Data Processing Agreement - Walaw

Last Updated: October 1, 2026

This Data Processing Agreement (this "DPA") applies to the extent a Client is subject to the Act respecting the protection of personal information in the private sector (Québec), the Personal Information Protection and Electronic Documents Act (Canada), the General Data Protection Regulation (European Union), or any other applicable data protection law requiring a written agreement between a data controller and its service provider or processor, when Walaw processes Personal Information on the Client's behalf under the Client's Subscription to the Service, as provided for in Section 7(e) of the Terms of Use.

This DPA is incorporated into and forms part of the Terms of Use.

Capitalized terms used but not defined in this DPA have the meaning given to them in the Terms of Use.

PART 1 – DEFINITIONS AND INTERPRETATION

ARTICLE 1 – DEFINITIONS

1.1 The following definitions and rules of interpretation apply in this DPA.

"Data Subject" means an individual who is the subject of Personal Information.

"Personal Information" means any information Walaw collects, uses, processes, or maintains for the Client that is about or relates to an identifiable individual, or that identifies or can be used to identify that individual, directly or indirectly, either alone or in combination with other information.

"Processing, processes, or process" means any activity that involves the use of Personal Information or that the relevant Privacy and Data Protection Laws may otherwise include in the definition of processing, processes, or process. It includes collecting, using, disclosing, or carrying out any operation or set of operations on the Personal Information.

"Privacy and Data Protection Laws" means all applicable federal, provincial, and foreign laws and regulations relating to the processing, protection, or privacy of Personal Information, as each may be amended or replaced from time to time, including without limitation the Act respecting the protection of personal information in the private sector (Québec), and the Personal Information Protection and Electronic Documents Act (Canada).

"Security Breach" means any act or omission that materially compromises the security, confidentiality, or integrity of Personal Information or the physical, technical, administrative, or organizational safeguards put in place to protect it.

PART 2 – DATA PROCESSING

ARTICLE 2 – CLIENT RESPONSIBILITIES

2.1 The Client remains at all times accountable for and in control of the Personal Information, and responsible for its compliance obligations under the applicable Privacy and Data Protection Laws, providing any required notices and obtaining any required consents, and for the processing instructions it gives to Walaw.

2.2 The Client represents and warrants that Walaw's expected use of the Personal Information for the Service and as specifically instructed by the Client under this DPA will comply with all Privacy and Data Protection Laws.

ARTICLE 3 – PROVIDER OBLIGATIONS

3.1 Walaw will only process the Personal Information to the extent, and in such a manner, as is necessary for the performance of the Service, which, for greater certainty, includes maintaining, improving and enhancing the Service. Maintaining, improving and enhancing the Service does not include using the Personal Information to train or fine-tune any artificial intelligence or machine learning model, whether Walaw's or a third party's, and Walaw will not permit any subprocessor to use the Personal Information for such purposes. Walaw will not process the Personal Information in a way that does not comply with this DPA, the Client's instructions, or the Privacy and Data Protection Laws.

3.2 Walaw will promptly comply with any Client request or instruction requiring Walaw to amend, transfer, or delete the Personal Information, or to stop, mitigate, or remedy any unauthorized processing.

3.3 Walaw will maintain the confidentiality of all Personal Information and will not disclose Personal Information to third parties unless the Client or this DPA specifically authorizes the disclosure in compliance with Privacy and Data Protection Laws, or as otherwise required by law. If a law requires Walaw to process or disclose Personal Information, Walaw will first notify the Client of the legal requirement and give the Client an opportunity to object or challenge the requirement at the Client's sole cost and expense, unless the law prohibits such notice.

3.4 Walaw will reasonably assist the Client with meeting the Client's compliance obligations under the Privacy and Data Protection Laws, considering the nature of Walaw's processing and the information available to Walaw. The Client acknowledges that Walaw is under no duty to investigate the completeness, accuracy, or sufficiency of any specific Client instructions or the Personal Information other than as required under the Privacy and Data Protection Laws.

3.5 Walaw will limit Personal Information access to those employees and subprocessors who require it to meet Walaw's obligations under this DPA and the Terms of Use.

3.6 Walaw will implement and maintain appropriate technical and organizational measures designed to safeguard Personal Information against unauthorized or unlawful processing, access, copying, modification, storage, reproduction, display, or distribution, and against accidental loss, destruction, or damage.

3.7 Walaw will promptly notify the Client if it becomes aware of any Security Breach and will take steps to contain and mitigate the Security Breach. Walaw will reasonably co-operate with the Client in the Client's handling of the matter, including making available all relevant information to the extent required to comply with all Privacy and Data Protection Laws. Walaw will not inform any third party of any Security Breach without first obtaining the Client's prior written consent, except when Privacy and Data Protection Laws or other laws or regulations require it. Walaw agrees that the Client has the sole right, to the extent permitted by applicable laws, to determine whether to provide notice of the Security Breach to any Data Subjects, regulators, law enforcement agencies, or others, as required by Privacy and Data Protection Laws.

