Upback Cloud Inc. Data Processing Agreement

Definitions

For the purposes of this DPA:

• - "Personal Data" means any information relating to an identified or identifiable natural person.
• - "Data Controller" means the entity that determines the purposes and means of processing Personal Data.
• - "Data Processor" means the entity that processes Personal Data on behalf of the Data Controller.
• - "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• - "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means.

Data Processing

• Scope and Role: The parties acknowledge that, with regard to the processing of Personal Data, Upback is a Data Processor acting on behalf of the Customer, who is the Data Controller.
• Purpose: Upback shall process Personal Data only for the purpose of providing our services in accordance with the Agreement and this DPA.
• Instructions: Upback will process Personal Data only in accordance with documented instructions from the Customer unless required to do otherwise by applicable law.

Security Measures

• Technical and Organizational Measures: Upback shall implement appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration, or disclosure.

Sub-Processors

• Authorization of Sub-Processors: Customer authorizes Upback to engage sub-processors to process Personal Data. Upback shall ensure that sub-processors comply with the same data protection obligations as set forth in this DPA.

Data Subject Rights

• Assistance: Upback shall assist the Customer, insofar as possible, in fulfilling its obligations to respond to requests by Data Subjects to exercise their rights under applicable data protection laws.

Data Breach

• Notification: Upback shall notify the Customer without undue delay upon becoming aware of a Personal Data breach.

Data Transfer

• Transfers: Upback shall not transfer Personal Data to any third country or international organization without ensuring appropriate safeguards are in place in accordance with applicable data protection laws.

Termination

• Return or Deletion: Upon termination of the Agreement, Upback shall, at the choice of the Customer, delete or return all Personal Data to the Customer, unless retention is required by applicable law.

Miscellaneous

• Governing Law: This DPA shall be governed by and construed in accordance with the laws of British Columbia.
• Entire Agreement: This DPA and the Agreement constitute the entire agreement between the parties concerning the processing of Personal Data.