Personal information processing agreement

1. Parties and purpose

This agreement is entered into between Kitobiz (“Kitobiz”, “we”) and the business that uses the Kitobiz service (“the Business”). It forms part of the Terms of use and applies as soon as the Business records, receives or sends personal information by means of Kitobiz.

For the personal information of its own clients, leads, visitors, respondents and callers, the Business decides why and how it is collected: the Business is responsible for it. Kitobiz processes it only on the Business's behalf and according to its instructions, as provided for in section 18.3 of the Act respecting the protection of personal information in the private sector (Québec). This agreement sets out the obligations of each party.

2. Information and processing covered

• Persons concerned: the Business's clients and leads; visitors of its business card; people who fill out its forms, request a quote or book an appointment; people who call its phone assistant; members of its team.
• Information: contact information (name, email, phone number, address), content of requests, quotes, invoices, payments and reminders, messages, attached files, appointments, voice and transcriptions of calls, anonymized visit statistics.
• Processing: hosting, display, production and sending of the documents and messages the Business prepares or schedules, collection of payments, appointment booking, automated phone answering, synchronization with the tools the Business connects, backup and deletion.
• Duration: throughout the use of the service, until the deletion of the data provided for in section 9.

3. Instructions of the Business

Kitobiz processes the information only to provide the service, according to the Business's settings and actions in the application, which constitute its instructions. Kitobiz does not use it for its own purposes, does not sell it, does not rent it and does not use it for advertising. If an instruction appears to be contrary to the law, Kitobiz notifies the Business.

4. Confidentiality

The people at Kitobiz who can access the information are bound by confidentiality and access it only when necessary: support requested by the Business, correction of a problem, security. Their access is limited by role, recorded in a log and, for sensitive actions, justified.

5. Security measures

• Encryption of exchanges (HTTPS) and of data at rest at the hosting provider.
• Partitioning by business in the application and in the database (row-level security): a business never sees another business's data.
• Mandatory two-step verification; new verification before sensitive actions; permissions according to each member's role.
• Clients' files in private spaces, opened by temporary links; public links that expire after a time.
• Access tokens for connected tools (Google, QuickBooks, Sage) encrypted.
• Monitoring of errors and automated tasks; log of sensitive actions.

6. Sub-processors

The Business authorizes Kitobiz to use the providers below. Each one receives only the information necessary for its task and is bound by a processing agreement offering protection at least equivalent to this one.

Kitobiz notifies the Business by email at least 30 days before adding or replacing a provider. If the Business objects for a reasonable ground related to the protection of the information, it may close its account at no charge before the change comes into force.

7. Communications outside Québec

Several providers are located outside Québec. Before communicating information to them, Kitobiz conducted a privacy impact assessment and concluded that the protection is adequate, given the agreements and the measures in place (section 17 of the Act). This assessment is published: Assessment of communications outside Québec.

8. Rights of persons and incidents

• Requests from persons: if a person contacts Kitobiz about their information held by the Business, Kitobiz directs them to the Business and notifies the Business. Kitobiz helps the Business respond (consultation, correction, export, deletion) within the 30-day period provided for by the law.
• Confidentiality incidents: Kitobiz notifies the Business without undue delay, no later than 72 hours after becoming aware of it, describes to it the incident, the information concerned and the measures taken, and helps it assess the risk of serious injury and notify the Commission d'accès à l'information and the persons concerned. Kitobiz keeps a register of incidents.

9. End of service

The Business can export its data at any time (Settings > My account). When the account is closed, Kitobiz immediately destroys the Business's information, except the information a payment provider must keep under its own legal obligations. The hosting provider's backup copies are overwritten according to its normal cycle.

10. Obligations of the Business

• Collect its clients' information lawfully and inform them of the use it makes of it.
• Obtain the required consents, in particular for commercial emails and text messages (Canada's Anti-Spam Legislation), and honour unsubscribe requests.
• Not record in Kitobiz information unrelated to the service (health, social insurance numbers, its clients' banking data, etc.).
• Keep its access credentials confidential and give each member of its team only the role necessary.
• Respond to requests from the persons concerned, with Kitobiz's help if needed.

11. Information and verification

On reasonable request, Kitobiz provides the Business with the information necessary to demonstrate compliance with this agreement, in particular the description of the security measures and the up-to-date list of providers.

12. Changes, governing law and contact

Kitobiz may change this agreement; in the event of a significant change, the Business is notified of it and accepts it on its next visit. This agreement is governed by the laws of Québec and Canada that apply to it.

Person in charge of the protection of personal information: Marie-Andrée Aubergiste, person in charge of the protection of personal information, info@kitobiz.com.