Data Processing Addendum

1. Application, definitions, and priority

This Data Processing Addendum (“DPA”) forms part of the Software Services Agreement or other services agreement that expressly incorporates it (“Agreement”) between Teamledge Tech Inc. (“Teamledge”) and the Customer. It applies when Teamledge processes personal information on the Customer’s behalf to provide the Services.

“Customer Personal Information” means personal information in Customer Data processed on that behalf. “Processing” includes collection, hosting, use, disclosure, alteration, retrieval, and deletion. A “Subprocessor” is a provider Teamledge engages to process Customer Personal Information for the Services. A “Privacy Incident” is unauthorized access, use, disclosure, loss, destruction, or alteration of Customer Personal Information, including a breach of security safeguards or confidentiality incident under applicable law.

“Applicable Privacy Law” means Canadian federal, provincial, or territorial privacy law that applies to the relevant processing, including PIPEDA or applicable private-sector laws in Quebec, Alberta, and British Columbia. Naming a law does not make it apply where it otherwise would not. This DPA does not itself incorporate EU or UK transfer clauses or authorize processing for an unsupported jurisdiction.

This DPA controls a conflict concerning Customer Personal Information, including a conflict with the AI Terms. A signed amendment changes it only if expressly stated and lawful. The Privacy Policy explains Teamledge’s independent processing, such as personal account administration and its own billing or security responsibilities; that processing remains subject to law and must not be used to evade this DPA.

2. Roles and documented instructions

The Customer determines the purposes of its workspace personnel processing. Teamledge acts as its service provider for that information and processes it only on documented instructions or as legally required. The Agreement, accepted Orders, this DPA, authorized product settings, and lawful instructions submitted through the Services or an agreed support channel constitute instructions.

Teamledge will not use Customer Personal Information for unrelated advertising, sell it, combine it for an independent workforce profiling purpose, or use it to train general-purpose AI models without a separate lawful and express agreement. Providing AI output for a requested task is processing for the Services, not permission for unrelated model development.

If Teamledge reasonably believes an instruction violates Applicable Privacy Law, it will notify the Customer and may pause that instruction while the issue is resolved. If law requires processing beyond the instructions, Teamledge will inform the Customer before that processing unless legally prohibited. Teamledge will verify the authority of a person requesting consequential changes.

The Customer is responsible for a lawful purpose, required notices and consent or other authority, data accuracy, appropriate permission settings, and proportionate retention instructions. Each party remains responsible for legal duties imposed directly on it.

3. Confidentiality and safeguards

Teamledge will restrict access to personnel and providers who need it for authorized purposes and are bound by contractual or statutory confidentiality duties. It will maintain safeguards appropriate to sensitivity, scale, context, and foreseeable risks, including the measures described in Schedule B.

Teamledge may update safeguards as technology and risks change, provided the overall level of protection is not materially reduced during the Agreement. This DPA does not represent that Teamledge holds a particular certification or that every incident can be prevented. The Customer must secure the access credentials, devices, and configurations under its control.

4. Subprocessors and processing locations

The Customer authorizes the Subprocessors identified in the provider and location record supplied for its Services under Schedule C. Teamledge must provide that record before processing begins under this DPA. It identifies each relevant provider, its function, the information processed, and the countries where processing occurs. A list of generic service categories alone is not a completed provider record.

Before a new or replacement Subprocessor begins processing, Teamledge will give the Customer at least 30 days’ written notice with the relevant details. The Customer may object during that period on reasonable data protection grounds. The parties will work in good faith on a suitable alternative. If the concern cannot be resolved, the Customer may terminate the affected Service before the new processing begins and receive a prorated refund of prepaid unused fees.

For an urgent replacement necessary to protect security or maintain an essential Service, Teamledge may provide as much advance notice as practicable and explain the urgency. The objection and resolution rights still apply.

Teamledge will assess relevant safeguards, bind Subprocessors to written data protection obligations consistent with this DPA, and remain responsible to the Customer for their performance of those obligations. A third-party service chosen and separately controlled by the Customer is not automatically a Teamledge Subprocessor.

