Data Processing Addendum

0. Parties, and how this addendum fits

This Data Processing Addendum ("Addendum") forms part of the agreement between CSR ECO SOLUTIONS INC., a corporation incorporated under the laws of the Province of Ontario, Canada, of 2 Island 130, Port Severn, Ontario L0K 1S0, doing business as csr eco solutions ("csr eco solutions"), and the customer named in the Order Form ("Customer") for the use of recovery (the "Platform").

If there is a conflict, the documents apply in this order: the Order Form; this Addendum; the Terms of Service; then csr eco solutions' policies, including the Privacy Policy, the Security and Data Storage Overview and the Data Retention and Deletion Schedule, each of which csr eco solutions provides to Customer on request.

Capitalised words not defined here have the meaning given in the Terms of Service.

1. Definitions

"Applicable Privacy Law" means the privacy laws that apply to a party's handling of Personal Information under this Addendum, including, where they apply, Canada's Personal Information Protection and Electronic Documents Act, Quebec's Act respecting the protection of personal information in the private sector, Alberta's Personal Information Protection Act and British Columbia's Personal Information Protection Act.

"Personal Information" means information about an identifiable individual that csr eco solutions handles on Customer's behalf through the Platform. It is found in Client Data and in the account details of Authorised Users.

"Security Incident" means a loss of, unauthorised access to, or unauthorised use or disclosure of Personal Information while it is held by csr eco solutions or a Subprocessor.

"Subprocessor" means a third party that csr eco solutions engages and that handles Personal Information on its behalf. The current Subprocessors are listed at https://recovery.csrecosolutions.com/legal/subprocessors (the "Subprocessor List").

2. Roles and scope

2.1 When this Addendum applies. This Addendum applies whenever Client Data contains Personal Information, and to Authorised Users' account details so far as csr eco solutions handles them to provide the Platform to Customer.

2.2 Customer decides. Customer decides what Personal Information is entered into or uploaded to the Platform, why, and who its Authorised Users are. Customer remains responsible for that Personal Information under Applicable Privacy Law.

2.3 csr eco solutions acts for Customer. csr eco solutions handles Personal Information as Customer's service provider, only to provide the Platform and only on Customer's instructions under section 3.

2.4 Where Customer acts for someone else. If Customer enters Personal Information on behalf of its own client or another organisation, Customer confirms that it is authorised to do so and to appoint csr eco solutions on these terms. Customer remains csr eco solutions' only point of instruction.

2.5 What csr eco solutions does on its own account. csr eco solutions decides for itself how it handles the following, under its Privacy Policy and not under this Addendum: (a) business contact, contract and billing details of Customer; (b) sign-in, security and audit records, and information used to prevent fraud and abuse of the Platform; (c) the comparison described in the Terms of Service under "Integrity Checks Across Accounts"; (d) records that Customer's Authorised Users accepted a notice or term; and (e) records csr eco solutions creates in delivering its own decommissioning services to Customer under a separate services agreement. csr eco solutions does not use anything in this section to do what section 3.3 forbids.

2.6 Projects csr eco solutions ran. Where csr eco solutions publishes into Customer's account a project that it ran for Customer, csr eco solutions made the records of that project itself, in running it, and keeps its own source record. csr eco solutions handles the source record on its own account under section 2.5(e). The published copy in the Platform is read-only to Customer. It shows the project's figures and display details, including the name of the csr eco solutions project manager and the site address. csr eco solutions may correct or withdraw the copy. Section 12.7 says when the copy is deleted.

2.7 Uploaded files. A file that Customer or an Authorised User uploads is Client Data. Customer decides which files to upload and is responsible for the personal information in them. csr eco solutions scans each file automatically for malware and saves images again in a standard form, to provide the Platform. That is not a review of the file's content by csr eco solutions.

3. Customer's instructions

3.1 The instructions. csr eco solutions will handle Personal Information only on Customer's documented instructions. Those instructions are: (a) the Order Form, this Addendum and the Terms of Service; (b) what Customer and its Authorised Users do in the Platform, including inviting users, sharing results with a channel partner or another person, and publishing a results page; and (c) any other written instruction that csr eco solutions accepts.

3.2 If the law requires otherwise. If a law that applies to csr eco solutions requires it to handle Personal Information in another way, csr eco solutions will tell Customer first, unless that law forbids it.

