Privacy Policy

1Introduction

SideDrawer Inc. (“SideDrawer”, “we”, “us”) has created this Privacy Policy (“Privacy Policy”) in order to set out how we collect, use, and disclose Personal Information (as hereinafter defined) through our Website and in the course of providing our SideDrawer software-as-a-service platform (the “Platform”), our mobile app (the “App”) and related services (collectively, the “Services”), each as more particularly described below and in our Terms of Use.

SideDrawer offers a technology solution for customers (including customers who are PSPs (as defined below)) and third-party Advisors (as defined below), in which end users can keep their personal, financial, and important records organized for life allowing PSPs and other Collaborators (as hereinafter defined) to collaborate and communicate with their clients and other people with whom they have a relationship through a single, living document repository. The Website, App and Platform allow end users to capture their critical life documents. The Website, App and Platform also provide the ability to establish permission-based access to PSPs and Collaborators who can access and process their clients’ and other people’s records in real-time.

The privacy of our users’ Personal Information is of great importance to us. By visiting our website located at www.SideDrawer.com, including subpages, (collectively, the “Website”), or using the App, Platform or Services in any manner, you acknowledge that you accept the practices and policies outlined in this Privacy Policy and you hereby consent to the collection, use and disclosure of your Personal Information in accordance with this Privacy Policy.

Our customers are responsible for complying with any regulations or laws that require providing notice, disclosure and/or obtaining consent prior to collecting their customers’ Personal Data using the Website, App, Platform, and/or Services. Please see Section 3. and Section 4. as well as our Data Processing Agreement, attached as Appendix A, for more information.

2What Does this Privacy Policy Cover?

This Privacy Policy covers our collection, use and disclosure of information about identifiable individuals and information which can be used to identify an individual (“Personal Information”). Personal Information may be collected about visitors to the Website, as well as our customers, end users, and other users who use the App, Platform, or Services.

This Privacy Policy covers the activities of SideDrawer only. This Privacy Policy does not apply to the practices of persons and companies that we do not own or control, including your Collaborators and our Tenant PSP customers who may use the Services to collect or access your Personal Information. For the purposes of this Privacy Policy: a “PSP” is an organization that provides professional financial, legal, estate planning, or other services to customers, including, without limitation, banks and other financial institutions, insurance brokers and companies, law firms, and accounting firms; and, an “Advisor” is an individual that provides professional financial, estate planning, legal or other services to clients. An Advisor may be a partner, employee, or contractor of a PSP. If you are a Collaborator (including PSPs and Advisors) and you submit any Personal Information to SideDrawer or the Platform, Website, App or Services, you are responsible for ensuring that you have obtained the necessary authorizations and consents from the relevant individuals to whom such Personal Information relates in order to make such Personal Information available to us for use and disclosure of such Personal Information in accordance with this Privacy Policy. If you are an end user and you submit any Personal Information to SideDrawer or the Platform, Website, App or Services (including any Personal Information that is submitted to SideDrawer or the Platform, Website, App or Services on your behalf by any Collaborator (including PSPs and Advisors on your behalf)), you consent to the use and disclosure of such Personal Information in accordance with this Privacy Policy.

3Collection of Personal Information

3.1User Account Information. In order to use the Platform, Website, App, and Services, users are required to have a valid SideDrawer account to log in (“Account”). When you register for the Services or create an Account, SideDrawer collects certain Personal Information from you (collectively, “Account Information”) to set up and administer your Account:

Name
Email address/es
Mobile number/s
Residential address/es

3.2Records. The purpose of the SideDrawer Website, App, Platform, and Services is to allow end users to store personal records and documents and to share those records and documents with Collaborators (including PSPs and Advisors). Accordingly, SideDrawer collects and stores these personal records that users or their PSPs, Advisors or other Collaborators choose to upload, which includes any Personal Information, including, without limitation, Personal Information such as financial, legal, health, investment, and estate records. SideDrawer does not generally access the Personal Information contained in end user’s records. However, SideDrawer will keep track of what types of documents and records have been uploaded.

3.3Sponsors. An end user customer or a PSP may purchase a subscription and Account for the Services for use by someone else. In such an instance, the end user customer or PSP is known as a “Sponsor” for that other end user, Account, and subscription. Sponsors may notify someone who the Sponsor wants to sponsor (such as its employees, clients, or family members) by inviting that person to create an Account. Sponsors are responsible for the payment of all subscription fees for the Accounts and end users they have sponsored. Upon termination of any Sponsor-initiated subscription, the applicable end user of the Sponsor-initiated subscription may be given the option to convert the applicable Account to an individual Account. When an Account is set up at the invitation of a Sponsor, that Sponsor is automatically given the ability to view, edit and upload content and records for such Account. An end user may revoke or change Sponsor permissions at any time other than in the case where the Sponsor is a Tenant PSP (as hereinafter defined). In the case where the Sponsor is a PSP who is using the Platform, Website, App and Services with such PSPs’ own services for Sub-processor Use (as hereinafter defined) (a “Tenant PSP”), the Tenant PSP will have console access to Accounts that are sponsored by that Tenant PSP and the end user for such Accounts will not have the ability to override or curtail such console access (even using the administrative functions of the Account). Console access to an Account means that the Tenant PSP has complete back-office level access to such Account and its record and records. A Tenant PSP will also be able to provide console-level access to that PSP’s personnel who may be involved in providing professional advice as well as other third parties. It is the Tenant PSP’s obligation to describe in its own privacy policy any other persons or organizations to whom it discloses Personal Information. Where a Sponsor other than a Tenant PSP has been given access to an end user’s Account, that Sponsor’s interaction with the Account will be in the role of a Collaborator and covered by the terms of this Privacy Policy relating to Collaborators. When a Sponsor is given access to an end user’s Account as a Tenant PSP, the Tenant PSP is the data controller for the collection, use, and disclosure of Personal Information and/or Personal Data collected in respect to such Account and the collection, use, and disclosure of such Personal Information and/or Personal Data will be governed by the Tenant PSP’s privacy policy.

