Data Processing Agreement.

About this DPA

This Data Processing Agreement ("DPA") forms part of the Cloud Alter Inc. Terms of Service (the "Terms") between Cloud Alter Inc. ("Cloud Alter") and Customer, and applies whenever Cloud Alter processes Customer Personal Data. For the processing of personal information, this DPA prevails over the Terms. Capitalized terms not defined here have the meanings given in the Terms.

1. Definitions

• "Data Protection Laws" means PIPEDA; Alberta's and British Columbia's Personal Information Protection Acts; Québec's Act respecting the protection of personal information in the private sector; and, to the extent they apply to Customer Personal Data, the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws including the California Consumer Privacy Act as amended ("CCPA") — each as amended or replaced.
• "Customer Personal Data" means personal information contained in Customer Data that Cloud Alter processes on Customer's behalf.
• "Data Subject" means the identified or identifiable individual to whom Customer Personal Data relates.
• "Process" means any operation performed on personal information, including collection, recording, storage, use, transmission, disclosure and deletion.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of, or access to, Customer Personal Data in the control of Cloud Alter or its Sub-processors. It includes a "breach of security safeguards" under PIPEDA and a "confidentiality incident" under Québec law. It excludes unsuccessful attempts, such as pings, port scans and failed log-ins, that do not compromise security.
• "Sub-processor" means a third party Cloud Alter engages to Process Customer Personal Data on its behalf. Customer-Selected Providers are not Sub-processors.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.

2. Roles and Scope

2.1 Roles

Customer is the organization in control of, and the controller or business for, Customer Personal Data. Cloud Alter processes it on Customer's behalf as a service provider, processor or third-party processor. If Customer is itself a processor for its own clients, Customer warrants that its instructions and this DPA are authorized by the relevant controller, and Cloud Alter acts as a sub-processor.

2.2 Cloud Alter as independent controller

Cloud Alter is an independent controller, not a processor, of (a) personal information about Customer's representatives and Authorized Users, which its Privacy Policy covers; (b) Usage Data; and (c) traffic metadata within Customer Personal Data (telephone numbers, IP addresses, call and message records and fraud signals, but not message content or call media) that it uses, to the extent necessary and as Data Protection Laws permit, for its own fraud prevention, network security, billing and legal compliance.

2.3 Details

Annex 1 describes the subject matter, nature, purpose and duration of the processing, and the types of personal information and Data Subjects.

2.4 Customer-Selected Providers

Carriers, SMS suppliers, gateways and other Customer-Selected Providers that Customer configures are not Sub-processors. Cloud Alter transmits Customer Personal Data to them on Customer's instruction. Customer is responsible for its agreements with them and for the lawfulness of those transmissions, including international transfers.

3. Customer's Obligations

3.1 Lawful basis and notices

Customer is responsible for: (a) having a lawful basis and all consents for the Processing, including for call recording and marketing messages; (b) giving Data Subjects the notices Data Protection Laws require, including that a service provider may process their information outside their province or country; (c) the accuracy of Customer Personal Data; (d) ensuring its instructions comply with Data Protection Laws; (e) carrying out any privacy impact assessments it requires, including Québec transfer assessments; and (f) as the organization in control, deciding on and making any breach notifications to regulators and individuals.

3.2 No sensitive data

Customer will not use the Services to Process health information, payment-card data, government identification numbers, biometric data or children's data, except as message content Customer is lawfully entitled to transmit. The Services are not designed to meet HIPAA or PCI DSS requirements unless the parties agree otherwise in writing.

3.3 Customer's security

Customer is responsible for the security of its configuration, credentials, users, equipment and Client Software installations, and for the security options it chooses to enable. Customer will not send Customer Personal Data to Cloud Alter through Telegram or WhatsApp.

4. Processing on Instructions

4.1 Instructions

Cloud Alter will Process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise, in which case Cloud Alter will tell Customer before Processing unless the law prohibits it. The Agreement, this DPA, and Customer's configuration and use of the Services (including routing, retention settings and features enabled) are Customer's complete instructions. Additional instructions require written agreement and may incur fees.