3.3 What csr eco solutions will not do. csr eco solutions will not: (a) sell Personal Information, or disclose it to anyone except as this Addendum allows; (b) use Personal Information, or any other Client Data, to market its services to Customer's customers; (c) use Client Data to introduce, recommend, rank or route work to any supplier, unless Customer asks it to for a named project; (d) use Client Data to train an artificial intelligence model, or send it to an artificial intelligence service, without Customer's agreement; or (e) keep Personal Information after the agreement ends, except as section 12 allows.

3.4 Instructions csr eco solutions cannot follow. csr eco solutions will tell Customer if it believes an instruction breaks Applicable Privacy Law, or if it can no longer meet this Addendum. It may pause the affected processing until the parties resolve the point.

4. Customer's responsibilities

4.1 Customer is responsible for having the authority, and for giving any notice and obtaining any consent that Applicable Privacy Law requires, to enter Personal Information into the Platform and to have csr eco solutions handle it under this Addendum.

4.2 The Platform is built to record decommissioning projects. It needs little Personal Information. Customer will not enter or upload health information, financial account details, government-issued identity numbers, or other sensitive information about individuals. Where a document shows more Personal Information than a project record needs, Customer should remove or cover it before uploading.

4.3 Customer is responsible for its Authorised Users: who they are, what role each holds, removing them when they leave, and keeping their sign-in details secure.

5. People who handle Personal Information

5.1 csr eco solutions limits access to Personal Information to the staff and contractors who need it to provide, secure or support the Platform.

5.2 Each of them is bound by a duty of confidentiality that continues after their engagement ends.

6. Security

6.1 csr eco solutions will protect Personal Information with safeguards appropriate to its sensitivity, including the measures in Annex 2. The Security and Data Storage Overview describes them in more detail.

6.2 csr eco solutions may change its measures as the Platform and threats change, but will not reduce the overall level of protection during the term.

6.3 Customer is responsible for the security of its own systems, and for how its Authorised Users use the Platform.

7. Subprocessors

7.1 General authorisation. Customer authorises csr eco solutions to use Subprocessors, including those on the Subprocessor List on the date of the Order Form.

7.2 Terms with Subprocessors. csr eco solutions will have a written agreement with each Subprocessor that requires it to protect Personal Information to a standard comparable to this Addendum and to use it only to provide its service. csr eco solutions remains responsible to Customer for what its Subprocessors do with Personal Information.

7.3 Notice of changes. Before a new Subprocessor starts to handle Personal Information, or an existing one starts to do so in a new country, csr eco solutions will update the Subprocessor List and email the owners and administrators of Customer's account at least 30 days beforehand.

7.4 Objection. Customer may object within that period, in writing to dpo@csrecosolutions.com, on reasonable grounds relating to the protection of Personal Information. The parties will work in good faith to resolve the objection, for example by a change in configuration or by not using the new Subprocessor for Customer's Personal Information. If they cannot resolve it within 30 days of the objection, Customer may end the affected service by written notice, and csr eco solutions will refund any prepaid fees for the period after the end date. This is Customer's only remedy for the objection.

7.5 Urgent replacement. If csr eco solutions must replace a Subprocessor urgently to keep the Platform secure or available, it will give notice as soon as it reasonably can, and Customer's right to object runs from that notice.

7.6 Who is not a Subprocessor. A channel partner, supplier or other person with whom Customer shares Client Data, or to whom Customer links its account, receives it on Customer's instruction and is not a Subprocessor.

8. Where Personal Information is held

8.1 Canada first. Client Data is stored in Toronto, Canada.

8.2 Outside Canada. Some Subprocessors handle limited Personal Information in the United States, as the Subprocessor List shows: for example, an email address and the content of a message when the Platform sends email, and a project's site address when the Platform places it on a map. csr eco solutions does not promise that all processing takes place in Canada.

8.3 What that means. Personal Information held outside Canada, or by a provider subject to another country's laws, may be accessed by the courts, law enforcement and national security authorities of that country. csr eco solutions uses its agreements with Subprocessors to give Personal Information a comparable level of protection wherever it is handled.

8.4 Assessments. If Applicable Privacy Law requires Customer to assess a transfer of Personal Information outside its province or country, csr eco solutions will give Customer the information it reasonably needs about the Subprocessors and their locations.

