Data Processing Agreement

1. Purpose

This Data Processing Agreement ("DPA") is entered into between:

• The Client ("Controller") – a user of Get Allan's services, and
• Aplo CFO Inc., operating as Get Allan ("Processor"), a corporation incorporated in Ontario, Canada.

This DPA describes how Aplo CFO Inc., operating as Get Allan ("Get Allan", "we", "our", or "us") processes Personal Data on behalf of the Client in connection with the services provided under the Terms of Use or any other signed agreement (collectively, the "Agreement").

This DPA forms part of the legally binding agreement between the parties.

2. Definitions

• "Personal Data": Any information relating to an identifiable natural person, as defined under applicable data protection laws.
• "Processing": Any operation performed on Personal Data, including collection, storage, use, or disclosure.
• "Data Subject": An individual whose personal data is processed.
• "Subprocessor": Any third party engaged by the Processor to process Personal Data on its behalf.
• "Applicable Data Protection Laws": Refers to all laws and regulations governing the protection of Personal Data, including PIPEDA, GDPR (if applicable), UK GDPR, and any other local privacy regulations.
• "EU/UK Data Protection Laws": Refers to the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK Data Protection Act 2018 / UK GDPR.
• "Standard Contractual Clauses (SCCs)": Refers to the EU Standard Contractual Clauses (Module 2) and the UK International Data Transfer Addendum incorporated into this DPA.

3. Roles and Responsibilities

• The Controller determines the purposes and means of processing Personal Data.
• The Processor shall process Personal Data only on the documented instructions of the Controller and only to the extent necessary to deliver services. The Processor shall immediately notify the Controller if, in its opinion, an instruction infringes Applicable Data Protection Laws.

4. Nature of Processing

Subject matter: Provision of forecasting, inventory planning, financial modeling, and professional implementation services (including email automation setup and campaign management).

Duration: For the duration of the Agreement.

Types of Personal Data: Customer names, email addresses, shipping/billing addresses, purchase history, and any other data accessed through integrations (e.g., Shopify).

Categories of Data Subjects: End customers of the Controller, employees or contractors of the Controller, and any other users added to the Controller's account.

AI Usage Restrictions: Personal Data processed under this DPA shall not be used to train public, foundational, or shared third-party artificial intelligence (AI) models.

5. Processor Obligations

The Processor shall:

• Only process Personal Data as instructed by the Controller;
• Implement appropriate technical and organizational measures to protect data against unauthorized or unlawful processing, accidental loss, destruction, or damage;
• Ensure personnel authorized to process Personal Data are under confidentiality obligations;
• Assist the Controller, where feasible, in responding to data subject rights requests;
• Notify the Controller without undue delay upon becoming aware of a data breach;
• Provide reasonable assistance with data protection impact assessments (DPIAs) or audits, where required by law.

6. Subprocessing

The Controller authorizes the Processor to engage Subprocessors as needed to provide the services. A current list of Subprocessors (including Aplo Group Ltd. for Development, Maintenance, and Professional Services) can be provided upon request.

Where Controller is established in the European Union or the United Kingdom, or to the extent Personal Data is subject to EU or UK Data Protection Laws, Processor shall provide Controller with at least fourteen (14) days' prior written notice before engaging any new Subprocessor. Controller may object to such appointment in writing within the notice period on reasonable data protection grounds.

The Processor will:

• Ensure any Subprocessor is contractually bound by data protection terms no less protective than this DPA;
• Remain liable for the actions of any Subprocessor.

7. Data Transfers

Where Personal Data subject to EU or UK Data Protection Laws is transferred across borders to a third country outside the EEA or UK, the parties agree to abide by and incorporate by reference:

• The EU Standard Contractual Clauses (Module 2: Controller-to-Processor), attached hereto as Annex 1; and
• The UK International Data Transfer Addendum, attached hereto as Annex 2.

For Subprocessors located in the United States, the Processor will verify that such Subprocessors maintain active certification under the EU-U.S. Data Privacy Framework (DPF) or execute standard contractual clauses.

8. Security Measures

The Processor implements industry-standard technical and organizational measures, including but not limited to:

• Encrypted transmission (TLS/SSL) and encryption at rest (AES-256)
• Secure API keys and access tokens
• Role-based access control
• Regular security assessments

Details of technical and organizational measures can be made available upon request.

9. Data Subject Requests

The Processor will:

• Promptly notify the Controller of any request received directly from a Data Subject (e.g., access, correction, deletion);
• Not respond to such requests without the Controller's instructions unless required by law;
• Provide reasonable assistance to enable the Controller to respond to such requests.

10. Breach Notification

In the event of a Personal Data Breach, the Processor shall:

• Notify the Controller without undue delay after becoming aware;
• Provide information regarding the nature, impact, and mitigation efforts;
• Cooperate fully in any investigation or regulatory response.

11. Return or Deletion of Data

Upon termination of the Agreement:

• The Controller may request that all Personal Data be returned or securely deleted;
• The Processor shall, within a reasonable timeframe, delete or anonymize Personal Data unless retention is required by law.
• The Processor shall provide written certification of data deletion upon written request from the Controller.

12. Audit Rights

The Processor shall make available, upon written request, relevant documentation to demonstrate compliance with this DPA. The Controller may audit the Processor's compliance with this DPA, provided:

• Reasonable notice is given;
• Audits are limited to once annually unless required due to a breach or investigation.

13. Limitation of Liability

Liability under this DPA is subject to the limitations set forth in the main Agreement, unless otherwise required by law.

14. Governing Law

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. Disputes arising from or related to this DPA will be subject to the exclusive jurisdiction of the courts in Ontario.

15. Contact

Get Allan

+1 (249) 508 5889

info@aplogroup.com

135 Laurier Ave W, Ottawa, ON, Canada, K1P 5J2

Annex 1: EU Standard Contractual Clauses (Module 2: Controller-to-Processor)

(Incorporated by reference to Commission Implementing Decision (EU) 2021/914)

Annex 2: UK International Data Transfer Addendum

(Incorporated by reference to UK Information Commissioner's Office Template B1.0)