Data Processing Agreement

Agreement Overview

A Clear Framework for Customer Data

This agreement sets out how EMPHOS Group Corporation handles personal information entrusted to it for an agreed business service. It defines the Customer’s instructions, EMPHOS’s processor obligations, and the arrangements for security, privacy requests, subprocessors, transfers, and deletion.

The service agreement and processing schedule identify the actual services, information, locations, and safeguards covered. Individual privacy requests and EMPHOS’s independent business processing are addressed separately so each request reaches the responsible party.

Section 1

When This Agreement Applies

This Data Processing Agreement (“DPA”) forms part of a service agreement or order form between EMPHOS Group Corporation (“EMPHOS”) and a business customer (“Customer”) when that agreement incorporates this DPA. It applies only to personal information EMPHOS processes on the Customer’s behalf in providing the agreed services (“Customer Personal Data”).

The service agreement, order form, and agreed processing schedule identify the services covered. These may include agreed hosted, managed, support, or connected services associated with Heinrich, Aletheia, FieldLine PDF, FieldLine Planner, FieldLine Construction, RightNow Maintenance, or other EMPHOS software. A product name alone does not determine the processing role or place every feature within this DPA. FLORA in those four desktop applications runs on the device. A FLORA question, guide excerpt, or reply is Customer Personal Data under this DPA only when the customer later submits it to EMPHOS or makes it accessible through an agreed connected service.

Files, projects, prompts, outputs, and other information that remain entirely on a Customer’s device and are not submitted or made accessible to EMPHOS are outside this DPA. A separately enabled connected feature or a support submission is assessed according to the information actually provided and the agreed purpose.

Section 2

Definitions & Processing Roles

• Personal information / personal data: information about an identified or identifiable individual, as defined by applicable data protection law.
• Controller: the party that determines why and how personal data is processed. The Customer acts as controller for Customer Personal Data, or as a processor authorized by its own controller to engage EMPHOS.
• Processor: a party processing personal data on a controller’s behalf. EMPHOS acts as processor, or subprocessor where the Customer is itself a processor, for the processing covered by this DPA.
• Subprocessor: a provider engaged by EMPHOS to process Customer Personal Data on the Customer’s behalf.
• Applicable data protection law: the privacy and data protection laws that apply to the particular processing, including the EU GDPR, UK GDPR, Canada’s PIPEDA, and British Columbia’s PIPA where applicable.

2.1 EMPHOS’s own business records

EMPHOS acts independently for information it processes for its own account administration, billing, fraud prevention, legal compliance, product security, and direct customer communications. Those activities are governed by applicable law and the Privacy Policy. This distinction depends on the purpose of each activity; it does not authorize EMPHOS to repurpose Customer Personal Data.

2.2 Shopify and other providers

Our online store uses Shopify. Shopify may process merchant customer data as a processor and may act independently for specified services. Its role depends on the service and applicable terms, including the Shopify Data Processing Addendum. A storefront provider is not automatically a subprocessor for every EMPHOS software service.

Where the Customer engages EMPHOS as a subprocessor, the Customer confirms that its controller has authorized that engagement and the relevant instructions. Neither party is relieved of responsibilities that applicable law places directly on it.

Section 3

Customer Instructions & Responsibilities

3.1 Documented instructions

EMPHOS will process Customer Personal Data only on the Customer’s documented instructions, including instructions about international transfers, or as required by applicable law. Instructions include the agreed service agreement, order form, processing schedule, this DPA, and authorized written directions within the service’s scope.

Where law requires processing outside those instructions, EMPHOS will inform the Customer of that requirement before processing unless the law prohibits that notice. If EMPHOS believes an instruction infringes applicable data protection law, it will inform the Customer immediately and work with the Customer to resolve the issue before carrying out the affected instruction.

Customer Personal Data will not be used for EMPHOS’s independent advertising, general model training, or other independent purposes under this DPA. Any separately proposed use requires its own lawful basis and appropriate agreement; a support upload or service request does not itself authorize that use.

3.2 Customer responsibilities

The Customer determines the purposes and lawful basis of its processing, provides required notices, obtains necessary permissions or consent, and ensures it is entitled to provide the information and instructions. Where the GDPR or UK GDPR applies, the Customer identifies the applicable lawful basis and any additional condition required for special-category data.

The Customer will limit submissions to information needed for the service, maintain appropriate account and device access controls, and keep an authorized service and privacy contact available. It remains responsible for the accuracy and lawfulness of its instructions and for responding to individuals as controller, with EMPHOS’s assistance as set out below.

Section 4

Processing Schedule

The agreement or order form records the particulars of the processing. The framework below is completed or narrowed for the actual service, including its security measures, subprocessors, locations, and deletion arrangements, before Customer Personal Data is processed.