Processing outside Canada or the Customer’s province requires the disclosures, assessments, contractual protections, and other measures applicable under law. Teamledge will provide reasonably needed information to support the Customer’s assessment. Neither the Canadian market scope nor this DPA promises Canada-only storage.

5. Privacy incident response

Teamledge will notify the Customer without undue delay after becoming aware of a Privacy Incident affecting Customer Personal Information and within any shorter time required by Applicable Privacy Law or an agreed Order. It will not wait for a final investigation to provide the initial notice.

As information becomes available, notice will describe the nature and timing of the incident, affected information and individuals where known, likely consequences, containment or remediation, a contact for follow-up, and steps the Customer should consider. Teamledge will provide material updates, preserve relevant evidence, and take reasonable measures to contain and remedy matters within its control.

The parties will cooperate on assessments and notifications. The Customer determines notifications for information it controls, while Teamledge remains responsible for any notice, report, or recordkeeping duty imposed directly on Teamledge. Teamledge will not identify the Customer in a voluntary public notice without consulting it where practicable, unless law requires disclosure.

Notification is not an admission of fault. Unsuccessful attempts that do not compromise Customer Personal Information are not automatically Privacy Incidents, but remain subject to appropriate security management.

6. Individual requests and compliance assistance

Teamledge will provide reasonable and timely assistance with access, correction, deletion, consent withdrawal, portability, and other requests that Applicable Privacy Law gives individuals, considering the nature of processing and available information. If a request relates to Customer-controlled information, Teamledge will notify or direct it to the Customer and will not independently decide the Customer’s response unless authorized or legally required.

Teamledge will reasonably assist with relevant privacy impact assessments, cross-border assessments, regulator inquiries, and incident obligations where assistance is needed for the Customer’s use of the Services. It will make available information reasonably necessary to demonstrate compliance with this DPA.

Routine assistance is included in the Services. For exceptional requests requiring substantial work beyond ordinary support, the parties may agree reasonable fees in advance. Fees must not obstruct a statutory right, delay legally required action, or charge the Customer for correcting Teamledge’s own breach.

7. Compliance information and review

On reasonable request, Teamledge will provide available security information, relevant policies, and responses to proportionate questionnaires, subject to confidentiality and protection of other customers’ information. The parties should first use available documents to address a concern.

If that information is insufficient to verify a material obligation, the Customer may arrange a proportionate review by a qualified independent reviewer subject to confidentiality, reasonable advance notice, and procedures that protect service security. Ordinarily, such a review occurs no more than once a year, except following a relevant Privacy Incident, credible evidence of non-compliance, or a regulatory requirement.

A review must not expose another customer’s data, give unrestricted access to production systems, or involve unapproved penetration testing. Each party bears its ordinary participation costs; additional external review costs are agreed in advance, except where law provides otherwise or Teamledge’s material breach necessitated the review. Teamledge will address substantiated deficiencies without undue delay.

8. Return, retention, and deletion

During the Agreement, the Customer can use available export and deletion functions and give lawful supplementary instructions. After the Services end, Teamledge will return or delete Customer Personal Information at the Customer’s choice, subject to the recovery periods and lawful exceptions described here. The parties may specify formats, delivery, and a deletion schedule in the Order.

Ordinary cancellation does not immediately delete a workspace. Authorized administrators retain available export access during the communicated inactive-workspace retention period. The Customer should export before requesting workspace deactivation for deletion: that request disables ordinary content access and begins the 14-day recovery period. Supported item-level soft deletions normally have a separate 30-day recycle-bin period.

When the applicable recovery period expires, Teamledge will delete eligible operational information without undue delay. A specific earlier erasure instruction or legal deadline will be addressed without treating a default recovery window as permission to delay mandatory action. Restricted backup copies expire under the documented backup cycle; pending expiry, they remain protected and are used only for necessary recovery or legal purposes. If restored, applicable deletion instructions must be reapplied.

