Data Processing Agreement (DPA) Availability

This page clarifies whether a Data Processing Agreement (DPA) may be requested by clients of My Waypoint Technologies Inc., and the circumstances in which a DPA may be appropriate.

This is an availability statement. It does not constitute a DPA itself. The terms of any DPA would be established through a separate written agreement.

A Data Processing Agreement (DPA) is a contract between a data controller and a data processor that governs how personal information is processed on behalf of the controller.

DPAs are commonly used when:

• A service provider processes personal information on behalf of a client organization
• The client organization is subject to privacy regulations that require contractual protections for data processing activities
• The client organization's procurement or compliance requirements mandate a DPA with service providers

Under Canadian privacy law (PIPEDA and PIPA BC), organizations are responsible for personal information transferred to service providers and must use contractual or other means to provide comparable protection.

A DPA with My Waypoint Technologies Inc. may be appropriate where:

• My Waypoint Technologies Inc. is providing hosting, managed services, or data processing services that involve access to personal information belonging to the client's customers or employees
• The client organization is subject to privacy regulations that require contractual data processing protections
• The client organization's internal policies or procurement requirements mandate a DPA with service providers
• The nature of the engagement involves ongoing processing of personal information on behalf of the client

A DPA is generally not required for engagements that do not involve My Waypoint Technologies Inc. accessing or processing personal information on behalf of the client.

My Waypoint Technologies Inc. may consider DPA requests from:

• Business clients engaging MyWaypoint for hosting, managed services, or professional services that involve personal information processing
• Organizations subject to Canadian privacy law (PIPEDA, PIPA BC, or provincial equivalents) that require contractual protections for data processing
• Organizations subject to other privacy frameworks that require DPAs with service providers

DPA requests are evaluated on a case-by-case basis. My Waypoint Technologies Inc. does not guarantee that a DPA will be offered in all circumstances.

My Waypoint Technologies Inc.'s Privacy Policy governs the collection, use, and disclosure of personal information in connection with our products and services.

A DPA supplements the Privacy Policy by establishing specific contractual obligations regarding the processing of personal information on behalf of a client. Where a DPA exists, its terms govern the processing activities described in that agreement.

The Privacy Policy continues to apply to personal information collected directly by My Waypoint Technologies Inc. in connection with its own operations.

My Waypoint Technologies Inc. requires its own service providers and subprocessors to protect personal information through contractual means. Our vendor management practices include DPA or equivalent contractual protections with vendors that process personal information on our behalf.

See our Vendor and Subprocessor Disclosure for the named list of vendors and the safeguards in place.

A DPA with My Waypoint Technologies Inc. would reflect the same accountability principle — establishing clear contractual obligations for the protection of personal information processed on behalf of clients.

To inquire about a Data Processing Agreement, contact:

Email: legal@mywaypoint.ca
Subject: Data Processing Agreement Request

Please include:

• Your organization name and contact information
• A brief description of the services you are engaging or considering
• The nature of the personal information involved
• The privacy framework or regulatory requirement driving the DPA request

We will review your request and respond within a reasonable time. DPA requests are evaluated on a case-by-case basis.