Privacy PIPEDA Document

PRIVACY PIPEDA AGREEMENT

This Privacy PIPEDA Agreement (the Agreement) is entered into as of Effective Date: by and between:

WHEREAS

WHEREAS the Organization collects, uses and discloses personal information in the course of its commercial activities and seeks to engage the Service Provider to perform certain services that involve access to or handling of personal information subject to the Personal Information Protection and Electronic Documents Act (PIPEDA);

WHEREAS the Service Provider has represented that it has implemented and will maintain appropriate administrative, technical and physical safeguards to protect Personal Information and will process such Personal Information only in accordance with the Organization’s instructions and in compliance with PIPEDA;

WHEREAS the parties wish to set out their respective obligations with respect to the collection, use, disclosure, retention, protection and disposition of Personal Information in connection with the services to be provided.

1. DEFINITIONS

For purposes of this Agreement: "Personal Information" means any information about an identifiable individual as defined by PIPEDA and related provincial privacy legislation, including but not limited to names, contact information, identifiers, account data and any other information the Organization designates as Personal Information.

2. SCOPE OF WORK

The Service Provider will perform the services described below and will access, receive, store, transmit, use, or otherwise handle Personal Information only for the purposes described and only as authorized by the Organization.

3. PAYMENT TERMS

In consideration for the services, the Organization will pay the Service Provider in accordance with the following terms.

4. TERM AND TERMINATION

This Agreement commences on Start Date: and continues until End Date: unless earlier terminated in accordance with this Section.

Either party may terminate this Agreement immediately upon written notice if the other party materially breaches its obligations relating to Personal Information and fails to cure such breach within thirty (30) days of receipt of notice. Termination for cause does not relieve the breaching party of liability for damages resulting from the breach.

5. CONFIDENTIALITY AND DATA HANDLING

The Service Provider shall treat all Personal Information received from or on behalf of the Organization as confidential information. The Service Provider shall:

a) Process Personal Information only for the purposes set out in this Agreement and in accordance with the Organization’s documented instructions; not use Personal Information for any other purpose without the Organization’s prior written consent.

b) Ensure that access to Personal Information is limited to employees, contractors and agents who have a need to know and who are subject to confidentiality obligations at least as protective as those in this Agreement.

c) Promptly return to the Organization or securely destroy all Personal Information upon termination or expiration of this Agreement, at the Organization’s option, except as otherwise required by applicable law; provide written certification of destruction upon request.

6. SECURITY MEASURES

The Service Provider represents and warrants that it has implemented and will maintain appropriate administrative, technical and physical safeguards to protect Personal Information against unauthorized access, disclosure, loss or destruction. Minimum safeguards include:

- Access controls and authentication
- Encryption of Personal Information in transit and at rest where technically feasible
- Regular vulnerability assessments and patch management
- Secure disposal procedures for media containing Personal Information

7. BREACH NOTIFICATION

The Service Provider shall notify the Organization without undue delay and in any event within of becoming aware of a breach of security safeguards that creates a real risk of significant harm to an individual. The notice shall include the nature of the breach, the Personal Information affected, mitigation measures and contact information for further inquiries.

8. SUBCONTRACTING AND THIRD PARTIES

The Service Provider shall not engage any subcontractor to process Personal Information without the Organization’s prior written consent. Where such consent is provided, the Service Provider shall require each subcontractor to be bound by written obligations no less protective than those set out in this Agreement. The Service Provider remains fully liable for the acts and omissions of its subcontractors.

9. CROSS-BORDER TRANSFERS

Personal Information shall not be transferred or stored outside of Canada except with the Organization’s prior written consent. Where consent is granted, the Service Provider shall implement additional safeguards to ensure an equivalent level of protection as required under PIPEDA and shall inform the Organization of the jurisdictions involved.

10. INDIVIDUAL RIGHTS

The Service Provider shall promptly notify the Organization of any request received from an individual to access, correct, or withdraw consent regarding Personal Information processed under this Agreement, and shall not respond to such requests without the Organization’s prior written instruction except as required by law.

11. AUDIT AND RECORDS

The Service Provider shall maintain records sufficient to demonstrate compliance with this Agreement and PIPEDA. Upon reasonable notice, the Organization (or an independent auditor engaged by the Organization) may audit the Service Provider’s policies, procedures and records during normal business hours to verify compliance. Audit findings shall be remedied within a timeframe agreed by the parties.

12. REPRESENTATIONS AND WARRANTIES

Each party represents and warrants that it has the authority to enter into this Agreement. The Service Provider further represents that its processing of Personal Information will comply with PIPEDA and that it will implement and maintain reasonable security practices appropriate to the sensitivity of the Personal Information.

13. LIMITATION OF LIABILITY

Except for liability arising from willful misconduct, gross negligence, or a material breach of confidentiality or data protection obligations, neither party shall be liable to the other for indirect, incidental, consequential, special or punitive damages.

14. GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the Province of and the laws of Canada applicable therein.

15. ENTIRE AGREEMENT

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations and discussions, whether oral or written. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

16. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the contact persons set out above at the addresses provided, or to such other address as either party may designate by notice in accordance with this Section.

17. CERTIFICATIONS

Each party certifies that the individual executing this Agreement on its behalf is duly authorized to bind the party and that the party will comply with all applicable privacy laws and obligations set out herein. Failure to comply with obligations under this Agreement may expose the parties to regulatory action, enforcement measures and potential liability.

Sign Now