8.5 Moving the primary location. csr eco solutions will not move the storage of Client Data out of Canada without giving notice in the same way, and with the same right to object, as for a new Subprocessor under section 7.

9. Requests from individuals

9.1 If an individual asks csr eco solutions to access, correct or delete Personal Information, or to withdraw consent, and the request concerns Client Data, csr eco solutions will pass it to Customer within 5 business days and will not answer it except to say it has done so.

9.2 Customer can meet most requests itself, using the Platform to view, correct, export and delete Client Data. Where it cannot, csr eco solutions will give reasonable help, taking account of what the Platform can do.

9.3 csr eco solutions will also give Customer reasonable help with a privacy impact assessment, or with a question from a privacy regulator, that concerns the Platform.

9.4 Help under this section is included in the fees, unless a request is repetitive or needs substantial manual work, in which case csr eco solutions may charge its reasonable costs after telling Customer.

10. Security Incidents

10.1 Notice. csr eco solutions will notify Customer without undue delay, and in any case within 72 hours, after it becomes aware of a Security Incident affecting Customer's Personal Information.

10.2 What the notice says. So far as csr eco solutions knows it at the time: what happened and when; the kinds of Personal Information and roughly how many individuals are affected; what csr eco solutions has done and will do to contain it and reduce harm; and whom to contact. It will add to the notice as it learns more.

10.3 Where it goes. To the security contact named in the Order Form or, if none, to the owners of Customer's account.

10.4 What csr eco solutions does. It will act promptly to contain the Security Incident and to reduce the risk of harm, keep a record of it, and give Customer the information and reasonable help Customer needs to assess the risk, report to a regulator and notify individuals.

10.5 Who reports. Customer decides whether a Security Incident affecting Client Data must be reported to a regulator or notified to individuals, and makes those reports. csr eco solutions will not notify Customer's individuals itself unless Customer asks it to or the law requires it. csr eco solutions makes its own reports for information it handles on its own account under section 2.5.

10.6 No admission. A notice under this section is not an admission of fault or liability.

10.7 Attempts. This section does not require notice of unsuccessful attempts that do not affect Personal Information, such as blocked sign-in attempts or network scans.

11. Information and audit

11.1 Information first. On request, and no more than once in any 12 months, csr eco solutions will give Customer: the current Security and Data Storage Overview; written answers to a reasonable security questionnaire; and, when one exists, a summary of the most recent independent security test of the Platform.

11.2 What csr eco solutions does not hold. csr eco solutions does not hold a SOC 2 report or an ISO 27001 certificate. If it obtains either, it will provide the report or certificate under this section.

11.3 Follow-up questions. If that information does not reasonably show that csr eco solutions meets this Addendum, Customer may ask written follow-up questions, and csr eco solutions will answer them.

11.4 Audit. Customer, or an independent auditor bound by confidentiality, may inspect csr eco solutions' handling of Customer's Personal Information only where Applicable Privacy Law or a regulator requires it. An inspection: needs 30 days' written notice and an agreed scope; takes place in business hours, no more than once in any 12 months unless a regulator requires more; must not give access to any other customer's information or put the Platform's security at risk; and is at Customer's cost.

11.5 Anything Customer learns under this section is csr eco solutions' confidential information.

12. Return and deletion

12.1 During the term. Customer can view, correct, export and delete Client Data using the Platform.

12.2 When the agreement ends. For 30 days after the agreement ends, Client Data remains available to Customer to read and export. On request in that period, csr eco solutions will give Customer one archive of the records Customer entered, with a list of the files it uploaded.

12.3 Deletion. After that period, csr eco solutions will delete Client Data from the Platform's live systems.

12.4 Backups. Copies in backups are not deleted one by one. They are deleted as the backups age out. Until then csr eco solutions keeps them protected, does not use them except to restore the Platform after a failure, and, if a backup is restored, deletes Customer's Client Data from the restored copy.

12.5 What is kept. csr eco solutions may keep: (a) the information it handles on its own account under section 2.5, for the periods in the Data Retention and Deletion Schedule; and (b) anything a law requires it to keep, for as long as that law requires. This Addendum continues to apply to any Personal Information kept.

12.6 Confirmation. On request, csr eco solutions will confirm in writing that deletion under this section is complete, and when the last backup copy will age out.

