic" or "the Processor"), a company based in Gatineau, Quebec, Canada, and [ORGANIZATION NAME] ("the Client" or "the Controller"), hereinafter collectively referred to as "the Parties."

Article 1 — Purpose, definitions and precedence

1.1 Purpose

This agreement governs the processing by iCivic, acting as mandatary, of personal information entrusted by the Client in connection with the use of the iCivic institutional dashboard. It constitutes the written mandate required by section 18.3 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) or, where the Client is a public body, by section 67.2 of the Act respecting access to documents held by public bodies and the protection of personal information (CQLR, c. A-2.1). It supplements the service agreement concluded between the Parties (the Institutional Terms of Service).

1.2 Definitions

In this agreement:

• "Information" means the personal information that the Client entrusts to iCivic or that its operators generate while using the dashboard, described in Schedule A;
• "Logs" means all records produced by iCivic's systems about the Client and its operators, namely:
  1. the audit log, which records the actions of the Client's operators in the dashboard and iCivic's interventions on the organization's account (for example, its creation);
  2. the iCivic access log, which records access by iCivic personnel to the Information in the manner set out in section 5.8;
  3. the technical logs: web requests, error traces, login-attempt rate-limiting counters and email delivery records.

The term "Logs" is used with this single meaning throughout this agreement and its schedules. No category of log is excluded from this agreement.

1.3 Precedence

For any matter relating to the processing of the Information, this agreement prevails over the Institutional Terms of Service, any purchase order and any other contractual document binding the Parties, regardless of their date. Only a written amendment, signed by both Parties and expressly referring to this section, may derogate from it.

Article 2 — Term

This agreement enters into force on the date of its signature by both Parties and remains in force for the entire duration of the service agreement, and beyond for as long as iCivic holds Information. Confidentiality and data destruction obligations survive termination for a period of five (5) years.

Article 3 — Nature, purpose and legal basis of processing

iCivic processes the Information for the following purposes:

• Operator account management — creation, authentication, role assignment (RBAC) and deactivation of dashboard access;
• Audit log — recording administrative actions and data access for security and traceability purposes;
• Operational notifications — sending threshold alerts and periodic reports to the email addresses designated by the Client;
• AI assistant — processing the requests an operator chooses to submit to the assistant built into the dashboard.

The Client is responsible for ensuring that the processing rests on a valid legal basis (operator consent or legitimate interest within the employment relationship) before entrusting this information to iCivic.

iCivic uses the Information solely to perform the service agreement; it does not use it for its own purposes and does not sell it.

Article 4 — Documented instructions

iCivic processes the Information only in accordance with the Client's documented instructions, as set out in the service agreement, this agreement and the configuration made by the Client's operators in the dashboard. If iCivic is required by law to carry out processing not provided for herein, it informs the Client in advance, unless prohibited by law.

If iCivic considers that a Client instruction infringes an applicable legal provision, it informs the Client without delay.

Article 5 — iCivic's obligations (mandatary)

5.1 Confidentiality

iCivic ensures that every person authorized to process the Information is bound by a confidentiality undertaking or subject to an appropriate statutory duty of confidentiality. This obligation survives the end of the agreement.

5.2 Security

iCivic implements and maintains the following technical and organizational measures:

• TLS 1.3 encryption of all communications;
• Encryption of data at rest (AES-256);
• Role-based access control (RBAC) and multi-organization isolation via Row Level Security (RLS), verified by automated tests;
• IP address handling: salted hashing (SHA-256) before any storage on consumer-facing surfaces; in the audit log, retention in clear text for a maximum of ninety (90) days for security and traceability purposes, then automatic truncation of the final segment (/24 for IPv4, /48 for IPv6), which permanently removes host identification;
• Keeping of the Logs defined in section 1.2, including the iCivic access log (section 5.8);
• Centralized secrets management (no secrets in clear text in the code);
• Periodic security audits.

