Data Processing Addendum

Effective date: August 21, 2026 · Last updated: August 21, 2026 · Version 2026.1

Contents

1. Agreement and order of precedence
2. Definitions
3. Roles
4. Customer instructions
5. Details of processing
6. Personnel and confidentiality
7. Security measures
8. Subprocessors
9. International transfers
10. Assistance (access, deletion, DPIA)
11. Personal-information incident notice
12. Return and deletion
13. Records and audits
14. Liability
15. Term and changes
16. Governing law
17. Contact

1. Agreement and order of precedence

This DPA applies automatically when the Customer accepts the Terms of Service, starts a trial, pays for a subscription, or otherwise uses the Service to store Customer Data. No extra signature is required for this public DPA to apply.

If a signed Enterprise order form, master services agreement, or Customer-specific data processing addendum conflicts with this DPA, the signed document controls for that conflict. Otherwise this DPA, the Terms, the Privacy Policy, and the Customer’s configuration in the product are the Customer’s documented processing instructions.

2. Definitions

Capitalized terms not defined here have the meaning in the Terms. In this DPA:

• Applicable Privacy Law means PIPEDA, applicable Canadian provincial private-sector privacy statutes (including Quebec Law 25, Alberta PIPA, and British Columbia PIPA where they apply), and, to the extent they apply to the processing, the GDPR, UK GDPR, Swiss FADP, and US state privacy laws such as the CCPA.
• Customer Data means personal information the Customer or its users upload to, or generate in, the Service about the Customer’s clients, applicants, family members, representatives, leads, and related casework — including identity documents, medical records, financial statements, police certificates, and other immigration-file contents.
• Personal Information Incident means a breach of security safeguards involving Customer Data under ImmigrateOS’s control, as those concepts are used in PIPEDA and other Applicable Privacy Law (including a personal-data breach under the GDPR where it applies).
• Subprocessor means a third party engaged by ImmigrateOS to process Customer Data in order to provide the Service.

This DPA does not apply to information ImmigrateOS collects as an independent controller — for example demo and sales inquiries, ImmigrateOS subscription billing, or website usage data — which is described in the Privacy Policy.

3. Roles

For Customer Data:

• The Customer is the controller (or equivalent, including “business” under the CCPA where that statute applies to the Customer).
• ImmigrateOS is the processor (or “service provider” / “contractor” under the CCPA) acting only on the Customer’s documented instructions.

The Customer is responsible for the lawfulness of its instructions, for notices and consents required to collect Customer Data, and for responding to requests from individuals about their files, except where Applicable Privacy Law requires ImmigrateOS to act directly.

If ImmigrateOS reasonably believes an instruction violates Applicable Privacy Law, it will notify the Customer and may decline that instruction until clarified.

4. Customer instructions

The Customer instructs ImmigrateOS to process Customer Data only:

• to provide, secure, support, and improve the Service;
• as configured by the Customer in the product (including roles, retention, AI settings, portal access, and connected integrations);
• as described in this DPA, the Terms, and the Privacy Policy; and
• as required by law, in which case ImmigrateOS will, unless prohibited, notify the Customer before disclosing Customer Data so the Customer may seek a protective order.

Connecting an optional integration (for example Google Calendar, Stripe Connect, Twilio, or DocuSign) is the Customer’s instruction to transfer the Customer Data that integration requires to that vendor. ImmigrateOS does not use Customer Data to train ImmigrateOS’s own models. AI processing by third-party providers occurs only when a user of the Customer runs an AI feature.

5. Details of processing

• Subject matter: hosting and operating practice-management software for immigration consulting firms.
• Duration: for the term of the Customer’s subscription or trial, plus the retention, backup, and legal-hold periods described in the Privacy Policy and the Customer’s Settings.
• Nature and purpose: storage, retrieval, display, transmission, backup, security logging, and the features the Customer enables (documents, messages, invoices, portal, AI drafts, and integrations).
• Types of personal information: identity and contact details; immigration, employment, education, and family information; identity, medical, financial, and legal documents; communications; billing metadata for the Customer’s own clients (not card numbers); and audit metadata.
• Categories of individuals: the Customer’s clients and applicants, their family members and representatives, leads, and other people the Customer stores in a file; and the Customer’s staff to the extent their actions are logged against a file.

Core client and case data is stored in Google Cloud Canada regions (Montreal by default; Toronto available), as described on Security and in the Privacy Policy.

6. Personnel and confidentiality

ImmigrateOS will ensure that people authorized to process Customer Data are bound by confidentiality obligations and are limited to those who need access to provide, secure, or support the Service. Production access is restricted to authorized personnel on a need-to-know basis.

7. Security measures

ImmigrateOS will implement administrative, technical, and physical safeguards appropriate to the sensitivity of immigration case data, including:

• encryption in transit (TLS) and at rest (AES-256 on Google Cloud);
• role-based access control inside each organization;
• multi-factor authentication for firm staff (enforceable by the Customer);
• separate identity for the client portal;
• append-only audit logs on sensitive writes;
• document versioning so files are not silently overwritten;
• encrypted storage of integration tokens; and
• PCI-compliant checkout through Stripe or Square — ImmigrateOS does not store card numbers.

A current description of infrastructure and PIPEDA/CICC posture is on the Security page. ImmigrateOS does not claim SOC 2 or ISO certification on this site unless a current report is published there.