3.4Collaborators. End users may invite third parties (including PSPs and Advisors), known as “Collaborators”, to upload, view and/or edit content and records in the end user’s Account. Accounts may also be created for end users by PSPs for use of the Platform, Website, App and Services with such PSPs’ own services. If an Account is created by a PSP for an end user, then the PSP will either (i) advise the applicable end user that an Account has been created for such end user and that the Platform, Website, App and Services are being used to store and process such end user’s content and records and the PSP will obtain such end user’s acceptance of SideDrawer’s Terms of Service and this Privacy Policy (which may be done by referring to such Terms of Service and Privacy Policy within the PSP’s own terms of service and privacy policy) (“OEM Use”), or (ii) ensure the use of the Account and the Platform, Website, App and Services will be governed solely by the PSP’s terms of service and privacy policy (“Sub-processor Use”). In the case of Sub-processor Use, the applicable PSP’s terms of service and privacy policy will apply to such PSP’s collection, use and processing of your Personal Information. In all cases, you acknowledge and agree that SideDrawer is not responsible or liable for the collection, use, disclosure, or any other processing of your Personal Information by any Collaborators (including PSPs and Advisors). SideDrawer collects the name and email address of such Collaborators from the requesting end user.

3.5 Payment Information. For customers who purchase paid Services, including Premium Services (as defined in our Terms of Use), a valid credit card number, type, expiration date, name and billing address (collectively, “Payment Information”) is collected, stored, used and processed by Stripe Inc. (“Stripe”), our third-party payment processor, and not by us.

Accordingly, the collection, storage, use and processing of your Payment Information is governed by Stripe’s applicable terms of service available at https://stripe.com/us/terms and privacy policy available at https://stripe.com/us/privacy. However, sometimes we may request and receive some of your Payment Information from Stripe in order to complete certain transactions you initiated through the Services, to enroll you in a discount or other rebate program you elected to participate in, to protect against or identify potentially fraudulent transactions, or otherwise as necessary to manage our business.

4Use of Personal Information.

In addition to the purposes identified above, in order to provide the Website, App, Platform, and Services, SideDrawer may use your Personal Information to:

authenticate access to your Account and to provide access to the Website, App, Platform, and Services, including through the use of multi-factor authentication;
provide, operate, maintain and improve the Website, Platform, App and Services;
send technical notices, updates, security alerts and support and administrative messages, including alerts related to your document deadlines and expiry dates;
provide and deliver the Website, App, Platform, and Services and features you request, process and complete transactions, and send you related information, including confirmations and invoices;
respond to comments, questions, and requests and provide customer and user service and support;
communicate with customers and users about services, features, surveys, newsletters, offers, promotions, and provide other news or information about us and our select partners;
investigate and prevent fraudulent transactions, unauthorized access to the Website, App, Platform, and Services, and other illegal activities;
personalize and improve the Website, Platform, App, and Services, and provide content, features, and/or advertisements that match your interests and preferences or otherwise customize your experience on the Website, App, Platform, and Services;
monitor and analyze trends, usage, and activities in connection with the Website, App, Platform, and Services and for marketing or advertising purposes (for example to suggest documents and information that may be missing, such as a will or insurance policy, and recommend PSPs or Advisors that you might need to complete services related to missing records);
enable you to communicate, collaborate, and share files with Collaborators (including PSPs and Advisors) you designate; and
for other purposes which we will notify you about and seek your consent.

5Cookies and Similar Technologies

When you visit the Website, App or Platform, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Website, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Website, and information about how you interact with the Website. We refer to this information as “Device Information”.

We collect Device Information using the following technologies:

“Cookies” are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.
“Log files” track actions occurring on the Website, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
“Web beacons”, “tags”, and “pixels” are electronic files used to record information about how you browse the Website.

A cookie is a small data file that is stored on your device. Cookies cannot be used to see any other data on your computer, nor can they determine your email address or identity.

We may use “persistent cookies” for customer and user registration ID and login password for future logins to the Services.

We may use “session cookies” to enable certain features of the Services, to better understand how you interact with the Services and to monitor aggregate usage and web traffic routing on our Website, App and Platform.

The Website, App and Platform may also use technologies such as beacons, scripts, and tags. These technologies may be used for analyzing trends, administering the Website, tracking users’ movements around the Website, and gathering demographic information about our user base as a whole. Various browsers may offer their own management tools for removing these types of tracking technologies.

We may also use third-party ad companies to help provide some of our advertising services. These third parties may place cookies on your computer and collect data about your online activities across websites or online services when you are visiting such third-party websites or logged into such third-party services, including for targeted advertising.

We use visitor identification technologies that help us understand which businesses and organizations visit our website. These technologies may enable us or our service providers to associate website activity with information relating to a business or professional contact. We use this information solely for business-to-business marketing, sales, analytics, customer relationship management, and business development purposes.

In some circumstances, our service providers may associate website activity with business contact information, including a business email address, job title, employer, or other professional information that they lawfully maintain or obtain from lawful third-party sources.

Our business professional visitor-identification technologies are intended to be used only in connection with website visitors who are reasonably identified through technical means, including IP-address-based location information, as being located in the United States. For additional information regarding visitor-identification technologies used in connection with certain U.S. website visitors, please see 'Website Visitors Located in the United States' below.

You may manage cookies through your browser settings and may also exercise any available opt-out rights offered by the applicable service provider.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt out of targeted advertising by using the links below:

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at: http://optout.aboutads.info/.

6Storage Location and Transfer of Personal Information

SideDrawer processes and stores its data, including Personal Information, on servers located in Canada, the United States and other jurisdictions in the world. SideDrawer also transfers data to the third-party service providers described on our Sub-Processors webpage, available here: https://www.sidedrawer.com/legal/sub-processors (“Sub-Processors”).

By submitting Personal Information (including via PSPs) or otherwise using the Services, you agree to this transfer, storing or processing of your Personal Information in the jurisdictions in which our Sub-Processors are located. You acknowledge and agree that your Personal Information may be accessible to law enforcement and governmental agencies in such jurisdictions under lawful access regimes or court order.

