Data Processing Agreement

You (the customer)

You decide why and how personal information is collected through your receptionist. Under privacy law you are the controller, and under PHIPA you may be the health information custodian. You are responsible for having a lawful basis and for giving your callers the notice and consent your situation requires.

Us (Distronode Corporation)

We act as your processor and service provider. We handle personal information on your instructions to deliver the service, and we do not decide the purposes of your processing. Distronode Corporation is a Canadian corporation, federally incorporated under the Canada Business Corporations Act, with our founder and CEO, Sean Dean, accountable for privacy.

Process only on your instructions

We process personal information only to provide the service and to follow your documented instructions, including the settings you choose in your workspace. We do not use your content for our own purposes and we do not sell it. We may use statistics about use of the service that are aggregated and de-identified so that they identify neither you nor any individual.

Confidentiality

The people who handle your data are bound by confidentiality obligations, and access to production data is scoped and least-privilege.

Security

We keep appropriate technical and organizational safeguards. They are encryption in transit (TLS 1.2 or higher); database storage encrypted at rest by the provider hosting each region, with a second layer through Google Cloud KMS for stored third-party credentials; tenant isolation enforced by PostgreSQL row-level security; managed secrets; and rate limiting in front of authentication.

Sub-processors

We use vetted sub-processors to run the platform and remain responsible for their performance. We keep a current list and give at least 30 days' notice before adding or replacing one so you can object.

Assisting with individual requests

We help you respond to access, correction, deletion, and portability requests from the people whose information you process, using the export and deletion tools in the product and direct support where needed. Someone who contacts us directly about information you control is redirected to you, and we do not answer on your behalf unless you ask us to; help beyond the product tools may be charged at a reasonable rate where requests are excessive.

Breach notification

We maintain incident logs and will notify you without undue delay, and in any case within 48 hours of confirming a personal-data breach affecting your workspace, with the information you need to meet your own notification duties.

Deletion and return

On termination, or on your request, we delete or return your workspace data. Archived call recordings are also deleted on a retention schedule (90 days by default; a different default retention window can be arranged as part of an enterprise agreement). On request, we confirm deletion in writing.

Records and cooperation

We keep records of our processing and cooperate with your reasonable audit and information requests, and with supervisory authorities where the law requires it. Documentation, written answers and any third-party report we hold come first; an audit beyond that is limited to once in any twelve-month period, on at least 30 days' written notice, during business hours, at your cost, under confidentiality, in an agreed scope, and never touching another customer's data.