Data Processing Addendum

This addendum is part of the terms of service between you and Atheron Network Inc.. It applies whenever we handle personal information for you through ATON Desk.

For that information, your business is in control of it (the controller), and we act for you (the processor, or service provider).

• the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal privacy law;
• Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25;
• the private sector privacy laws of British Columbia and Alberta, where they apply;
• the EU and UK General Data Protection Regulation (GDPR), where your business is subject to it.

ATON Desk is not designed for health records or payment card numbers. Please do not ask your customers for them in a chat.

We handle the information only on your instructions: these terms, the settings you choose in ATON Desk, and requests you send us. If the law requires us to do something else, we tell you first, unless the law forbids it.

You are responsible for having a lawful basis for the information you collect through ATON Desk, and for telling your customers how you use it, for example in your own privacy notice.

Only people who need to, and who are bound to keep it confidential, can reach your workspace's information. Our staff look at a conversation only when you ask for help with it, or to keep the service safe and running.

We protect the information with measures suited to its sensitivity, including:

• encryption whenever information travels between browsers, our servers and our providers;
• each workspace walled off from every other in the database itself, not only in our code;
• the app reaching the database through a login that can only call checked functions;
• access tokens for your connected channels encrypted before they are stored, and API keys kept only as a one-way code;
• rate limits and checks against floods of messages and automated traffic;
• regular backups, kept for a limited time.

You allow us to use the providers on the list of subprocessors. We bind each one to protect the information at least as well as this addendum does, and we stay responsible to you for their work.

Before adding or replacing one, we update the list and tell your workspace's owners at least 30 days ahead. If you object for a good reason, we will try to find a way round it; if we cannot, you can cancel and get back the unused part of what you prepaid.

Your workspace's stored information is kept with DigitalOcean in Toronto, Canada. Some providers handle it outside Canada, mainly in the United States, as the subprocessor list shows: the AI's answers are always written outside Canada.

Where the GDPR applies, transfers to Canada rely on the European Commission's finding that Canada protects personal information adequately for businesses under PIPEDA, and onward transfers rely on the safeguards each provider offers, such as standard contractual clauses or the EU-U.S. Data Privacy Framework.

If you are in Quebec, we give you what you need for the assessment Quebec law asks of you before information leaves the province.

When a person asks your business to see, correct, move or delete their information, we help you answer. A request to delete a chat made from the chat itself waits for you on your console's Privacy page, and we help with anything the console cannot do. If a request reaches us directly, we pass it to you and do not answer it ourselves, unless you ask us to.

We also give you the information you reasonably need for privacy assessments, and to answer a regulator.

If we learn that information we handle for you has been lost, or reached by someone who should not have it, we tell your workspace's owners without undue delay, and within 72 hours of confirming it. We say what happened, what information is involved, what we have done, and who to talk to, and we keep you updated.

We keep a record of every such incident, and help you with the notices the law may require you to give.

When you close your workspace, we delete its information within 30 days of your asking, after sending you a copy if you want one. Copies in backups are replaced as the backups age out. We keep only what the law requires, such as billing records.

We answer your reasonable written questions about how we meet this addendum, once a year or after an incident. If the law requires an audit, we agree its scope, timing and cost with you first, and it must protect other customers' information and our security.

• sell your workspace's information, or share it for advertising;
• use it to train AI models, ours or anyone's;
• use it for any purpose of our own beyond running, securing and billing ATON Desk.

We may use counts and measurements of how ATON Desk is used, which identify no person and no customer of yours, to run and improve the service.

If this addendum and the terms disagree about personal information, this addendum wins. The limits of liability in the terms apply to it, as far as the law allows. Earlier versions stay readable on this page.

Questions: privacy@aton-network.org.