Subprocessor Change Notification Policy

This Subprocessor Change Notification Policy describes how My Waypoint Technologies Inc. communicates changes to its vendor and subprocessor relationships to clients and the public.

Transparency about subprocessor changes supports client trust, privacy accountability, and informed decision-making by clients who depend on our services.

A subprocessor change occurs when My Waypoint Technologies Inc.:

• Adds a new subprocessor — engages a new third-party vendor that will process personal information on our behalf
• Removes a subprocessor — discontinues use of a vendor that previously processed personal information on our behalf
• Materially changes a subprocessor relationship — changes the scope, purpose, or nature of personal information processing by an existing vendor in a way that is material to clients

Not all vendor changes constitute subprocessor changes. Changes to vendors that do not process personal information (such as domain registrars or DNS providers) are not covered by this policy.

See our Vendor and Subprocessor Disclosure for the current list of subprocessors.

My Waypoint Technologies Inc. communicates subprocessor changes through the following mechanisms:

• Trust Centre update — the Vendor and Subprocessor Disclosure page is updated to reflect the change
• Policy Change Log — a change entry is added to the Policy Change Log describing the nature of the change
• Direct client notification — for clients with active service agreements that involve the affected subprocessor, we will make reasonable efforts to provide direct notification through available contact channels

The method and timing of notification will depend on the nature of the change and the services affected.

When a subprocessor change occurs, the Vendor and Subprocessor Disclosure page will be updated to reflect the current list of subprocessors.

The updated disclosure will include:

• The name and category of the new, removed, or changed subprocessor
• The purpose and scope of processing
• The information processed and data location
• The safeguards in place

The Policy Change Log will record the date and nature of the change.

Subprocessor changes take effect when the new vendor relationship begins or the existing relationship ends. My Waypoint Technologies Inc. will make reasonable efforts to update the Vendor and Subprocessor Disclosure promptly following a subprocessor change.

Where a subprocessor change involves the addition of a new vendor that will process personal information, we will make reasonable efforts to notify affected clients before the change takes effect where practical.

In some circumstances, operational requirements may necessitate that a subprocessor change takes effect before notification is complete. In such cases, notification will be provided as promptly as reasonably practicable.

My Waypoint Technologies Inc. assesses whether a subprocessor change is material based on factors including:

• Whether the change affects the types of personal information processed
• Whether the change affects the jurisdictions in which personal information is processed
• Whether the change affects the safeguards protecting personal information
• Whether the change affects the purposes for which personal information is processed
• The potential impact of the change on client privacy obligations

Material changes will be communicated through the notification mechanisms described above. Non-material changes (such as minor updates to vendor configurations that do not affect the nature of processing) may be reflected in the Vendor and Subprocessor Disclosure without separate notification.

Clients with questions or concerns about a subprocessor change are encouraged to contact us:

Email: privacy@mywaypoint.ca

We will respond to subprocessor-related inquiries within a reasonable time and provide available information about the change and its implications for the client's services.

See our Contact page for all contact channels.