5.3 Sub-processors

The Client authorizes iCivic to engage the sub-processors listed in Schedule B.

iCivic gives the Client at least thirty (30) days' prior notice before adding or replacing a sub-processor that will process Information. The Client may object in writing, on reasonable grounds, within that period. Failing agreement between the Parties, the Client may terminate the services affected by the change, without penalty or termination fee.

iCivic imposes on each sub-processor protection obligations at least equivalent to those in this agreement. A sub-processor may in turn entrust the processing of Information to a third party only on the same terms; that third party is then subject to this section as if it had been designated directly.

iCivic remains liable to the Client for the performance of the obligations of its sub-processors and of the third parties they engage. Where a sub-processor's standard terms fall short of the level of this agreement, iCivic answers to the Client for the gap as for its own act.

5.4 Assistance with data subject rights

iCivic assists the Client, to the extent reasonably possible and according to the nature of the processing, in responding to requests to exercise rights (access, rectification, erasure, portability, cessation of dissemination) made by data subjects, within the time limits set by law.

5.5 Notice of breach, attempted breach and incident

iCivic notifies the Client without delay, and no later than seventy-two (72) hours after becoming aware of it, of:

• any breach or attempted breach, by any person, of any of the obligations relating to the confidentiality of the Information;
• any confidentiality incident affecting the Information, namely access, use or communication not authorized by law, loss, or any other breach of its protection.

This notice is not conditional on a risk of serious injury. That threshold governs notice to the Commission d'accès à l'information du Québec (CAI) and to the persons concerned; it does not limit the notice owed to the Client.

The notice specifies the nature of the event, the Information affected or targeted, the measures taken or planned and the contact details of iCivic's point of contact. Elements still unknown at the time of the notice are provided as soon as they are established.

iCivic assists the Client in assessing the risk of injury and with its obligations to notify the CAI and the persons concerned, and records the incident in its incident register.

5.6 Verification

iCivic allows the Client's person in charge of the protection of personal information to carry out any verification relating to the confidentiality of the Information. To that end, iCivic provides, upon written request, the information necessary to demonstrate compliance with this agreement, including the relevant Logs and available security attestations.

iCivic may charge reasonable fees for the preparation of audit reports beyond the usual scope, without those fees restricting the verification right set out in the preceding paragraph or the right to obtain the extract provided for in section 5.8.

5.7 Requests from a public authority

If iCivic receives from a public authority, whether of Quebec, of Canada or foreign, a binding request concerning Information (order, warrant, subpoena or equivalent request), iCivic:

• notifies the Client without delay, unless applicable law prohibits it; in that case, it notifies the Client as soon as the prohibition ends;
• discloses only the minimum required by the request;
• challenges the request, or seeks to narrow its scope, where there are reasonable grounds to do so;
• never discloses Information to an authority voluntarily, in the absence of a binding request.

This section also applies to requests received by a sub-processor, to the extent that the sub-processor informs iCivic of them.

5.8 Access by iCivic personnel

Who. Technical access to the Information is reserved for iCivic personnel designated by name for that purpose, all located in Quebec and bound by a confidentiality obligation. As of this version, a single person holds such access. Upon written request, iCivic tells the Client how many people hold it and who they are.

By what means. Such access is exercised only through iCivic's internal administration console, protected by two-factor authentication, or through direct database access, opened with the designated person’s named account with the hosting provider, protected by two-factor authentication. iCivic never opens a session in the name of a Client operator.

When. Access takes place only for a documented need: a support request from the Client, diagnosis or handling of an incident, or a legal obligation.

Logging. Each entry in the iCivic access log states the identity of the person, the organization concerned, the timestamp, the means used and the reason. For the administration console, the entry is made by the system before any access, and the console does not give access to the Information if the entry fails. For direct database access, the entry is made by the designated person, before connecting. This entry is declarative: as of this version, no mechanism automatically detects direct access that was not entered. This log is protected against modification and deletion, and is retained for seven (7) years (Article 8).

Extract. Upon the Client's written request, iCivic sends it, within ten (10) days, the extract of the iCivic access log that concerns it, for the requested period. This right is exercised free of charge and independently of section 5.6.

Notice. iCivic notifies the Client, within seventy-two (72) hours, of any access to its Information that it did not itself request. Where the access took place in the context of an incident, the notice provided for in section 5.5 serves that purpose.