7Disclosure of Personal Information with Third Parties

7.1Disclosure to Others. End users have the option of sharing Personal Information from their Account with other users, known as Collaborators (including PSPs and Advisors), who may need to view, upload, or edit content or records on an end user’s behalf. In the case where an Account is created by a Collaborator (other than a Tenant PSP) for an end user, that Collaborator will be automatically given the ability to view, edit and upload contents and records for such Account. In the case where an applicable Collaborator is a Tenant PSP, the Tenant PSP will be given console access to accounts created by or at the request of such Tenant PSP, and such console-level access cannot be overridden by the applicable end user (even using the administrative functions of the Account). A Tenant PSP will also be able to provide console-level access to that PSP’s personnel who may be involved in providing professional advice as well as other third parties. End users can also designate PSPs, Advisors, and other users (such as family members) who can edit documents stored in an end user’s Account and can also withdraw editing privileges from those PSPs, Advisors, and other users (in each case, other than Tenant PSPs). By default, the end user of an Account is an editor of that Account. Content and records and Personal Information are only shared with any applicable Tenant PSP (and with any third parties that such Tenant PSP may share such content and records with) and with those Collaborators who an end user or an editor of an Account have designated. Editor users can update their settings to add or remove Collaborators (including PSPs, Advisors, and other users, in each case other than Tenant PSPs) for an Account and revise specific permissions of Collaborators (including PSPs, Advisors, and other users, in each case other than Tenant PSPs).

7.2 Service Providers and Business Partners. We may from time to time employ third parties to perform tasks on our behalf and we may need to share Account Information and other Personal Information with them to provide certain services. Unless we tell you differently, such third parties do not have any right to use the Personal Information we share with them beyond what is necessary for them to provide the tasks and services on our behalf. The third parties we currently engage includes third party companies and individuals employed by us to facilitate our Services, including the provision of database management, payment processing, and customer relationship management tools, including the Sub-Processors.

7.3 Business Transfers. If our business (or substantially all of our assets) are acquired by a third party, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information may be made available or otherwise transferred to the new controlling entity, where permitted under applicable law. Your Personal Information may also be transferred in connection with due diligence for any such transactions.

7.4 With Your Consent. If we need to use or disclose any Personal Information in a way not identified in this Privacy Policy, we will notify you and/or obtain consent as required under applicable privacy laws.

7.5 As Required by Law. We may disclose your Personal Information to third parties without your consent if we have reason to believe that disclosing this information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. Further, we may disclose Personal Information when we believe in good faith that such disclosure is required by and in accordance with the law.

We also reserve the right to access, read, preserve, and disclose any information as we reasonably believe is necessary to:

satisfy any applicable law, regulation, legal process or governmental request; enforce our contracts (including our Terms of Use), as well as investigation of potential violations of such contracts; and
detect, prevent, or otherwise address fraud, security or technical issues.

The above may include exchanging information with other companies and organizations for fraud protection and spam/malware prevention. Notwithstanding the terms of this Privacy Policy, the collection, use, and disclosure of Personal Information may be made outside of the terms herein to the extent provided for in any applicable privacy or other legislation in effect from time to time, or pursuant to court orders.

8Retention

We will keep your Personal Information for as long as it remains necessary for the identified purpose or as required by law, which may extend beyond the termination of our relationship with you. When an Account becomes inactive for an extended period of time, we have the right to delete the Account and related data and Personal Information.

Our customers may use the Services to store records of their clients, including Personal Information, in accordance with their own retention policies.

We may retain certain data as necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, non-personally-identifiable data, account recovery, or if required by law. All retained Personal Information will remain subject to the terms of this Privacy Policy.

The data our customers process in connection with the Website, App, Platform, and/or Services is retained according to the SideDrawer Data Processing Agreement, attached as Appendix A.

9Protection of Personal Information

SideDrawer uses technological safeguards designed to protect your Personal Information from loss and unauthorized access, copying, use, modification or disclosure. For example, we take the following measures:

We use AES 256-bit encryption for data storage and AES 128-bit encryption for data during transmission;
We limit our own access to your Personal Information by ensuring that only authorized persons have access and such access requires a secure password. Only employees who “need to know” in order to fulfill their job requirements have access to your Personal Information; and
We train our employees to keep users’ Personal Information private and confidential.

Unfortunately, no data storage or data transmission over the Internet is 100% secure. As a result, while we strive to protect your Personal Information, we cannot guarantee the confidentiality or security of any information you transmit to us, and you do so at your own risk.

10Artificial Intelligence

10.1Collection and Use. End users have the option of sharing Personal Information from their Account. We collect personal information that you provide directly to us when creating an account, interacting with or using our Website, App, Platform, and Services. This information may include your name, contact details, payment information, usage data, and any content you submit. Certain data may be processed by our artificial intelligence (“AI”) systems to provide, improve, and personalize our Services.

10.2AI-Powered Processing. Our Services may involve automated decision-making or profiling using AI technologies. Such processing may include content analysis, pattern recognition, personalization of recommendations, and performance optimization. We use these technologies to enhance user experience, improve service accuracy, and ensure security. We do not use AI systems to make decisions solely on automated processing that produce legal or similarly significant effects without meaningful human involvement.

10.3Training and Improvement of AI Models. To improve the performance of our AI systems, we may use aggregated, de-identified, or anonymized data derived from interactions with our Platform by customers, end users, and other users who use the App, Platform, or Services. We do not use your identifiable personal information to train our AI models unless we have obtained your explicit consent.

10.4Data Minimization and Retention. We limit the use of Personal Information in our AI systems to the minimum necessary for the purposes described in this Privacy Policy. Personal Information used in AI-related processing is retained only for as long as necessary to provide the Services or as required by law.

10.5Third-Party AI Services. Where we rely on third-party AI tools or providers, and where possible, we ensure that such providers are contractually obligated to maintain appropriate safeguards for your Personal Information and to process it only in accordance with our instructions and applicable privacy laws. Where we are not able to ensure appropriate safeguards, we will notify you where you use those parts of the Services so you can make your own decision as to whether to interact with such third-party tool, such as with third-party AI chat services as outlined in the Terms of Service.