4.2 Unlawful instructions

Cloud Alter will tell Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected Processing until the instruction is confirmed or changed. Cloud Alter is not obliged to review Customer's instructions for legal compliance.

4.3 Use limits

Cloud Alter will not sell Customer Personal Data or share it for cross-context behavioural advertising, use it for any purpose other than providing the Services and the purposes in Section 2.2, or combine it with other data except as Data Protection Laws permit.

5. Personnel

Cloud Alter limits access to Customer Personal Data to personnel who need it to perform the Agreement, who are bound by confidentiality obligations, and who receive privacy and security training.

6. Security and Segregation

6.1 Security measures

Cloud Alter will implement and maintain the technical and organizational measures in Annex 2, appropriate to the risk of the Processing. Cloud Alter may update them, provided the overall level of protection does not materially decrease.

6.2 Segregation of customer data

1. TextEnvoy: each customer's platform runs on a dedicated instance with its own database. No other customer's data is stored on it.
2. Cloudfonica and Optima Saver: these work like a cloud-hosting platform. Sign-up, accounts and billing run on a shared platform, where each customer's records carry a unique account identifier and access controls at the application and database layers restrict each customer to its own records. Each customer creates and destroys its own servers, and each server's data, including its CDRs, is kept on that server. Each customer's tunnels are authenticated with that customer's own credentials.
3. Administrative access to customer environments is restricted to authorized personnel, logged and reviewed.
4. Test environments do not use Customer Personal Data unless it is anonymized, except where needed to resolve Customer's own support request with its authorization.
5. Backups are encrypted and either kept per customer or tagged by account.

6.3 Encryption

Portals and APIs use TLS 1.2 or higher. Databases and backups are encrypted at rest where the hosting platform supports it. Tunnel traffic between Client Software and Cloud Alter's servers is encrypted. SIP, RTP and SMPP connections to Customer-Selected Providers are encrypted only where both endpoints support it (for example TLS, SRTP or SMPP over TLS), and Customer decides whether to require it.

7. Sub-processors

7.1 Authorization

Customer generally authorizes Cloud Alter to engage Sub-processors. Annex 3 and any annex under Section 16 show the list on the date of this version. The current list is kept at cloudfonica.com/legal/subprocessors and prevails.

7.2 Flow-down

Cloud Alter will have a written agreement with each Sub-processor imposing data-protection obligations no less protective than this DPA, to the extent relevant to the services it provides. Cloud Alter remains responsible for each Sub-processor's performance of those obligations, subject to the limitations of liability in the Terms.

7.3 Changes and objections

Cloud Alter will give at least 15 days' notice of a new or replacement Sub-processor by updating the list and emailing Customer's administrative contact. Customer may object on reasonable data-protection grounds by written notice within that period. The parties will discuss the objection in good faith. If it is not resolved within 30 days, Customer may terminate the affected Services by notice, and Cloud Alter will refund Customer's Unused Prepayment for them. This is Customer's sole remedy for an objection.

7.4 Urgent replacement

If a Sub-processor must be replaced urgently for reasons outside Cloud Alter's control, such as a security issue or the provider's failure, Cloud Alter may replace it with as much prior notice as the situation allows and will notify Customer as soon as practicable. Section 7.3's objection right still applies.

8. Data Subject Requests and Assistance

8.1 Requests

If Cloud Alter receives a request from a Data Subject about Customer Personal Data, it will promptly forward the request to Customer where it can identify Customer, and will not respond except to refer the Data Subject to Customer, unless the law requires otherwise.

8.2 Self-service tools

The portals let Customer search, export and delete CDRs and configuration. Where they are not enough, Cloud Alter will provide reasonable assistance, at Customer's reasonable cost where the effort is more than minimal.

8.3 Assessments

Cloud Alter will provide reasonable information about the Services for Customer's privacy and data-protection impact assessments, Québec transfer assessments and consultations with regulators, at Customer's reasonable cost where the effort is more than minimal.

9. Security Incidents

9.1 Notice

Cloud Alter will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data.

9.2 Content

To the extent known, the notice will describe the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Information may be provided in stages as it becomes available.