Article 6 — Client's obligations (controller)

• Provide processing instructions that comply with applicable law;
• Establish and document the legal basis for processing before entrusting personal information to iCivic;
• Inform its operators of the processing of their personal information by iCivic, in accordance with its own disclosure obligations;
• Designate authorized operator accounts and promptly revoke them upon departure or change of role;
• Notify iCivic without delay of any confidentiality incident it becomes aware of that could affect iCivic's systems.

Article 7 — Communications of personal information outside Quebec

Some of iCivic's sub-processors are established or process Information outside Quebec. Schedule B lists each of these communications, with the recipient, the territory, the Information concerned and the condition under which it takes place. No communication outside Quebec takes place other than those listed there.

For each one, iCivic documents a privacy impact assessment taking into account the sensitivity of the Information, the purpose, the protection measures and the legal regime of the State concerned, and provides the Client with a summary upon request, to support it in its own obligations.

The Client, by signing this agreement, authorizes these communications under the conditions described in Schedule B.

Article 8 — Retention periods and destruction

• Active operator accounts — retained as long as the account is active.
• Deactivated operator accounts — access is revoked immediately. Account information is retained for the duration of the service agreement, so that actions already recorded in the audit log remain attributable; it is deleted or anonymized upon the Client's written request, or automatically upon termination as set out below.
• Audit log and iCivic access log — retained for seven (7) years, a period adopted for traceability and compliance purposes (SOC 2). The IP address in the audit log is in clear text only for the first ninety (90) days: beyond that, it is automatically truncated (/24 for IPv4, /48 for IPv6) and can no longer identify a workstation.
• Technical logs — retained for the period specific to each tool, which iCivic discloses to the Client upon request.
• Upon termination of the service agreement — all personal information of the Client's operators is deleted or anonymized within thirty (30) days of termination. iCivic provides the Client, upon request, with a certificate of destruction.

Article 9 — Data subject rights

As the Client is the controller for this processing, operators exercise their rights with the Client. iCivic assists the Client in accordance with section 5.4.

An operator may also write directly to legal@icivic.app; iCivic acknowledges receipt and responds within thirty (30) days, in coordination with the Client. The dashboard also allows each operator to update their own authentication settings (password, two-factor).

Two limits, stated here rather than discovered in use: an operator cannot delete their own account, which falls under the Client's access management (Article 6); and audit log entries cannot be erased at the operator's sole initiative, their retention serving the security and traceability purposes described in Article 8.

Article 10 — Liability

Each Party is responsible for damages caused by its own breaches of this agreement or of applicable law. iCivic's liability is limited, to the extent permitted by law, to the amounts paid by the Client during the twelve (12) months preceding the damaging event. This limitation does not apply in the event of gross negligence or willful misconduct.

Article 11 — Governing law and dispute resolution

This agreement is governed by the laws of Quebec and the applicable federal laws of Canada. Any dispute will be submitted to the competent courts of Quebec, district of Gatineau. The Parties agree to attempt amicable resolution within thirty (30) days following notification of a dispute.

Article 12 — French version and language primacy

This agreement is drawn up in French. An English version is made available to the Client for convenience. In the event of any discrepancy between the French version and the English version, the French version prevails.

The governing version is the one whose number and fingerprint appear on the copy signed by the Parties.

Article 13 — Amendments

iCivic may amend this agreement to reflect regulatory or operational changes, with thirty (30) days' prior notice. If the Client objects, it may terminate the service agreement in accordance with the procedures set out in the Institutional Terms of Service.

Article 14 — Contact — Privacy Officer

iCivic — Privacy Officer
Gatineau, Quebec, Canada
legal@icivic.app

Schedule A — Information processed

The wait-time data accessible in the dashboard consists of aggregated, anonymized statistics containing no personal information and is not covered by this agreement.

Schedule B — Sub-processors and communications outside Quebec

B.1 Communications outside Quebec

B.2 Sub-processors processing the Information in Quebec

Signatures

The Parties acknowledge having read and accepted this agreement. It takes effect on the date of the last signature affixed below.

For any question: legal@icivic.app · Solutions iCivic inc. — Privacy Officer · Gatineau, Quebec, Canada