10.6 Security of AI Systems. We implement reasonable technical and organizational safeguards to protect your personal information used in AI systems from unauthorized access, misuse, or disclosure. We regularly monitor and test our AI systems to mitigate risks and ensure compliance with applicable privacy regulations.

10.7 Your Rights. Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the processing of your Personal Information, including data used in AI systems.

10.8 Document Processing and AI. When you upload documents, forms, or other materials to our Services, we collect and process the information contained in those files. This may include Personal Information, business information, and other content you choose to provide.

AI-Based Processing of Documents: We use AI systems to extract data from the documents and data you upload in order to generate, populate, and format forms, analysis, notifications and other documents. AI processing may involve text recognition, data classification, and automated mapping of information into structured outputs.

Data Use and Retention: The extracted data is used solely for providing the Services requested by you, a Sponsor, PSP or Advisor, such as generating completed forms. We may store uploaded documents and extracted data temporarily to enable functionality, quality assurance, or customer support, but such data is retained only as long as necessary or as required by law.

Training and Improvement of AI Models: We do not use your Personal Information to train our AI models unless you have given explicit consent. We may, however, use de-identified or aggregated data to improve the accuracy and performance of our systems.

Data Ownership: You retain all rights to the documents and information you upload. We make no claim of ownership over your content. By using our Services, you grant us a limited license to process and transform your documents for the purpose of delivering the Services.

Security of Uploaded Data: We use reasonable technical and organizational measures to protect uploaded documents and extracted data from unauthorized access, disclosure, or misuse. However, we cannot guarantee absolute security of information transmitted over the internet.

11Access, Correction and Accuracy Rights to Personal Information

You have the right to access the Personal Information we hold about you in order to verify the Personal Information we have collected in respect to you and to have a general account of our processing of that Personal Information. Upon receipt of your written request, we will provide you with a copy of your Personal Information, although in certain limited circumstances, and as permitted under law, we may not be able to make all relevant Personal Information available to you, such as where that Personal Information also pertains to another user. In such circumstances we will provide reasons for the denial to you upon written request. We will endeavor to deal with all written requests for access and modifications in a timely manner.

For all of the rights described in this Section, in certain instances, where we are acting as a sub-processor for one of our customers who is the actual data controller, we may not be able to respond to or take action in respect to a request from you in connection with your Personal Information or Personal Data without notifying and receiving consent and/or further instructions from such customer who is the actual data controller. Where our Website, App, Platform, and/or Services are made available to you via one of our customers as a Sub-processor Use, please direct your Personal Information and Personal Data questions to such customer, as your use of the Website, App, Platform, and/or Services is subject to that customer’s terms and policies. We are not responsible for any customer’s privacy or security practices, and those practices may be different from those described in this Privacy Policy. The customer can remove Personal Information or Personal Data without our involvement in some cases or will request that we remove applicable Personal Information or Personal Data from the Website, App, Platform, and/or Services (subject to the provisions on data retention above). Please refer to the applicable customer’s organizational policies for more information.

We will make every reasonable effort to keep your Personal Information accurate and up to date, and we will provide you with mechanisms to update, correct, delete or add to your Personal Information as appropriate. As appropriate, this amended Personal Information will be transmitted to those persons and entities to whom we are permitted to disclose your Personal Information. Having accurate Personal Information about you enables us to give you the best possible service.

12Residents of the European Economic Area (“EEA”)

The legal basis on which SideDrawer relies to process Personal Information (known as “Personal Data” under the European Union’s General Data Protection Regulation) are consent, fulfillment of our contracts with customers, as well as pursuit of legitimate business activities. Please see Annex 1 of the SideDrawer Data Processing Agreement, attached as Appendix A for additional details regarding the processing of Customer Personal Data required by Article 28(3) of the European Union’s General Data Protection Regulation.

Where we collect Personal Data directly from the data subjects, such as our customers (including PSPs), and make decisions in regards to processing such Personal Data, we act as the data controller. Otherwise, where we process Personal Data on behalf of third parties (such as when our customers use the Services to process Personal Data of their clients), we are the data processor.

If you are a resident of the EEA, you have certain data protection rights. SideDrawer takes reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data. If you wish to be informed of what Personal Data we hold about you and if you want it to be removed from our systems, please contact us using the contact information set out below. Note that where we act as the data processor on behalf of a customer (including PSPs), you will be required to contact the data controller directly to exercise your rights.

In certain circumstances, where we act as data controller, you have the following data protection

rights:

The right to request access to your Personal Data (commonly known as a “data subject access request”). This right enables you to receive a copy of the Personal Data we hold about you where we are the data controller and to check that we are lawfully processing it.
The right to request correction of the Personal Data that we hold about you. This right enables you to have any incomplete or inaccurate Personal Data we hold about you corrected, though we may need to verify the accuracy of the new Personal Data you provide to us.
The right to request erasure of your Personal Data. This right enables you to ask us to delete or remove your Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your Personal Data unlawfully, or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your erasure request for specific legal reasons which will be notified to you, if applicable, at the time we respond to your request.
The right to object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your Personal Data which override your rights and freedoms.
The right to request restriction of processing of your Personal Data. This right enables you to ask us to suspend the processing of your Personal Data in the following scenarios: (a) if you want us to establish the Personal Data’s accuracy; (b) where our use of the Personal Data is unlawful but you do not want us to erase it; (c) where you need us to hold the Personal Data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your Personal Data but we need to verify whether we have overriding legitimate grounds to use it.
The right to request the transfer of your Personal Data to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated Personal Data which you initially provided consent for us to use or where we used the Personal Data to perform a contract with you.
The right to withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain Services to you. We will advise you if this is the case at the time we respond to your withdrawal of consent.

Please note that we may ask you to verify your identity before responding to such requests.

You have the right to complain to a data protection authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the EEA.

If you wish to exercise any of the rights set out above, please contact us using the contact details below.

13Website Visitors Located in the United States

13.1Visitor Identification and Business Contact Intelligence. To better understand interest in our products and services, we use third-party analytics, advertising, and business intelligence providers to identify organizations that visit our website.