The Customer’s rights and obligations are set out in this DPA and the service agreement. Changes to processing purposes or categories must remain within documented instructions and be reflected in the agreed schedule where required. Product documentation describing an optional feature does not by itself authorize that feature to process Customer Personal Data.

Section 5

Confidentiality & Security

EMPHOS will ensure that personnel authorized to process Customer Personal Data are subject to contractual or statutory confidentiality obligations and may access that information only as needed for their authorized work.

EMPHOS will implement and maintain technical and organizational measures appropriate to the processing risks, taking account of the nature, scope, context, and purpose of the processing, the state of the art, and implementation costs. The agreed security schedule describes the measures for the service.

• Access protection: authorization controls, least-privilege access, and procedures to remove access when it is no longer required.
• Data protection: encryption and pseudonymization where appropriate to the processing and risk.
• Operational safeguards: relevant logging, secure development and change practices, vulnerability handling, and incident response.
• Continuity: measures to protect confidentiality, integrity, availability, and resilience, including timely recovery of access following an incident where relevant.
• Review: assessment and testing of the effectiveness of security measures appropriate to the service.

EMPHOS will not materially reduce the agreed level of protection during the service term. The Customer is responsible for the security of devices, networks, credentials, and configurations under its control.

Section 6

Subprocessors

6.1 Authorization and transparency

EMPHOS will engage a subprocessor for Customer Personal Data only with the Customer’s prior specific or general written authorization. The service’s subprocessor schedule identifies the authorized entities, their functions, and processing locations. General authorization applies only as set out in that agreed schedule or service agreement.

Where the Customer gives general authorization, EMPHOS will provide advance written notice of intended additions or replacements, with enough information and time for the Customer to raise a reasonable data protection objection before the change takes effect. The agreement may specify the notice period and objection process. The parties will work to resolve an objection before the proposed subprocessor processes the affected data.

6.2 Contractual protection

EMPHOS will require each subprocessor to accept written data protection obligations that provide materially no less protection than this DPA for the relevant processing, including appropriate security measures. EMPHOS remains responsible to the Customer for the subprocessor’s performance of those obligations as required by applicable law.

A third-party service the Customer contracts with directly is governed by that separate relationship. Its use does not automatically make it an EMPHOS subprocessor or authorize EMPHOS to send Customer Personal Data to it.

Section 7

Privacy Requests & Customer Assistance

7.1 Requests concerning Customer Personal Data

Taking account of the nature of processing, EMPHOS will assist the Customer through appropriate technical and organizational measures, insofar as possible, with requests to exercise rights under applicable data protection law. This includes locating, accessing, correcting, exporting, restricting, or deleting information where the relevant right applies.

If EMPHOS receives a request directly concerning Customer Personal Data, it will promptly notify or refer the request to the Customer and will not independently determine the response unless instructed by the Customer or required by law. Assistance will be provided in time to support the Customer’s applicable response obligations.

7.2 Requests about EMPHOS’s own processing

For information EMPHOS handles independently, contact info@emphosgroup.com. Depending on the law that applies, rights may include access, correction, deletion, portability, restriction, objection, withdrawal of consent, and a complaint to a privacy authority.

We will respond within the period required by applicable law and explain any permitted extension or limitation. We may request proportionate information to verify identity or authority. The subject line “DATA SUBJECT REQUEST” helps route an email; no particular subject line is required to exercise a right.

Where processing is based on consent, withdrawal applies going forward and does not affect the lawfulness of earlier processing. Details about EMPHOS’s independent processing and the rights that apply are in the Privacy Policy.

Section 8

Personal Data Breaches

8.1 Notification to the Customer

EMPHOS will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. A personal data breach includes accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to that information.

The initial notice will include the information then available about the incident, the categories and approximate numbers of affected individuals and records where known, likely consequences, measures taken or proposed, and a contact for further information. EMPHOS will provide updates as the investigation develops; the initial notice will not wait for every detail to be established.

EMPHOS will take appropriate steps to contain and investigate the breach, mitigate its effects, preserve relevant records, and assist the Customer with its legal obligations. The Customer must keep its incident contact details current.

8.2 Regulatory and individual notifications

The Customer is responsible for determining and making notifications for processing for which it is controller, with EMPHOS’s assistance. This does not displace any notification or record-keeping duty that applies directly to EMPHOS.

Under the GDPR and UK GDPR, a controller generally reports a breach to the competent authority without undue delay and, where feasible, within 72 hours of awareness, unless it is unlikely to create a risk to people’s rights and freedoms. Notification to affected individuals is required without undue delay where the applicable high-risk threshold is met, subject to legal exceptions.

Under PIPEDA, the organization with control of the information must report to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible after determining that a breach creating a real risk of significant harm has occurred. Applicable breach-record obligations also apply. These rules are distinct from the GDPR’s authority-notification timeline.