12.7 Published projects, uploaded files and Enterprise. (a) A published copy of a project described in section 2.6 is not deleted when a paid plan ends. It is deleted from the Platform when Customer's organisation is closed and purged. csr eco solutions' own source record stays (section 12.5(a)). (b) A file that Customer deletes is removed after a short undo period, and a deleted file can be recovered from the storage provider's version history for 30 days, after which it is gone. Files are deleted with the Client Data under section 12.3, and copies in backups follow section 12.4. (c) When an Enterprise arrangement ends, Customer's organisation is treated as a paid plan that has ended, and section 12.2 applies.

13. Requests from authorities

If a court, regulator or government authority requires csr eco solutions to disclose Customer's Personal Information, csr eco solutions will, unless the law forbids it: tell Customer before disclosing, so that Customer can respond; and disclose only what the demand requires.

14. Liability

Each party's liability under this Addendum is subject to the limits and exclusions in the Terms of Service. Nothing in this Addendum limits a liability that Applicable Privacy Law does not allow the parties to limit.

15. Term and changes

15.1 This Addendum starts with the Order Form and lasts for as long as csr eco solutions holds Customer's Personal Information.

15.2 csr eco solutions may update this Addendum where a change in Applicable Privacy Law requires it, by giving Customer 30 days' notice. Any other change needs both parties' agreement in writing.

15.3 Contact for anything under this Addendum: Blake Leal, Managing Partner, the person in charge of the protection of personal information at csr eco solutions, at dpo@csrecosolutions.com.

Annex 1: Details of the processing

Annex 2: Security measures

csr eco solutions maintains at least the following measures. The Security and Data Storage Overview gives more detail.

1. Separation between customers. Each customer's records carry that customer's identifier. The database itself refuses to return one customer's rows to another (row-level security, enforced on every customer table), in addition to checks in the application. The customer is taken only from the signed-in session, never from anything the browser sends. Automated tests that try to read across customers run against a real database.
2. Sign-in. Passwords are stored only as salted argon2id hashes. Repeated failed sign-ins are slowed. Sign-in errors do not reveal whether an account exists.
3. Sessions. Sessions are held on the server and checked on every request. They end after 30 minutes without activity and after 12 hours in any case, at sign-out, on a password change, and when a user is disabled or removed. The session cookie is not readable by scripts and is sent only over an encrypted connection.
4. Protection against forged requests. Every request that changes data must come from the Platform's own address and carry a token tied to the session.
5. Encryption in transit. Connections between browsers and the Platform use TLS. Connections between the application and its database use TLS with the server's certificate verified.
6. Encryption at rest. The managed database is encrypted at rest by the hosting provider.
7. Least privilege in the database. The application connects with separate roles for separate jobs. None owns the tables, and none can bypass the separation in item 1. Sign-in secrets sit in a separate area that the customer-data role cannot read.
8. Input handling and errors. The server accepts only the fields it expects and sets the customer, author and data source itself. Errors shown to users carry a reference code and no technical detail.
9. Secrets. Passwords and keys are kept in a password manager and in protected files on the server, separate for each environment, and never in source code. Every code change is scanned for leaked secrets.
10. Software supply chain. Dependencies and server images are scanned for known vulnerabilities on code changes, and a fixable high or critical finding blocks the change.
11. Administrator access. Two-factor sign-in is on for csr eco solutions' server access, source code hosting and administrative accounts. Access to production systems is limited to named individuals.
12. Records. Sign-ins and security-relevant actions are logged.
13. Uploaded files (from the day uploads are switched on). Files are stored in private object storage in Toronto, encrypted at rest by the storage provider, with a version history. Only the application holds the storage keys, and files reach storage only through the application. Every file is scanned for malware by software on csr eco solutions' own server before it can be opened; a file that cannot be scanned is not shown. Files are opened only through short-lived signed links (5 minutes; 24 hours for an organisation logo). Only PDF, PNG, JPEG and WebP files within a size limit are accepted. Images are saved again in a standard form, which removes metadata such as the place a photo was taken.
14. Projects published by csr eco solutions. A project csr eco solutions publishes into Customer's account is sent from csr eco solutions' internal system to the Platform over a private network between those two systems, not over the public internet. Publication is a manual action by csr eco solutions staff.

Annex 3: Subprocessors

The Subprocessors on the date of the Order Form are those on the Subprocessor List at https://recovery.csrecosolutions.com/legal/subprocessors. Section 7 governs changes.