When you visit or log in to our website, cookies, pixels, and similar technologies may be used by our service providers and data partners to collect information about your interactions with our website. These providers may use this information, together with information lawfully available from other sources, to identify the company or organization associated with a website visit.

In some circumstances, our service providers may associate website activity with information relating to a business professional, including a business email address, job title, employer, or other business contact information.

This business professional visitor-identification program is intended solely for website visitors who are reasonably identified by technical means, including IP-address-based location information, as located in the United States. We do not use this program to identify or market to website visitors located in Canada.

13.2How We Use This Information. We may use information obtained through these services to:

Understand which organizations are interested in our products and services;
Analyze website usage and engagement;
Improve our website, products, services, and marketing activities;
Identify potential business customers;
Conduct business development, sales, and marketing activities; and
Communicate with prospective business customers regarding products, services, events, educational resources, industry insights, and other business-related information where permitted by applicable law.

13.3Sources of Information. The information provided through these services may be derived from website activity, cookies and similar technologies, publicly available business information, commercial business databases, professional networking sources, and other lawful sources maintained by the service provider or its partners.

13.4 Your Choices. All marketing communications will include any opt-out or unsubscribe mechanisms required by applicable law.

You may:

Configure your browser to reject or delete cookies;
Manage cookie preferences through any cookie management tools made available on our website;
Unsubscribe using the unsubscribe mechanism provided;
Opt out of receiving advertising through RB2B by visiting RB2B Advertising Opt-Out; and
Opt out of RB2B's collection and processing of personal data by visiting RB2B Privacy Opt-Out.

If you have questions regarding our use of visitor-identification technologies or our privacy practices, please contact us using the contact information provided in this Privacy Policy.

14California Privacy Rights

This section provides additional details about the Personal Information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act (the “CCPA”).

For more details about the Personal Information SideDrawer has collected over the last twelve (12) months, please see the section “Collection of Personal Information” above. We collect this Personal Information for commercial purposes described above. SideDrawer does not sell (as that term is defined in the CCPA) the Personal Information we collect.

Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of Personal Information we collect (including how we use and disclose this Personal Information), to delete their Personal Information, to opt out of any “sales” of Personal Information that may be occurring, and to not be discriminated against for exercising these rights.

California consumers may make a written request pursuant to their rights under the CCPA by contacting us at the contact information below. We will verify your request using the information associated with your Account, if available, including email address. Government identification may be required. Consumers can also designate an authorized agent to exercise these rights on their behalf. Note that where we act as the data processor on behalf of a customer (including PSPs), you will be required to contact the data controller directly to exercise your rights (as described in more detail in Section 10).

15Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. Processing of Personal Information we collect is subject to the Privacy Policy in effect at the time such Personal Information is collected, used or disclosed. If we make material changes or changes in the way we use Personal Information, we will notify you by posting an announcement on our Website or sending you an email prior to the change becoming effective. You are bound by any changes to the Privacy Policy when you use the Website, App, Platform or Services after such changes have been first posted.

16Additional Information

If you have any questions or concerns about our Privacy Policy, how it might apply to you, or if it does apply to you, please contact our Privacy Officer. You can:

send an e-mail to privacy@sidedrawer.com
mail us at SideDrawer Inc., 3080 Yonge St, Suite 6060, Toronto, ON, M4N 3N1.

Your use of the Website, the App, Platform or the Services means that you agree to our collection, use, and disclosure of the Personal Information you share with us, as explained in this Privacy Policy. If you do not agree with this Privacy Policy, or the Terms of Use, please do not use the Website, the App, Platform or the Services.

Last updated August 28, 2026.

Appendix A

SideDrawer Data Processing Agreement

This SideDrawer Data Processing Agreement and its Annexes (“DPA”) reflects the parties’ agreement with respect to the Processing of Customer Personal Data (as defined below) by SideDrawer in connection with the SideDrawer Terms of Use or Enterprise Software Agreement as applicable (the “Agreement”).

This DPA is supplemental to, and forms an integral part of, the Agreement and is effective upon its incorporation into the Agreement, which may be specified in the Agreement, an order or an executed amendment to the Agreement. In case of any conflict or inconsistency with the terms of the Agreement, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency.

SideDrawer may update these terms from time to time. If you have an active subscription, SideDrawer will let you know when we do so via email or via in-app notification.

The term of this DPA will follow the term of the Agreement. Terms not otherwise defined in this DPA will have the meaning as set forth in the Agreement.

1Definitions

1.1

In this DPA, the following terms shall have the meanings set out below:

“Applicable Law” means applicable Data Protection Laws;

“Contracted Processor” means SideDrawer or a Sub-processor;

“Customer” refers to the counterparty to the Agreement;

“Customer Personal Data” means any Personal Data that SideDrawer or a Sub-processor receives, collects, accesses, or otherwise Processes in the provision of the Services to Customer pursuant to the Agreement provided that such Personal Data is electronically submitted by or for Customer to the Services;

“Data Protection Laws” means all laws and regulations of any jurisdiction in respect to privacy, data protection, data security, communications secrecy, breach notification, or the Processing of Personal Data, including, without limitation, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”), the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”), UK Data Protection Act of 2018, the UK GDPR, the Swiss Federal Act on Data Protection, in each of the foregoing instances, as applicable to the Processing of Customer Personal Data by a Contracted Processor;

“Personal Data” means any information relating to an identified or identifiable natural person, or that is defined as “Personal Data,” “Personal Information,” “Personally Identifiable Information,” “Sensitive Personal Information,” or any similar term by Applicable Law;

“Personal Data Breach” means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorized access to, any Customer Personal Data;

“Restricted Transfer” means: (i) a transfer of Customer Personal Data from Customer to SideDrawer or a Sub-processor; or (ii) an onward transfer of Customer Personal Data from SideDrawer or a Sub-processor to a Sub-processor; in each case, where such transfer would be prohibited or restricted by applicable Data Protection Laws, in each case, in the absence of a legal transfer mechanism to be established under this DPA;

“Standard Contractual Clauses” means a legally acceptable version of the Standard Contractual Clauses (as selected by SideDrawer or a Contracted Sub-processor) for the transfer of Personal Data to Processors or Sub-processors established in third countries which do not ensure an adequate level of data protection as enacted pursuant to the European Commission’s decision 2021/915 of 4 June 2021; and

“Sub-processor” means any Processor engaged by SideDrawer who Processes Customer Personal Data in connection with the provision of the Services.