Section 9

International Data Transfers

Processing and access locations must follow the agreed schedule, the Customer’s instructions, and applicable transfer requirements. EMPHOS will not make a restricted international transfer of Customer Personal Data unless the required legal mechanism and safeguards are in place.

• EEA data: where applicable, a European Commission adequacy decision may cover the transfer. Otherwise, an appropriate mechanism such as the applicable EU Standard Contractual Clauses is required, together with the required assessment and supplementary measures.
• UK data: UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism may apply. EU clauses alone do not satisfy UK restricted-transfer requirements.
• Canadian information: the parties will maintain the contractual and other safeguards required by the applicable Canadian privacy law, including accountability for information transferred for processing.

Where contractual transfer clauses are needed, the parties will complete the required details, annexes, and applicable modules in a binding agreement or transfer schedule before the transfer. Any required transfer assessment and additional safeguards must also be completed. Publication of this page alone does not complete those arrangements.

EMPHOS will provide information reasonably needed for those assessments and inform the Customer if it can no longer meet an applicable transfer safeguard. The affected transfer must be suspended or brought into compliance as required by law and the governing transfer terms.

Details of the UK mechanisms are available in the ICO’s guidance on the IDTA and Addendum.

Section 10

Retention, Return & Deletion

EMPHOS will retain Customer Personal Data only for the agreed service and documented instructions, subject to legally required retention. The agreed schedule specifies the return method, deletion period, and treatment of backup copies for the service.

At the end of the relevant processing services, EMPHOS will, at the Customer’s choice, return or delete Customer Personal Data and delete remaining copies, unless applicable law requires storage. EMPHOS will also carry out valid deletion instructions during the service where required by the agreement or law.

Backup deletion will follow the agreed schedule and applicable law. Pending deletion, backup copies must remain protected, excluded from ordinary use, and used only where necessary for authorized recovery or a legal requirement. If restored, the applicable deletion instruction will be reapplied.

Where retention is legally required, EMPHOS will retain only the information required for that purpose, restrict its use, continue protecting it, and delete it when the requirement ends. On request, EMPHOS will provide confirmation of completed return or deletion and identify any legally required retention unless prohibited from doing so.

Local files and copies under the Customer’s control remain the Customer’s responsibility. Separate retention of EMPHOS’s own accounting, transaction, legal, and other independent business records is addressed by the Privacy Policy and applicable law; it does not create a general right to keep Customer Personal Data after the processing service ends.

Section 11

Assistance, Information & Audits

Taking account of the processing and the information available to it, EMPHOS will assist the Customer with applicable security obligations, breach reporting, data protection impact assessments, and prior consultation with privacy authorities.

EMPHOS will make available the information necessary to demonstrate compliance with the processor obligations that apply to it and will allow and contribute to required audits, including inspections, by the Customer or an auditor it appoints.

The parties will coordinate reasonable notice, scope, confidentiality, and security arrangements. Documentation and remote review may address an inquiry where sufficient. Audit arrangements must protect other customers’ information and systems, and may not prevent an inspection, urgent inquiry, or access required by applicable law or a competent authority.

Each party will cooperate with competent privacy authorities as required by law and maintain the records required for its role. Where lawful, EMPHOS will inform the Customer of an authority’s request relating to Customer Personal Data and provide relevant assistance.

Section 12

Privacy & Agreement Contacts

For a processing agreement, service schedule, subprocessor details, privacy request, or incident concerning Customer Personal Data, contact:

For business requests, include your organization, relevant service, and agreement or order reference if available. For a security incident, identify the affected service and a contact we can reach. Please avoid sending unrelated personal information or credentials.

Privacy authorities

You may raise a complaint with the privacy authority that has jurisdiction over your concern. This page does not require you to complete an EMPHOS review before exercising a statutory complaint right.

• Canada: Office of the Privacy Commissioner of Canada.
• British Columbia: Office of the Information and Privacy Commissioner for British Columbia.
• United Kingdom: Information Commissioner’s Office.
• EEA: the competent national data protection authority; see the European Data Protection Board’s member directory.

Section 13

Precedence & Updates

This DPA controls in the event of a conflict with the service agreement concerning the processing of Customer Personal Data, unless the parties expressly agree to different lawful terms. Mandatory data protection requirements and the governing terms of any applicable transfer clauses take priority.

This page may be updated as our services and data protection arrangements change. The date above identifies this version. Changes to a DPA already incorporated into a Customer’s agreement take effect through that agreement’s amendment procedure; changing the website date does not, by itself, replace an agreed version or authorize new processing.

Nothing in this DPA limits individuals’ non-waivable rights, a competent authority’s powers, or either party’s direct duties under applicable data protection law.