Data Processing Addendum
- Status
- Effective
- Version
- 2026-09-21-v1
- Effective date
- 2026-09-21
This legal instrument is currently owner-adopted in English and French. The English text is shown for this interface language until a reviewed convenience translation is available.
1. Scope and roles
This Addendum applies between KOTB Group Inc. and an organizational customer when KOTB Group Inc. processes Customer Personal Data on the customer's behalf through iKOTB. It forms part of the customer's iKOTB agreement once incorporated or agreed in writing. The customer determines purposes/instructions; KOTB Group Inc. acts as service provider/processor to the extent applicable.
2. Instructions and lawful data
The customer instructs KOTB Group Inc. to process Customer Personal Data as necessary to provide, secure, support and maintain iKOTB and follow documented instructions consistent with the Service. The customer is responsible for the lawfulness, accuracy and authority for data it provides.
3. Confidentiality and security
Access is limited to authorized personnel/providers subject to appropriate confidentiality obligations. Measures include organization-scoped RLS, private storage, role-based authorization, audit logging, authentication/session controls, TOTP/AAL2 for platform administrators, leaked-password protection, server-only secrets, security headers, rate limits, backups/recovery and transactional-email feedback handling. Measures may evolve without materially reducing overall protection.
4. Subprocessors and cross-border processing
The customer authorizes the providers listed in the current Subprocessors and Service Providers list. KOTB Group Inc. uses contractual or other appropriate measures intended to require protection and maintains provider review. Customer Personal Data may be processed outside the customer's province and outside Canada, including the current Supabase production region in the United States.
5. Rights assistance
Taking into account the nature of processing and information available, KOTB Group Inc. will provide reasonable assistance for valid access, correction, deletion or other privacy-right requests relating to Customer Personal Data. Current fulfillment/export/deletion procedures may be manual.
6. Security incidents
KOTB Group Inc. will investigate confirmed incidents affecting Customer Personal Data and notify the customer without undue delay when the incident materially affects Customer Personal Data or notice is required by law or agreement. The parties will reasonably cooperate on legally required notifications.
7. Return, retention and deletion
On termination or a valid documented request, KOTB Group Inc. will reasonably assist with return or deletion of Customer Personal Data, subject to law, legal holds, security/audit requirements, customer instructions and provider backup cycles. iKOTB currently uses a verified manual process rather than promising instantaneous automatic deletion.
8. Information, government requests and precedence
On reasonable request, KOTB Group Inc. will provide information reasonably necessary to demonstrate privacy/security measures, subject to confidentiality and proportionality. Where legally permitted, compulsory disclosures will be limited to what is required and affected customers will be notified where practicable. This Addendum controls a data-protection conflict with the main agreement; liability, governing law and dispute terms otherwise follow the main agreement unless mandatory law requires otherwise.