8. Subprocessors

The Customer authorizes ImmigrateOS to engage Subprocessors to provide the Service. The current list, purposes, and typical locations are in the Privacy Policy — Subprocessors. Core systems of record run on Google Cloud in Canada. Some Subprocessors handle limited data outside Canada when a feature requires it (for example authentication, payments, transactional email, or optional AI).

ImmigrateOS will impose data-protection terms on Subprocessors that are no less protective of Customer Data than this DPA in all material respects, and remains responsible to the Customer for the Subprocessor’s processing of Customer Data as if ImmigrateOS had performed it.

ImmigrateOS will update the public subprocessor table when a material new Subprocessor is added. The Customer may object on reasonable privacy grounds by emailing hello@immigrateos.com within 30 days of that update. If the parties cannot resolve the objection, the Customer may cancel the affected Service before the next renewal. Connecting or disconnecting an optional integration in Settings is the Customer’s own instruction and is not a new ImmigrateOS Subprocessor appointment.

9. International transfers

Customer Data is stored in Canada as described in Section 5. Limited processing outside Canada occurs only as needed for a feature or Subprocessor listed in the Privacy Policy. Where a transfer mechanism is required (for example EEA, UK, or Swiss data), ImmigrateOS relies on the vendor’s contractual safeguards (such as Standard Contractual Clauses) plus encryption and access control. The Customer’s configuration, including enabling an integration, is the instruction to make that transfer.

10. Assistance (access, deletion, DPIA)

Taking into account the nature of the processing, ImmigrateOS will provide reasonable assistance so the Customer can meet its obligations under Applicable Privacy Law, including:

• access, correction, deletion, and portability requests about Customer Data — using the product’s export, privacy, and portal tools where they exist, and support at hello@immigrateos.com where they do not;
• information reasonably needed for a privacy impact assessment or similar assessment; and
• consultation with a privacy regulator where the Customer is required to consult and the request relates to ImmigrateOS’s processing.

ImmigrateOS will not respond to an individual about a firm’s client file as if ImmigrateOS were the controller, except to direct the individual to the Customer, unless Applicable Privacy Law requires otherwise. Product procedures are in the Privacy Policy.

11. Personal-information incident notice

If ImmigrateOS becomes aware of a Personal Information Incident involving Customer Data, it will notify the Customer as soon as feasible and in any event without undue delay, including the information reasonably available at the time: nature of the incident, categories and approximate volume of data and individuals affected (if known), likely consequences, and measures taken or proposed. ImmigrateOS will update that notice as facts become clearer.

The Customer remains responsible for notifying its own clients, applicants, and regulators when Applicable Privacy Law requires the controller to do so. ImmigrateOS will provide information reasonably needed for that notice. ImmigrateOS will also notify individuals or regulators directly where the law requires the processor to do so.

12. Return and deletion

During the subscription the Customer may export Customer Data using the product. After the subscription ends, ImmigrateOS will delete or de-identify remaining Customer Data from production systems after a reasonable waiting period, subject to backup cycles, legal holds, and records ImmigrateOS must keep (for example billing and Terms-acceptance records), as described in the Terms and Privacy Policy.

Organization deletion is a support-reviewed request from an Owner or Admin — not an instant self-serve wipe — so ImmigrateOS can verify identity and avoid destroying regulated files by accident. Professional file-retention duties remain the Customer’s.

13. Records and audits

ImmigrateOS will keep records of processing reasonably required to demonstrate compliance with this DPA. Upon written request no more than once per 12 months (unless a regulator or a documented Personal Information Incident requires more), ImmigrateOS will provide a written summary of relevant safeguards, the public subprocessor list, and, where available, third-party audit or certification reports. On-site audits are available only if those materials are insufficient and the Customer has a demonstrated need under Applicable Privacy Law; they must be scheduled on reasonable notice, during business hours, scoped to ImmigrateOS’s processing of the Customer’s data, and subject to confidentiality. The Customer pays its own costs and ImmigrateOS’s reasonable costs of an on-site audit unless the audit reveals a material breach of this DPA by ImmigrateOS.

14. Liability

Liability arising out of this DPA is subject to the limitations and exclusions in the Terms, including the cap on ImmigrateOS’s liability, except to the extent Applicable Privacy Law makes a limitation unenforceable as to a particular claim.

15. Term and changes

This DPA lasts for as long as ImmigrateOS processes Customer Data for the Customer. ImmigrateOS may update this DPA by posting a new version on this page and changing the “Last updated” date. Material changes will also be notified as described in the Terms. Continued use after the effective date constitutes acceptance, except that if a change is material and adverse and the Customer does not agree, the Customer may cancel before the next renewal and continue under the prior DPA until that period ends.

Prior versions are available on request at hello@immigrateos.com.

16. Governing law

This DPA is governed by the same law and courts as the Terms: the laws of the Province of Ontario and the federal laws of Canada applicable there, without regard to conflict-of-law rules, and the courts of Toronto, Ontario, except that a mandatory choice-of-law or venue rule in Applicable Privacy Law (for example GDPR Article 82 claims) is not displaced where it cannot be waived.

17. Contact

Questions about this DPA, subprocessors, or a processing instruction:

Email: hello@immigrateos.com (subject: DPA)
Website: immigrateos.com/contact
Privacy Policy: immigrateos.com/privacy
Terms of Service: immigrateos.com/terms