Data Processing Agreement (DPA)

Last Updated: March 16, 2026

1.0 Introduction

This Data Processing Agreement (“DPA”) is published by Vezgo Inc. (“we,” “us,” or “the Company”), a corporation incorporated under the laws of Ontario, Canada.

This DPA applies to all clients (“you” or “Client”) who use our services (the “Services”) and, in doing so, cause personal data of their end-users or other individuals to be processed by us on their behalf. By accepting the applicable Terms of Service — whether by clicking “I agree,” creating an account, or otherwise using the Services — you agree to this DPA.

Where you act as a Data Controller and we act as a Data Processor on your behalf, this DPA governs that relationship. Where we process personal data for our own purposes (e.g., your account data), that processing is governed by our Privacy Policy.

This DPA is incorporated by reference into our Terms of Service, available at https://vezgo.com/terms-of-service/. In the event of any conflict between this DPA and the Terms of Service on data protection matters, this DPA prevails.

2.0 Definitions

3.0 How This DPA Applies to You

This DPA applies when you use the Services provided by the Company and, in doing so, cause Personal Data of your end-users to be processed on your behalf. We act as Data Processor; you remain the Data Controller and are responsible for the lawfulness of your processing instructions.

This DPA is designed to satisfy the requirements of a data processing agreement under Canadian law (PIPEDA) and, where relevant, Article 28 of the EU General Data Protection Regulation (GDPR). If your end-users are located in the EU or EEA, this DPA governs our processing on your behalf in that capacity as well. This DPA is intended to satisfy Article 28 processor agreement requirements.

If you have questions about how this DPA applies to your GDPR obligations, please contact us as specified in Section 13.0.

4.0 What Data We Process and Why

We process Personal Data only to deliver the Services. The table below describes our processing activities.

We do not process special categories of personal data (e.g. health, biometric, or religious data) through the Services. You must not instruct us to process such data without a separate written agreement.

5.0 Our Obligations as Data Processor

5.1 Processing on your instructions only

We process Personal Data only as necessary to deliver the Services and in accordance with your instructions, including as set out in the Terms of Service and this DPA. If we are required by law to process beyond those instructions, we will inform you to the extent legally permitted.

5.2 Confidentiality

Our personnel who access Personal Data are subject to binding confidentiality obligations and receive regular data protection training. Access is limited to those who need it to deliver the Services.

5.3 Security

We implement and maintain appropriate technical and organizational security measures, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent);
• Role-based access controls and the least-privilege principle; MFA for privileged access;
• Annual penetration testing by qualified third-party specialists;
• SOC 2 Type II audits by independent auditors; alignment with ISO/IEC 27001;
• Documented incident response and business continuity procedures.

5.4 Sub-processors

We may engage Sub-processors to help deliver the Services. By accepting this DPA, you grant us general authorization to do so, subject to: (a) we maintain an up-to-date Sub-processor list at https://vezgo.com/sub-processors; (b) we give at least 30 days’ advance notice of material changes; © all Sub-processors are bound by obligations no less protective than this DPA; and (d) we remain fully responsible for their compliance.

5.5 Data Subject Rights

We will assist you in responding to Data Subject rights requests (access, correction, deletion, portability). If we receive such a request directly from one of your end-users, we will not act on it unilaterally — we will redirect the individual to you as the Data Controller and notify you promptly, unless we are required by law to respond directly.

5.6 Audit Rights

We will demonstrate compliance with this DPA primarily through our current SOC 2 Type II report, which we will share upon written request. On-site or third-party audits are available only where you have reasonable documented grounds to believe the SOC 2 report is insufficient to demonstrate compliance with a specific obligation under this DPA, and are subject to our prior written approval, reasonable notice of no less than 60 days, a confidentiality agreement, and conducted at your expense. Audits may not be conducted more than once per calendar year absent a confirmed Security Incident.