Teamledge may retain limited information only where law permits and an identified obligation or justified purpose requires it. It will restrict that information, communicate the basis and expected retention where lawful, and delete or appropriately anonymize it when no longer required. Pseudonymization alone does not make personal information anonymous.

On reasonable request, Teamledge will confirm completion of deletion and disclose any lawful exception or pending backup expiry. Confidentiality and this DPA continue for retained Customer Personal Information.

9. Liability, duration, and contact

The Agreement’s liability allocation applies to this DPA unless a signed amendment expressly changes it. Nothing limits either party’s duties to individuals or regulators, or liability that cannot lawfully be limited. Ending the Agreement does not end this DPA while Teamledge still processes Customer Personal Information.

For instructions, incidents, provider information, or assistance, contact support@teamledges.com and identify the relevant Customer and workspace. The Customer must keep an authorized privacy and security contact current. Governing law and dispute resolution follow the Agreement, subject to mandatory Applicable Privacy Law.

10. Schedule A — Processing description

Subject matter and purpose: providing Customer-directed workforce training, assessments, document collection and review, broadcasts, messaging, employee administration, reporting, authorized AI assistance, support, and security.

Nature and frequency: ongoing collection, organization, hosting, retrieval, transmission to authorized recipients and providers, generation of operational records, correction, export, restricted retention, and deletion as the Customer and Users use the enabled Services.

Individuals: the Customer’s owners, administrators, employees, contractors, evaluators, and other authorized Users; emergency contacts and people whose information appears in lawfully submitted content.

Information: workspace identity and contact details; employment and organizational profile data; assignments, progress, answers, scores, evidence, certificates, and evaluation records; uploaded employee or branch documents; broadcasts and reading status; communications; performance records; AI inputs and outputs; and associated audit, access, and technical records.

Sensitive information: uploaded identity, employment, safety, or other documents may contain sensitive information. The Customer must minimize collection and ensure the feature and safeguards are suitable. This schedule does not authorize biometric identification, clinical records, or other specialized regulated processing unsupported by the agreed Services.

Duration: the service term plus applicable, documented recovery, return, deletion, backup, and lawful retention periods under Section 8. The Customer and its contact are identified in the Order; Teamledge’s contact is support@teamledges.com.

11. Schedule B — Safeguard commitments

• Access: individual authentication, least-privilege personnel access, workspace and role restrictions, permission review, and prompt access changes when no longer required.
• Application controls: server-side permission checks for applicable requests, separation of workspace data, validation of consequential actions, and audit records proportionate to the risk.
• Data protection: appropriate encryption during transmission and storage, controlled handling of credentials, and restricted access to production data and backups.
• Operations: risk-based vulnerability management, updates, logging, recovery procedures, and change controls designed to preserve confidentiality, integrity, and availability.
• People and providers: confidentiality commitments, appropriate privacy and security instruction, provider assessment, and contractual protections.
• Lifecycle and response: data minimization, documented retention and disposal, incident investigation and escalation, and processes to assist with individual rights.
• AI: authorized input and retrieval boundaries, protection of secrets, human confirmation for consequential actions, and separate records of requests and resulting business actions.

These are contractual safeguard commitments. Specific technical descriptions, certifications, audit reports, and service levels apply only when accurately documented or expressly agreed; none is implied by this schedule.

12. Schedule C — Provider and location record

The Customer-specific provider and location record supplied with the Order or otherwise in writing forms Schedule C of this DPA. It must identify the provider’s legal entity, service purpose, categories of Customer Personal Information, processing countries, relevant onward processing, and any applicable retention or AI-training restrictions.

The record must cover the actual providers used for enabled functions, including hosting, storage, authentication, email or notification delivery, support or diagnostics that receive Customer Personal Information, and AI processing. Payment providers must be distinguished according to whether they process on behalf of the Customer, Teamledge, or for their own legal obligations.

Request the record at support@teamledges.com. Teamledge must provide it before processing begins under this DPA and maintain it through the notice process in Section 4. An empty record, generic category list, or unpublished future list does not authorize an unidentified Subprocessor.