9.3 Cooperation

Cloud Alter will take reasonable steps to contain, investigate and mitigate the Security Incident, and will reasonably cooperate so Customer can meet its obligations, including assessing whether there is a real risk of significant harm, notifying regulators and individuals, and keeping breach records.

9.4 Notifications to others

Customer decides on and makes notifications to regulators and Data Subjects. Cloud Alter will not notify them about a Security Incident affecting Customer Personal Data without Customer's consent, unless the law requires Cloud Alter to do so.

9.5 No admission

A notification under this Section is not an admission of fault or liability.

9.6 Costs

If a Security Incident results from Cloud Alter's breach of this DPA, Cloud Alter will reimburse Customer's reasonable, documented costs of legally required notifications, subject to the limitations of liability in the Terms. Otherwise each party bears its own costs.

9.7 Records

Cloud Alter keeps a record of every Security Incident affecting Customer Personal Data for at least 5 years and will give Customer the parts relevant to it on request.

10. Audits and Compliance Information

10.1 Information

On written request, no more than once every 12 months, Cloud Alter will provide a completed standard security questionnaire, a summary of its security policies, and copies or summaries of available third-party certifications or audit reports for Cloud Alter or its key Sub-processors (such as a hosting provider's SOC 2 or ISO 27001 report), all under confidentiality.

10.2 Audits

If the information in Section 10.1 is not enough to show compliance with this DPA, a regulator requires an audit, or a Security Incident has affected Customer, Customer may audit Cloud Alter's compliance at its own cost, on these conditions:

1. at least 30 days' written notice with a proposed scope;
2. no more than once every 12 months, except where a regulator requires it or after a Security Incident;
3. during business hours, remotely where possible, and without unreasonably disrupting operations;
4. carried out by Customer or an independent auditor that is not a Cloud Alter competitor, under confidentiality;
5. no access to other customers' data or to Sub-processors' facilities, whose own reports will be provided instead;
6. Cloud Alter may charge for its personnel's time at its then-current professional-services rates; and
7. Customer gives Cloud Alter a copy of the audit report.

10.3 Remediation

Cloud Alter will remedy any material non-compliance an audit finds within a reasonable period agreed with Customer.

11. International Transfers

11.1 Locations

Cloud Alter and its Sub-processors Process Customer Personal Data in the locations listed in Annex 3. For TextEnvoy, the instance's primary data is hosted in the region Customer selects. Customer authorizes these transfers, and Cloud Alter will make sure they comply with Data Protection Laws.

11.2 Canada

Cloud Alter will use contractual and other means to provide a comparable level of protection while Customer Personal Data is processed outside Canada. Customer is responsible for notices to individuals and, for Québec, its own transfer assessment. Cloud Alter will provide the information in Annexes 1 to 3, and other information reasonably needed, to support that assessment.

11.3 EEA

Cloud Alter is subject to PIPEDA for this Processing. Transfers of Customer Personal Data from the EEA to Cloud Alter in Canada rely on the European Commission's adequacy decision for commercial organizations subject to PIPEDA. Where personal data subject to the GDPR is transferred to, hosted in or accessed from a country without an adequacy decision, by Cloud Alter or a Sub-processor, and no other valid transfer mechanism applies, the SCCs are incorporated into this DPA as follows: Module 1 for the data Cloud Alter controls under Section 2.2(c), Module 2 where Customer is a controller and Module 3 where Customer is a processor; the Clause 7 docking clause applies; Clause 9(a) Option 2 applies, with the notice period in Section 7.3; the optional wording in Clause 11 does not apply; Clause 17 Option 1 applies, with the law of Ireland; Clause 18 selects the courts of Ireland; and Annexes I to III are completed by Annexes 1 to 3 of this DPA, or by the annex that replaces them under Section 16. For onward transfers to Sub-processors in such countries, Cloud Alter will put SCCs or another valid transfer mechanism in place.

11.4 UK and Switzerland

For personal data subject to the UK GDPR, where a restricted transfer is not covered by UK adequacy regulations, the UK Addendum (version B1.0, or the version that replaces it) is incorporated, completed with the information in this DPA and its Annexes, including any annex under Section 16; in its Table 4, neither party may end it. For personal data subject to the Swiss Federal Act on Data Protection, where a transfer is not to a country the Swiss Federal Council recognizes as adequate, the SCCs apply with references to the GDPR read as references to that Act, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

11.5 Conflict

If the SCCs or the UK Addendum conflict with this DPA, they prevail.

