Data Processing Addendum

Effective Date: October 25, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between 18178160 CANADA INC. ("we") and each Business Customer ("Customer"). It applies automatically, without signature, whenever we process Customer Personal Data.

Capitalized terms not defined here have the meaning given in the Terms.

1. Definitions

Data Protection Law means all privacy laws that apply to the processing, including PIPEDA, Quebec's Act respecting the protection of personal information in the private sector, the EU GDPR, the UK GDPR and the Swiss FADP.

Customer Personal Data means personal information in Customer Content that we process on Customer's behalf.

Security Incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.

Subprocessor means a third party we engage to process Customer Personal Data.

2. Roles and scope

Customer is the controller (or the organization with control) of Customer Personal Data, and we are its processor (or service provider). Annex 1 describes the processing. Customer is responsible for having a lawful basis, and giving any notices and obtaining any consents, needed for us to process Customer Personal Data under the Terms.

We act as an independent controller for account, billing-contact and usage data we process to run our business, as described in our Privacy Policy. Our Merchant of Record processes payment data as its own controller.

3. Our obligations

We will:

1. process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA and Customer's use of the Service, unless the law requires otherwise, in which case we will tell Customer first where lawful;
2. tell Customer if we believe an instruction breaches Data Protection Law;
3. ensure everyone authorized to process Customer Personal Data is bound by confidentiality;
4. maintain the security measures in Annex 2, which we may update provided overall protection does not decrease;
5. help Customer, taking into account the nature of the processing, respond to requests from individuals exercising their privacy rights, and forward any such request we receive directly;
6. give Customer reasonable help with security, breach notification, impact assessments and consultations with regulators that relate to our processing; and
7. at the end of the Service, delete Customer Personal Data as described in Section 5.6 of the Terms, unless the law requires us to keep it.

4. Security Incidents

We will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident. We will provide the information Customer reasonably needs to meet its own notification duties, take reasonable steps to contain the incident, and keep a record of it. Notifying Customer is not an admission of fault.

5. Subprocessors

Customer authorizes the Subprocessors in the categories listed in Annex 3; the current list of named Subprocessors is available on request. We will impose data protection terms on each Subprocessor that protect Customer Personal Data at least as well as this DPA, and we remain responsible for their performance.

We will give at least 30 days' notice before adding or replacing a Subprocessor, by updating Annex 3 and emailing Customers who subscribe to updates at edwin@getarchetypes.com. Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.

6. International transfers

We are located in Canada. The European Commission recognizes Canada as providing adequate protection for organizations subject to PIPEDA, and the UK and Switzerland recognize the same, so transfers of Customer Personal Data to us need no further safeguards.

If that recognition ends, or for onward transfers to Subprocessors in countries without adequate protection, the parties agree that the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2, or Module 3 where Customer is itself a processor), the UK International Data Transfer Addendum and the Swiss amendments to those Clauses are incorporated by reference. For those Clauses: optional clause 7 does not apply; option 2 of clause 9 applies with the notice period in section 5; the optional language in clause 11 does not apply; clauses 17 and 18 select the law and courts of Ireland; and the annexes are completed by Annexes 1 to 3 of this DPA. Onward transfers may also rely on another valid mechanism, such as the EU-US Data Privacy Framework.

Within Canada, Customer remains responsible for any transfer assessments its own law requires, such as Quebec's assessment for transfers outside Quebec.

7. Audits

On written request, no more than once a year, we will answer Customer's reasonable security questionnaires and provide documentation needed to show compliance with this DPA. If that is not sufficient, or a regulator requires it, Customer may conduct an audit at its own cost, on 30 days' notice, during business hours, subject to confidentiality, and without access to other customers' data.

8. General

This DPA lasts as long as we process Customer Personal Data. If it conflicts with the Terms, this DPA prevails for Customer Personal Data. Section 11 of the Terms (Limitation of Liability) applies to this DPA, except where Data Protection Law does not allow liability to be limited.

Annex 1: Description of processing

Annex 2: Security measures

• Encryption of data in transit and at rest.
• Hosting on infrastructure operated by providers that maintain recognized security certifications.
• Access to production systems limited to personnel who need it, with multi-factor authentication.
• Regular backups, patching, access logging and a documented incident response process, including notification under Section 4.
• Security review of, and a written data processing agreement with, each Subprocessor before engagement. A detailed description of the measures is available on request.

Annex 3: Subprocessors