Legal
Data Processing Agreement (DPA)
Last Updated: 2026-10-23
1. Introduction
This Data Processing Agreement ("DPA") is entered into between Hivi (Hivi-x) ("Processor," "we," "us") and the business user ("Controller," "you") that uses Hivi-x (the "Service") to collect and process personal data about their clients or end-users.
When you use the Service as a business to collect personal data, including identification documents, health information, or other personal information from your clients, you act as the data controller and we act as the data processor for that data. This DPA sets out the terms on which we process that data on your behalf.
2. Definitions
- Controller: The business user (you) who determines the purposes and means of processing personal data of their clients or end-users through the Service.
- Processor: Hivi (Hivi-x), which processes personal data on behalf of the Controller.
- Personal Data: Any information relating to an identified or identifiable natural person that the Controller provides or that is submitted to the Service by or on behalf of the Controller's clients or end-users.
- Processing: Any operation performed on Personal Data (collection, storage, use, disclosure, etc.).
- Data Subject: The individual to whom the Personal Data relates (e.g., your client or end-user).
- Sub-processor: Any third party engaged by the Processor to process Personal Data on the Processor's behalf.
3. Scope and Roles
3.1 This DPA applies to all Processing of Personal Data by the Processor on behalf of the Controller when the Controller uses the Service to collect, store, or process data about their clients or end-users.
3.2 The Controller is responsible for ensuring that it has a lawful basis and has provided appropriate notice (including a privacy notice) to Data Subjects before collecting their Personal Data through the Service. The Controller shall not use the Service to collect Personal Data in violation of applicable law or without the necessary consent or legal basis.
3.3 The Processor shall process Personal Data only on the Controller's documented instructions, including as set out in this DPA and the Terms of Service, unless required to do otherwise by applicable law.
3.4 If the Controller enables calendar features (including Google Calendar synchronization), the Controller instructs the Processor to process calendar event data, reminder metadata, and synchronization metadata as needed to provide those features under the Service.
3.5 If the Controller enables a branded client portal or custom domain, the Controller instructs the Processor to display its supplied brand details and privacy-policy link, verify control of the domain, route client requests through the Service, and send related transactional messages. Branding does not change the parties' roles under this DPA. The Controller is responsible for its client notice and the privacy-policy URL it supplies.
4. Security and Confidentiality
4.1 The Processor shall implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, loss, destruction, or alteration, in line with the Processor's Privacy Policy and security practices.
4.2 The Processor shall ensure that any person authorized to process Personal Data is bound by confidentiality obligations.
5. Sub-processors
5.1 The Controller acknowledges that the Processor may use Sub-processors (e.g., infrastructure, hosting, payment processing) to provide the Service. A list of key Sub-processors is available in the Processor's Privacy Policy.
5.2 The Processor shall ensure that any Sub-processor is bound by contractual obligations that are substantially equivalent to those in this DPA.
5.3 Current Sub-processors. As of October 2026:
| Sub-processor | Purpose | Personal Data received | Location |
|---|---|---|---|
| Stripe | Subscription billing | The Controller's own account email address and an internal account identifier. No Data Subject records, documents or files. | United States |
| Optional. Sign-in, and calendar synchronization if the Controller connects a Google Calendar | Account email and basic profile; calendar event titles, descriptions and times | United States | |
| OVHcloud | Hosting infrastructure for the Processor's own mail server | Mail in transit, including any attachments the Controller instructs the Processor to send. OVHcloud supplies the machine; the Processor operates the mail software. | Beauharnois, Québec, Canada |
5.4 Data residency and delivery. Client records and documents uploaded through the secure guest portal are received and stored on the Processor's server in Canada; encrypted backup copies are kept in Canada. A custom portal domain is activated only after ownership, routing to the approved Canadian ingress, and HTTPS checks. We cannot guarantee that encrypted Internet traffic never crosses a national border. The Processor operates its own mail server in Québec and does not use a third-party email relay for these messages. Once email leaves that server, the recipient's provider and delivery networks may process it outside Canada. If the Controller enables Google Calendar synchronization, the calendar information described above is shared with Google under that optional integration. The separate account-data disclosures for Stripe and Google are described in the Privacy Policy.
Our standard app addresses, my-id.ca and hivi-x.ca, use .ca, Canada's country-code domain, and connect to our Canadian-hosted service. A business may choose its own domain with a different ending and use a registrar or DNS provider outside Canada. We do not require its custom domain or domain-service providers to be Canadian. The domain name alone does not determine where documents are stored: a custom domain connected to our portal must still route to our approved Canadian server. Using a custom domain does not move portal document storage outside Canada. Domain/DNS services and Internet transit may involve other countries with either address option, as explained below.
5.5 The Processor shall not engage any new Sub-processor that processes Data Subject records or documents without notifying the Controller in advance and allowing a reasonable opportunity to object.
5.6 Technical domain services. Custom-domain setup uses DNS lookups and Let's Encrypt (Internet Security Research Group, United States) for HTTPS certificates. These services receive the hostname and technical validation data, such as server addresses and DNS records; we provide our operations contact for certificate management. Certificate names are published in public Certificate Transparency logs and may remain there after domain removal. These services may process this metadata outside Canada; we do not send borrower documents or verification codes to them. Do not include a client's name or other confidential information in your portal hostname. See Let's Encrypt's privacy notice.
These services do not receive client documents for processing. Their independent roles and retention practices are described in their notices; this DPA does not promise erasure of public certificate logs.
6. Data Subject Rights
6.1 The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights (e.g., access, correction, deletion, portability) to the extent necessary and as permitted by the Service functionality. The Controller remains responsible for responding to Data Subject requests; the Processor will support as set out in the Service and documentation.
7. Data Breach
7.1 The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and shall provide information reasonably necessary to allow the Controller to meet any legal reporting or notification obligations.
8. Return and Deletion of Data
8.1 Upon termination of the Controller's use of the Service or upon the Controller's request, the Processor shall, in accordance with the Service's data retention and deletion procedures, delete or return Personal Data processed on behalf of the Controller, unless required to retain it by law.
9. Audits and Compliance
9.1 The Processor shall make available to the Controller information reasonably necessary to demonstrate compliance with this DPA and shall allow for audits or inspections as required by applicable law, subject to reasonable notice and confidentiality.
10. Governing Law
10.1 This DPA shall be governed by the laws of the Province of Ontario, Canada, and is subject to the Terms of Service. In the event of conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the processing of Personal Data on behalf of the Controller.
11. Contact
Questions regarding this DPA may be sent to: support@my-id.ca.
Effective Date: 2026-10-23
Last Updated: 2026-10-23