Data processing agreement

Contents

Version 2026-11-04.1

Parties and scope

This Data Processing Agreement is between LeakTrace Inc., an Ontario corporation, 1200 Bay Street, Suite 1201, Toronto, ON M5R 2A5, Canada ("LeakTrace") and the business customer that bought an External Cybersecurity Assessment or business monitoring ("Customer").
It forms part of the Terms of Service and, where Customer bought an assessment or monitoring, the Authorized Scan Agreement.

For the reading data LeakTrace processes only to deliver what Customer bought, Customer decides why it is processed and LeakTrace processes it on Customer's behalf as its processor. In this agreement that is "Customer Data".
Customer Data includes the work addresses at Customer's own domain that are checked against breach data, the contacts on Customer's record and what Customer enters on its own pages.
LeakTrace's own decisions about information it collects for its own purposes, such as billing and the security of its systems, are governed by its Privacy Policy, not by this agreement.

LeakTrace processes Customer Data only to provide the services Customer bought and on Customer's documented instructions, which are the agreements named in section 1 and this agreement.
LeakTrace does not sell Customer Data and does not use it for its own marketing.
Everyone at LeakTrace who can reach Customer Data is bound by confidentiality.
LeakTrace never says who its customers are or whether Customer is one.
LeakTrace protects Customer Data with the safeguards described at getleaktrace.com/security/.

Customer authorises the subprocessors listed at getleaktrace.com/security/subprocessors/ on the date this agreement takes effect.
LeakTrace updates that page at least 30 days before a new subprocessor starts receiving Customer Data. Customer may object in writing within that period on reasonable privacy grounds.
If the parties cannot resolve an objection, Customer may end the affected service and receive a refund of any prepaid fees for the period after it ends.
LeakTrace binds each subprocessor to protection at least as strong as this agreement in substance and remains responsible to Customer for its subprocessors.

LeakTrace notifies Customer within 72 hours after it becomes aware of a breach of its security safeguards that involves Customer Data.
The notice says what happened, what information is involved, what LeakTrace has done and what Customer can do. LeakTrace updates it as it learns more.
LeakTrace keeps a record of every such breach for at least 24 months.

On Customer's written request LeakTrace deletes Customer Data and confirms the deletion in writing within 30 days.
Deleted data ages out of encrypted backups as older backups are replaced, within about ten weeks.
LeakTrace keeps what the law requires it to keep and its evidence record of what was agreed, ordered, paid and delivered. It tells Customer what it kept.

A paid assessment's readings are kept for the life of the engagement and seven years after, unless Customer asks for their deletion sooner.
Customer page sign-in codes and each try at one are deleted seven days after they are made.
Purchase records are kept at least six years after the tax year they relate to.
The evidence record is kept 15 years from each entry.
The periods for every other record are at getleaktrace.com/security/data-handling/.

Once a year, or after a breach described in section 5, Customer may ask for the decision trace and evidence record entries about its own record.
LeakTrace provides them within 30 days. Each decision trace row records one decision and its outcome. Each evidence record entry is chained to the one before it, so a later change to an entry can be detected.
LeakTrace answers Customer's reasonable written questions about its safeguards within the same period.

This agreement lasts as long as LeakTrace processes Customer Data.
When the services end, LeakTrace stops processing Customer Data except to keep what section 6 allows. Customer may ask for deletion under section 6 at any time.
Sections 5, 6 and 8 continue for as long as LeakTrace holds any Customer Data.