6.0 Your Obligations as Data Controller

As Data Controller, you are responsible for:

• Ensuring you have a lawful basis for all processing instructions you give us;
• Providing end-users with appropriate privacy notices and obtaining all required consents or otherwise establishing a lawful basis for processing;
• Keeping access credentials, API keys, and authentication mechanisms secure;
• Ensuring your end-users and personnel comply with our Terms of Service;
• Notifying us promptly if you become aware of a Security Incident originating from your environment.

You represent and warrant that your instructions comply with Applicable Law. We are not responsible for your failure to meet data protection obligations that rest with you as Controller.

7.0 International Data Transfers

We primarily process Personal Data in Canada, in compliance with PIPEDA. Some Sub-processors are located outside Canada, including in the United States. Where Personal Data is transferred internationally, we ensure appropriate safeguards are in place — such as contractual clauses or recognized adequacy mechanisms — to maintain a level of protection equivalent to Canadian standards. Details are available in our Sub-processor list; refer to Section 5.4.

If your end-users are located in the European Union or European Economic Area, any transfer of their Personal Data to us is subject to GDPR Chapter V. We rely on Canada’s adequacy status under EU law and, where applicable, appropriate transfer mechanisms with our Sub-processors to ensure lawful international transfers. If you have specific questions about transfer mechanisms, please contact us as specified in Section 13.0.

8.0 Security Incident Notification

If we become aware of a Security Incident affecting Personal Data we process on your behalf, we will notify you without undue delay and, where feasible, within 72 hours. Our notification will include: the nature of the incident; the categories and estimated volume of affected Personal Data and Data Subjects; the likely consequences; and the measures taken or planned. We will cooperate with you on any notifications required to regulators or Data Subjects, and will not make public statements about an incident involving your data without your prior consent, which may be given by email, except as required by law.

9.0 Term and Data Return

This DPA remains in effect for as long as we process Personal Data on your behalf under the Terms of Service. Upon termination or expiration of your subscription, we will — at your written request made within 30 days of termination — return your Personal Data via the API or, where that is no longer available, in a commonly used electronic format upon request, or securely delete it within a reasonable period. We may retain Personal Data in secure backup systems for up to 3 months following termination, after which it will be permanently deleted. We may also retain Personal Data beyond that period only where required by law, and will continue to protect it in accordance with this DPA. Upon your request, we will confirm deletion in writing, which may be by email. Sections 1, 2, 8, 10, 11, and 12 survive termination.

10.0 Confidentiality and Data Use

We will not use Personal Data processed on your behalf for any purpose other than delivering the Services. We will not sell, rent, or otherwise make available for commercial gain your end-users’ Personal Data, and will not combine it with other clients’ data without your explicit consent. We may generate and use Anonymized Data for service improvement and performance monitoring. Both parties agree to keep confidential any non-public information exchanged in the course of using the Services.

11.0 Liability

Our liability under this DPA is subject to the limitation of liability provisions in the applicable Terms of Service. We are liable for direct losses arising from our material breach of this DPA. Neither party is liable for indirect, consequential, or punitive damages, except as required by Applicable Law. You are liable for losses arising from unlawful instructions, failure to obtain required consents, or unauthorized use of the Services by you or your end-users. Where both parties bear responsibility for a breach, liability is allocated in proportion to each party’s responsibility.

12.0 General

12.1 Governing Law

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada. Disputes shall be resolved before the courts of Ontario.

12.2 Updates to this DPA

We may update this DPA from time to time. We will post the updated version at https://vezgo.com/data-processing-agreement and notify you via email or in-product notice at least 30 days before material changes take effect. Continued use of the Services after the effective date constitutes acceptance.

12.3 Entire Agreement

Together with the applicable Terms of Service and Privacy Policy, this DPA constitutes the full agreement between the parties on data processing and supersedes any prior understandings on this subject.

12.4 Severability

If any provision of this DPA is found unenforceable, the remaining provisions continue in full force.

13.0 Contact

For questions about this DPA or data protection matters, please contact us at privacy@vezgo.com.