ARTICLE 4 – SUBPROCESSORS

4.1 The Client agrees that Walaw may engage subprocessors to process the Personal Information on the Client's behalf, provided that Walaw enters into a written contract with the subprocessor that imposes data protection terms requiring the subprocessor to protect the Personal Information to the standard required by applicable Privacy and Data Protection Laws. Walaw will provide a list of current subprocessors to the Client upon reasonable prior notice.

ARTICLE 5 – COMPLAINTS, DATA SUBJECT REQUESTS, AND THIRD-PARTY RIGHTS

5.1 Walaw will promptly notify the Client if it receives any complaint, notice, or communication that directly or indirectly relates to the Personal Information processing or to either Party's compliance with the Privacy and Data Protection Laws.

5.2 Walaw will promptly notify the Client if it receives a request from a Data Subject for access to their Personal Information or a request to correct, delete, or withdraw consent from any use by the Client or Walaw of the same.

5.3 Walaw will cooperate with the Client in responding to any complaint, notice, communication, or Data Subject request.

5.4 Walaw will not directly disclose the Personal Information to any Data Subject or to a third party unless the disclosure is required by law.

ARTICLE 6 – INTERNATIONAL TRANSFERS

6.1 The Client acknowledges and agrees that Walaw may process the Personal Information on a global basis as necessary for the performance of the Service, and in particular that Personal Information may be transferred to and processed by Walaw in Canada, the United States, and other jurisdictions where Walaw's affiliates and subprocessors have operations. Wherever the Personal Information is transferred outside its country of origin, each Party will ensure such transfers are made in compliance with the requirements of applicable Privacy and Data Protection Laws.

ARTICLE 7 – AUDIT

7.1 Upon the Client's written request at reasonable intervals, and subject to reasonable confidentiality controls, Walaw will make available to the Client a copy of Walaw's most recent third-party audit report or security certification, if any.

7.2 To the extent the report provided under Section 7.1 does not reasonably satisfy the Client's compliance obligations under Privacy and Data Protection Laws, the Client may request that an independent third-party representative conduct an audit of Walaw's data security infrastructure and procedures, provided that: (a) the Client provides reasonable prior written notice; (b) the audit is conducted during business hours and causes no more than minimal disruption to Walaw's operations; (c) the audit occurs no more than once per calendar year, unless otherwise required by Privacy and Data Protection Laws or a regulatory authority; (d) the audit is restricted to data relevant to the Client, with no access to information concerning other clients of Walaw; and (e) the Client bears the costs of the audit, including reasonable compensation to Walaw for time expended.

PART 3 – TERM, TERMINATION, AND DATA RETURN

ARTICLE 8 – TERM AND TERMINATION

8.1 This DPA will remain in full force and effect until the expiry or termination of the Subscription, or until the Parties mutually agree in writing to terminate the DPA (the "Term").

8.2 If a change in any Privacy and Data Protection Law prevents either Party from fulfilling all or part of its obligations, the Parties will suspend the processing of Personal Information until that processing complies with the new requirements. If the Parties are unable to bring the Personal Information processing into compliance by making commercially reasonable efforts, either Party may terminate this DPA upon written notice to the other Party, without prejudice to any Fees incurred by the Client prior to suspension or termination.

ARTICLE 9 – DATA RETURN AND DESTRUCTION

9.1 Upon the Client's written request following the termination or expiration of the Subscription, Walaw will securely destroy or, if directed by the Client, return and not retain, all or any Personal Information related to this DPA in its possession or control, unless applicable law permits or requires retention by Walaw. Personal Information contained in backups will be destroyed when such backups expire in the ordinary course, not exceeding one (1) year, and will remain subject to the confidentiality and security obligations of this DPA until then.

9.2 If any law, regulation, or government or regulatory body requires Walaw to retain any documents or materials that it would otherwise be required to return or destroy, Walaw will, to the extent permitted by law, notify the Client in writing of that retention requirement and, to the extent determinable, when the retention requirement ends.

9.3 Walaw will certify in writing that it has destroyed the Personal Information upon the Client's request, subject to the backups referred to in Article 9.1, which will be destroyed upon their expiration.

PART 4 – LIMITATION OF LIABILITY

ARTICLE 10 – LIMITATION OF LIABILITY

10.1 The limitations of liability set forth in the Terms of Use will apply to this DPA. For greater certainty, nothing in this DPA shall be construed to expand the liability of either Party beyond the limits established in the Terms of Use.

PART 5 – GENERAL PROVISIONS

ARTICLE 11 – ENTIRE AGREEMENT

11.1 This DPA, together with the Terms of Use and the Client's Subscription Terms, constitutes the entire agreement between the Parties with respect to its subject matter, and supersedes all prior agreements, representations, and understandings relating thereto. In the event of any conflict between the Terms of Use and the DPA, this DPA prevails over the Terms of Use to the extent of the conflict.

ARTICLE 12 – GOVERNING LAW

12.1 This DPA is governed by the laws of the Province of Québec and the federal laws of Canada applicable therein, without regard to its conflict of laws principles.