The terms, “Commission”, “Controller”, “Data Subject”, “Member State”, “Processing,” “Processor” and “Supervisory Authority” shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.

2Scope and Compliance with Data Protection Laws

2.1

This DPA applies only to the extent that SideDrawer Processes Customer Personal Data on behalf of Customer in providing the Services and where such Customer Personal Data is subject to the Data Protection Laws.

2.2

The parties acknowledge and agree that with regard to the Processing of Customer Personal Data, Customer is the Controller and SideDrawer is the Processor and SideDrawer may engage Sub-processors subject to the requirements set forth in Section 6. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws, including any applicable requirement to provide notice to Data Subjects of the use of SideDrawer as Processor. For the avoidance of doubt, Customer’s instructions for the Processing of Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Customer Personal Data and how Customer acquired such Customer Personal Data, and, in particular, Customer shall be solely responsible for obtaining any relevant authorizations, consents and permissions from Data Subjects for the Processing of Customer Personal Information in accordance with this DPA. SideDrawer will Process Personal Data only as set forth in this DPA and in compliance with Data Protection Laws.

2.3

Each party hereby certifies that it understands its restrictions and obligations set forth in this DPA and will comply with them.

3Processing of Customer Personal Data

3.1

SideDrawer shall:

3.1.1

not Process Customer Personal Data other than on Customer’s written instructions (including instructions provided and Processing initiated by Customer’s users in their use of the Service) unless Processing is required by Applicable Law to which SideDrawer is subject; and

3.1.2

promptly inform Customer if, in SideDrawer’s opinion, an instruction from Customer concerning the Processing of Customer Personal Data violates Data Protection Laws.

3.2

Customer hereby instructs SideDrawer to Process Customer Personal Data (including instructions provided and Processing initiated by Customer’s users in their use of the Service) and to transfer Customer Personal Data to any country or territory for the provision of the Services in accordance with this DPA.

3.3

Annex 1 to this DPA sets out certain information regarding the Processing of the Customer Personal Data pursuant to the Agreement and this DPA as required by Article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Nothing in Annex 1 confers any right or imposes any obligation on any party to this DPA.

3.4

SideDrawer shall not:

3.4.1

Sell Customer Personal Data;

3.4.2

otherwise Process Customer Personal Data for any purpose other than for the specific purposes set forth in this DPA (including Annex 1) and the Agreement; or

3.4.3

attempt to link, identify, or otherwise create a relationship between Customer Personal Data and non-Personal Data or any other data without the express authorization of Customer or as otherwise authorized in this DPA (including Annex 1) or the Agreement.

For purposes of this Section 3.4, “Sell” shall have the meaning set forth in the CCPA.

4Authorized Personnel

4.1

SideDrawer shall (i) take commercially reasonable steps to ensure the reliability of the SideDrawer personnel it authorizes to Process Customer Personal Data (“Authorized Personnel”), ensuring in each case that access to Customer Personal Data is limited to those Authorized Personnel who need to know and/or access the Customer Personal Data to provide the Services, and (ii) ensure that all Authorized Personnel are bound by confidentiality obligations (whether by contract or under Applicable Law) in respect of the Processing of Customer Personal Data.

5Security

5.1

SideDrawer shall in relation to the Customer Personal Data implement appropriate technical and organizational measures to provide a level of security appropriate to the types of Customer Personal Data being Processed by SideDrawer and the risk to applicable Data Subjects in the event of unauthorized use or disclosure of such Customer Personal Data, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

5.2

In assessing the appropriate level of security, SideDrawer shall take account of the risks that are presented by Processing, including from a Personal Data Breach in respect to the Customer Personal Data.

6Sub-processing

6.1

Customer authorizes SideDrawer to appoint (and permit each Sub-processor appointed in accordance with this Section 6 to appoint) Sub-processors in accordance with this Section 6. Customer hereby consents to SideDrawer’s use of its current Sub-processors which are set forth at: https://www.sidedrawer.com/legal/sub-processors.

6.2

Customer may reasonably object to SideDrawer’s use of a new Sub-processor by notifying SideDrawer promptly in writing within thirty (30) days after receipt of SideDrawer’s notice in accordance with the mechanism set out in Section 6.2. If Customer objects to a new Sub-processor, as permitted in the preceding sentence, SideDrawer will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor. If SideDrawer is unable to make available such change within a reasonable time, which shall not exceed thirty (30) days, Customer may terminate the applicable Order Form(s) with respect only to those Services which cannot be provided by SideDrawer without the use of the objected-to new Sub-processor by providing written notice to SideDrawer. SideDrawer will refund to Customer any prepaid fees covering the remainder of the term of such Order Form(s) following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.

6.3

With respect to each Sub-processor, SideDrawer shall:

6.3.1

before the Sub-processor first Processes Customer Personal Data, carry out commercially reasonable due diligence to determine that the Sub-processor is capable of providing the level of protection for Customer Personal Data required by this DPA;

6.3.2

enter into an agreement with such Sub-processor (including in electronic form) that is consistent with the terms of this DPA in respect to such Sub-processor’s Processing of Personal Data;

6.3.3

if an arrangement with a Sub-processor involves a Restricted Transfer, utilize a legal transfer mechanism under Applicable Law (such as the Standard Contractual Clauses, approved Binding Corporate Rules or any other transfer mechanism that may be approved by applicable Supervisory Authorities from time to time); and

6.3.4

provide to Customer for review, copies of SideDrawer’s agreements with its Sub-processors (which may be redacted to remove confidential commercial information) as Customer may request in writing from time to time.

6.4

SideDrawer shall be liable for the acts and omissions of its Sub-processors to the same extent SideDrawer would be liable if performing the services of each Sub-processor directly under the terms of this DPA and the Agreement.