12. Return and Deletion

12.1 During the Term

Customer can export CDRs and configuration through the portal or API, and can delete Customer Personal Data with the Services' tools.

12.2 After termination

Customer may export Customer Personal Data for 30 days after termination, as Section 14.5 of the Terms provides. After that period Cloud Alter will delete Customer Personal Data from active systems within 60 days, and from backups as they expire on their normal rotation, within 90 days. For TextEnvoy, SMS Annex 9.3 applies instead.

12.3 Retained data

Cloud Alter may keep Customer Personal Data where the law requires it (for example billing and tax records, legal holds and preservation orders) or where needed to establish or defend legal claims or prevent fraud. It will keep only what is needed, protect it under this DPA, and not Process it further for any other purpose. To the extent it keeps data for fraud prevention or legal claims, Cloud Alter does so as an independent controller under Section 2.2.

12.4 Certification

On written request, Cloud Alter will confirm deletion in writing.

13. U.S. State Privacy Law Terms

Where Customer Personal Data is subject to the CCPA or another U.S. state privacy law, Cloud Alter acts as a service provider or processor and:

1. will not sell or share it;
2. will not retain, use or disclose it for any purpose, including a commercial purpose, other than the business purposes specified in the Agreement, or outside the direct business relationship with Customer, except as those laws permit;
3. will not combine it with personal information from other sources, except as those laws permit;
4. will comply with those laws and provide the same level of privacy protection they require of businesses;
5. will notify Customer if it determines it can no longer meet its obligations under them;
6. agrees that Customer may, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use; and
7. for de-identified data, will take reasonable measures to prevent re-identification, publicly commit not to re-identify it, and require any recipient to do the same.

Cloud Alter certifies that it understands and will comply with these restrictions.

14. Requests from Public Authorities and Traceback

14.1 Disclosure

Cloud Alter will disclose Customer Personal Data to a public authority only where legally required, such as under a warrant, production order or subpoena, or where permitted in an emergency involving a risk of death or serious harm.

14.2 Notice

Unless legally prohibited, Cloud Alter will notify Customer promptly of the request and, where reasonable, redirect the authority to Customer.

14.3 Review

Cloud Alter will review each request's legality, challenge requests it has reasonable grounds to consider unlawful or overbroad, and disclose only the minimum information needed.

14.4 Traceback

Customer instructs Cloud Alter to respond to lawful traceback requests from carriers, regulators and industry traceback groups by disclosing the minimum information needed to identify the upstream source of specific traffic.

15. Liability

Each party's liability under or in connection with this DPA, including under the SCCs to the extent they permit, is subject to the exclusions and limitations of liability in the Terms. Nothing in this DPA limits a party's liability to Data Subjects where the SCCs do not allow it.

16. Term and Precedence

This DPA applies for as long as Cloud Alter Processes Customer Personal Data. For the Processing of personal information, the SCCs and UK Addendum (where they apply) prevail over this DPA, and this DPA prevails over the Terms. Subject to Section 11.5, an annex to this DPA that Cloud Alter publishes for a particular Service prevails over this DPA for the processing of personal information in that Service, and may replace Annexes 1 to 3 for it, including for the SCCs and the UK Addendum.

Annex 1 — Details of Processing

For the SCCs (Annex I.A and I.C): the data exporter is Customer and the data importer is Cloud Alter, each with the contact details in the Agreement and acting in the roles in Section 2.1. Acceptance of the Terms under Section 2.1 of the Terms counts as signature of the SCCs. The competent supervisory authority is the one determined under Clause 13 of the SCCs.

Annex 2 — Technical and Organizational Measures

Annex 3 — Sub-processors

Cloud Alter's own employees, in Bangladesh and India, operate and support the Services. They are not Sub-processors.

Payment processors such as PayPal handle Cloud Alter's own billing data and are listed in the Privacy Policy, not here. Customer-Selected Providers are not Sub-processors.