6.5

SideDrawer’s use of Sub-processors is at SideDrawer’s discretion, provided that: SideDrawer shall inform Customer in advance (by email, by posting within the Services, or by updating SideDrawer’s publicly posted list of Sub-processors) of any additions to or replacements of the Sub-processors used by SideDrawer (including the name, jurisdiction in which such Sub-processor is located, and the types of Personal Information to be Processed by such Sub-processor), and (b) Customer may object to the use of any new Sub-processor as provided in Section 6.2.

7Data Subject Rights

7.1

Considering the nature of the Processing of the Customer Personal Data by the Contracted Processors, SideDrawer will assist Customer, by appropriate technical and organizational measures, insofar as reasonably possible, in the fulfilment of Customer’s obligations to respond to requests by Data Subjects (or their representatives) for exercising their rights under Data Protection Laws (such as rights to access, correct, or delete Personal Data).

7.2

SideDrawer shall, unless prohibited by applicable law:

7.2.1

promptly notify Customer if SideDrawer receives (i) a request from a Data Subject under any Data Protection Laws in respect of Customer Personal Data (including requests of Data Subjects that may be communicated to SideDrawer by its Sub-processors), or (ii) a Data Subject complaint made to SideDrawer regarding the Processing of Customer Personal Data (including Data Subject complaints that may be communicated to SideDrawer by its Sub-processors) (collectively, the matters in items (i) and (ii) hereinafter referred to as “Data Subject Requests”); and

7.2.2

not respond to any Data Subject Requests except on the documented instructions of Customer or as required by Applicable Law; and

7.2.3

to the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, SideDrawer shall upon Customer’s request provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent SideDrawer is legally permitted to do so and the response to such Data Subject Request is required under Data Protection Laws. Customer shall be responsible for any costs arising from SideDrawer’s provision of such assistance.

8Personal Data Breach

8.1

SideDrawer shall notify Customer without undue delay (and in any event within seventy-two (72) hours) upon SideDrawer becoming aware of a Personal Data Breach affecting Customer Personal Data (including any Personal Data Breach for which SideDrawer receives notice from a Sub-processor), providing Customer with sufficient information to allow Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under Data Protection Laws. Any notification by SideDrawer of any Personal Data Breach shall not be interpreted or construed as an admission of fault or liability by SideDrawer.

8.2

SideDrawer shall use reasonable efforts to identify the cause of any Personal Data Breach affecting Customer Personal Data and take those steps as SideDrawer deems necessary and commercially reasonable to remediate the cause of such a Personal Data Breach affecting Customer Personal Data to the extent the remediation is within SideDrawer’s reasonable control. The obligations herein shall not apply to incidents that are caused by Customer or Customer’s users.

9Data Protection Impact Assessment and Prior Consultation

9.1

SideDrawer shall provide Customer with commercially reasonable assistance with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which are required under Data Protection Laws, in each case solely in relation to Processing of Customer Personal Data by, and taking into account the nature of the Processing and information available to SideDrawer, and, in each case, to the extent Customer does not otherwise have access to the relevant information. To the extent legally permitted, Customer shall be responsible for any costs arising from SideDrawer’s provision of such assistance.

10Deletion or Return of Customer Personal Data

10.1

Subject to Section 10.3, if Customer does not provide SideDrawer written notice under Section 10.2, SideDrawer shall promptly and in any event within twenty (20) business days of the date of cessation of any Services involving the Processing of Customer Personal Data (the “Cessation Date”), delete and procure the deletion of all copies of the Customer Personal Data held by or under the control of SideDrawer and/or any of its Sub-processors.

10.2

Subject to Section 10.3, Customer may in its absolute discretion by written notice to SideDrawer within ten (10) business days of the Cessation Date require SideDrawer to: (a) return a complete copy of all Customer Personal Data to Customer by secure file transfer in a format supported by the Services; and (b) delete and procure the deletion of all other copies of Customer Personal Data Processed by any Contracted Processor pursuant to this DPA. SideDrawer shall where practicable, comply with the requirements of this Section 10.2 within twenty (20) business days of the Cessation Date.

10.3

Each Contracted Processor may retain Customer Personal Data to the extent required by Applicable Law and for such period as required by Applicable Law and always provided that SideDrawer shall comply with the obligations of this DPA in respect of all such Customer Personal Data and shall only Process such Customer Personal Data as necessary for the purpose(s) specified in the Applicable Law requiring its storage and for no other purpose except as otherwise provide in this Section 10.3. In addition, each Contracted Processor may retain Customer Personal Data that is contained in archival records made by such Contracted Processors’ back-up systems pursuant to such Contracted Processor’s standard back-up and disaster recovery procedures, provided that such Customer Personal Data shall be deleted when the corresponding archival records are deleted in accordance with such Contracted Processor’s standard deletion schedule for back-up and disaster recovery records.

10.4

Upon written request from Customer, SideDrawer shall provide written certification to Customer that SideDrawer has fully complied with this Section 10 within twenty (20) business days of the Cessation Date.

11Audit Rights

11.1

SideDrawer shall make available to Customer (provided that Customer is not a competitor of SideDrawer) on request, all reasonable information that is available to SideDrawer and that is relevant to the Processing of the Customer Personal Data by the Contracted Processors, and shall allow for and contribute to audits, including inspections, by Customer or an auditor (provided that both Customer and the selected auditor are not competitors of SideDrawer) mandated by Customer that are relevant to the Processing of the Customer Personal Data by the Contracted Processors. Any information provided by SideDrawer (or any other Contracted Processor) to Customer, or to any auditor selected by Customer in connection with an audit, shall be SideDrawer’s Confidential Information and shall be protected by Customer (and Customer’s auditor) in accordance with the Confidential Information provisions of the Agreement.

11.2

Customer shall give SideDrawer reasonable notice of any audit or inspection to be conducted under Section 11.1 and shall avoid (and shall ensure that each of its mandated auditors avoids) causing any damage, injury or disruption to the Contracted Processors' premises, equipment, personnel and business while its personnel are on those premises (which includes access to any IT systems) in the course of such an audit or inspection. If Customer elects to use a third-party auditor, such third-party auditor shall be required to enter into a non-disclosure agreement with SideDrawer. SideDrawer need not give access to its premises for the purposes of such an audit or inspection:

11.2.1

to any individual unless he or she produces reasonable evidence of identity and authority;

11.2.2

outside normal business hours at those premises, unless the audit or inspection needs to be conducted on an emergency basis and Customer and SideDrawer have agreed that this is the case before attendance outside those hours begins; or

11.2.3

for the purposes of more than one audit or inspection, in respect of SideDrawer or any Sub-processor, in any calendar year, except for any additional audits or inspections which Customer is required or requested to carry out by Data Protection Laws, a Supervisory Authority or any similar regulatory authority responsible for the enforcement of Data Protection Laws in any relevant country or territory.

11.3

Customer shall reimburse SideDrawer for any time expended by SideDrawer or its Sub-processors for any such audit at the SideDrawer’s then-current professional services rates, which shall be made available to Customer upon request. Before the start of any such audit, Customer and SideDrawer shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Customer shall be responsible. All reimbursement rates shall be reasonable, considering the resources expended by SideDrawer, or its Sub-processors. Customer acknowledges and agrees that any audit of any Sub-processor is subject to the agreement of such Sub-processor, which is outside of SideDrawer’s control, and which may be denied by the applicable Sub-processor in such Sub-processor’s sole discretion. Customer shall promptly notify SideDrawer with information regarding any non-compliance discovered during any audit.

12Restricted Transfers

12.1To the extent that the Processing of Customer Personal Data by SideDrawer or a Sub-processor involves a Restricted Transfer, such transfer shall be done in accordance with a legal transfer mechanism under Applicable Law (such as the Standard Contractual Clauses, approved Binding Corporate Rules or any other transfer mechanism that may be approved by applicable Supervisory Authorities from time to time).

13General Terms

13.1

Governing law and jurisdiction

13.1.1

Without prejudice to the mediation, jurisdiction and governing law provisions of the Standard Contractual Clauses (to the extent the Standard Contractual Clauses are applicable to a Contracted Processor):

13.1.1.1

the parties to this DPA hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims arising under this DPA, including disputes regarding its existence, validity or termination or the consequences of its nullity; and

13.1.1.2

this DPA shall be governed by the laws of the country or territory stipulated for this purpose in the Agreement.

13.2

Order of precedence

13.2.1

Nothing in this DPA reduces SideDrawer's obligations under the Agreement in relation to the protection of Customer Personal Data or permits SideDrawer to Process (or permit the Processing of) Customer Personal Data in a manner which is prohibited by the Agreement.

13.2.2

In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses (to the extent the Standard Contractual Clauses are applicable to a Contracted Processor), the Standard Contractual Clauses shall prevail. For greater certainty, to the extent this DPA specifies rules in respect to the appointment of Sub-processors, the conduct of audits, and the certification of deletions, such rules also apply in relation to the Standard Contractual Clauses.

13.2.3

With regard to the subject matter of this DPA, in the event of any conflict or inconsistency between the provisions of this DPA and other provisions in the Agreement, or any other agreements between the parties, the provisions of this DPA shall prevail.

13.2.4

To the extent the Standard Contractual Clauses are applicable between Customer and SideDrawer, Customer shall be the data exporter and SideDrawer shall be the data importer, and to the extent the Standard Contractual Clauses require a description of the types of Customer Personal Information to be Processed, the types of Processing to be performed on the Customer Personal Information, the purpose of the Processing to be performed on the Customer Personal Information, the duration of the Processing of the Customer Personal Information and any other relevant information about the Processing to be performed on Customer Personal Information, the information set forth in Annex 1 to this DPA is deemed to be added to the Standard Contractual Clauses (mutatis mutandis).

13.3

Severance

Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in full force and effect. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained in this DPA.

Last reviewed October 20, 2025.

Annex 1

Details of Processing of Customer Personal Data

This Annex 1 includes certain details of the Processing of Customer Personal Data as required by Article 28(3) GDPR.

AList of Parties

Data exporter

Name: The Customer, as defined in the Agreement

Address: The Customer's address, as set out in the Agreement/Order Form

Contact person’s name, position and contact details: The Customer's contact details, as set out in the Agreement, Order Form and/or as set out in the Customer’s account

Role (controller/processor): Controller

Data importer

Name: SideDrawer Inc.

Address: 3080 Yonge St, Suite 6060, Toronto, ON, M4N 3N1

Contact person’s name, position and contact details: J. Gaston Siri, Data Protection Officer, SideDrawer Inc., support@sidedrawerinc.com.

Role (controller/processor): Processor

BSubject matter and duration of the Processing of Customer Personal Data

The subject matter and duration of the Processing of the Customer Personal Data are as set forth in the Agreement and this DPA.

CThe nature and purpose of the Processing of Customer Personal Data

SideDrawer will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement.

DThe types of Customer Personal Data to be Processed

Customer may submit Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and which may include personal data of the data subjects described in E below.

EThe categories of Data Subjects to whom the Customer Personal Data relates

Customer contacts and other end users including Customer employees, contractors, collaborators, customers, prospects, suppliers and subcontractors. Data Subjects may also include individuals attempting to communicate with or transfer Personal Data to Customer’s end users.

FFrequency of the transfer

Continuous

GNature of the Processing

Customer Personal Data will be Processed in accordance with the Agreement (including this DPA) and may be subject to the following Processing activities:

1. Storage and other Processing necessary to provide, maintain and improve the Services provided to Customer; and/or

2. Disclosure in accordance with the Agreement (including this DPA) and/or as compelled by applicable laws.

HPurpose of the transfer and further processing

SideDrawer will Process Customer Personal Data as necessary to provide the Services pursuant to the Agreement, and as further instructed by Customer in Customer’s use of the Services.

IPeriod for which Personal Data will be retained

SideDrawer will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed in writing.

JCompetent Supervisory Authority

The supervisory authority that will act as competent supervisory authority, as applicable, will be determined in accordance with GDPR.