This Data Processing Agreement (the "Agreement") is entered into between you, or the business you represent ("you", "Customer"), and LeapVision Technologies Inc. ("LeapVision", "we", "us"), a corporation incorporated in Quebec, Canada (NEQ 1181486631, BN 757702436), with its head office at 206 Rivermere, Saint-Lambert, Quebec, Canada J4R 2G1. HelionAI is the service and brand operated by LeapVision (the "Service").
1. Purpose, scope, and acceptance
This Agreement governs LeapVision's processing of the personal information you enter into the Service about your own customers, employees, or other individuals ("Customer Content"). It constitutes the written mandate required by section 18.3 of Quebec's Act respecting the protection of personal information in the private sector (CQLR, chapter P-39.1, "Law 25") when you communicate such information to us without the consent of the individuals concerned.
This Agreement is incorporated by reference into, and forms part of, the Terms of Service. By accepting the Terms of Service, you enter into this Agreement. Section 18.3 requires that the mandate be conferred in writing; it does not require a separate signed instrument. If your internal process nonetheless requires a signed copy, write to legal@helionai.ca and we will sign the text published here, without modifying it.
This Agreement does not cover the personal information LeapVision collects for its own purposes, such as your account, billing, or website information. That information is governed by our Privacy Policy.
2. Roles of the parties
In relation to Customer Content, you are the responsible enterprise under Law 25: you determine the purposes of the processing, and the obligations the law imposes in respect of that information are yours.
We act solely as your mandatary, that is, the person to whom you entrust a mandate within the meaning of section 18.3. We process Customer Content on your behalf, on your documented instructions, and never for our own purposes.
Your documented instructions consist of this Agreement, the Terms of Service, and your configuration and use of the Service.
Where the General Data Protection Regulation (GDPR) applies to you, you are the controller and we are the processor within the meaning of its Article 28. Where PIPEDA applies, you are the organization and we process on your behalf.
3. Subject matter, nature, purposes, and duration of processing
Purpose. We process Customer Content solely to provide and support the Service: a compliance platform that lets you maintain your registers, manage access requests and complaints, run privacy impact assessments, record confidentiality incidents, and track their deadlines.
Nature of processing. Hosting, storage, organization, retrieval, display, transmission within the Service, export, and deletion, as you configure; and sending the Service's messages to the people you designate.
Categories of data subjects. Your authorized users and personnel; and the individuals whose information you choose to record in the Service, such as your customers, your employees, or people who send you a request or a complaint.
Categories of personal information. The names, contact details, and credentials of your users; and the information you choose to enter into your registers, incidents, assessments, access requests, complaints, and uploaded supporting documents. That choice is yours. You must not upload sensitive personal information beyond what is necessary for your own purposes, and you remain responsible for the lawfulness of what you enter.
Duration. Processing continues for the term of your subscription and for the transition period set out in Section 12, at the end of which the mandate ends.
4. Our undertakings as mandatary
Section 18.3 of Law 25 requires the mandate to state the measures the mandatary must take to ensure the confidentiality of the personal information communicated, to ensure that the information is used only in the performance of the mandate, and to ensure that it is not kept after the mandate expires. We therefore undertake as follows.
4.1 Protection of confidentiality
We protect Customer Content using the technical and organizational measures described in Section 6. The people authorized to process Customer Content are bound by confidentiality obligations and have access only as needed to provide and support the Service, on a least-privilege basis.
4.2 Use limited to the performance of the mandate
We use Customer Content only to provide and support the Service. We use it for no other purpose. In particular: we do not sell Customer Content, we do not disclose it to anyone for our own commercial purposes, we do not use it to train, fine-tune, or improve any artificial-intelligence model, and we do not use the contact details of the people you record in the Service for our own prospecting or marketing.
4.3 No retention after the mandate ends
We do not keep Customer Content after the mandate expires. The periods and the deletion mechanics are set out in Section 12.
4.4 What the law imposes on us directly
The three undertakings above are the ones section 18.3 requires the mandate to state. The obligation to notify you without delay of any violation or attempted violation of the confidentiality obligations (Section 9) and the obligation to allow any verification relating to that confidentiality (Section 10) bind us directly under the same provision, whether or not this Agreement states them.
5. Your obligations and your instructions
You are responsible for the lawfulness of the information you enter into the Service, for the legal basis that allows you to collect it and to communicate it to us, for the information you must give individuals at your own points of collection, and for the accuracy of your instructions.
You will not instruct us to process personal information in a manner that breaches the law applicable to you, and you will configure access, retention, and deletion consistently with your own obligations.
5.1 Service messages sent to the people you designate
When you use the features of the Service that send email, you instruct us to send administrative messages (for example training invitations and reminders, completion records, notices of requests received through your public form, and deadline alerts) to the people you designate, in the language you assign them, on the schedule you configure. You confirm that you have the authority to provide us with those contact details for that purpose.
Training reminders are enabled by default and you may disable them at any time in the Service's settings. These messages are administrative and sent on your behalf: they do not promote HelionAI or any product, and we do not use those contact details for our own marketing.
6. Security measures
We implement and maintain reasonable security measures, proportionate to the sensitivity of the information and to the risk, including:
- Tenant isolation through database row-level security (RLS), with the application connecting under a non-owner database role so that isolation is actually enforced;
- encryption in transit (TLS);
- access controls, authentication, and least-privilege role separation;
- secrets management through a managed secret store rather than credentials embedded in code;
- logging, monitoring, and backups;
- a documented confidentiality-incident response process;
- hosting in Canada (see Section 8).
We will not materially decrease the overall security of the Service during the term of your subscription.
7. Sub-processors
7.1 Sub-processors that process Customer Content
You give us general authorization to engage the following sub-processors, each of which is itself our mandatary within the meaning of section 18.3:
- Amazon Web Services (AWS): hosting, database, storage, backups, and secrets management. Processes all Customer Content. Processing location:
ca-central-1region (Montreal, Quebec, Canada). - Resend, Inc.: delivery of the Service's transactional email. Processes the recipient's name and email address and the content of the message. Processing location: United States (see Section 8).
No artificial-intelligence inference sub-processor processes Customer Content today: AI-assisted drafting features are not enabled in our production environment and no content is sent to them. If we enable them, we will first update this Section, complete and document any assessment required by section 17 for processing that would occur outside Quebec, and give you prior notice in accordance with Section 7.3.
7.2 Providers that do not process Customer Content
The following providers are not our sub-processors in relation to your mandate, because they do not process Customer Content. We name them for transparency:
- Paddle (Paddle.com, Inc.): billing and payment processing, as merchant of record. Processes your account's billing contact details and transaction data, in respect of which LeapVision is the responsible enterprise and not your mandatary. Processing location: United States.
- Google Analytics 4 (Google LLC): usage measurement for our public website, activated only after the visitor's consent. Processes no platform data. Processing location: United States.
7.3 Obligations imposed on our sub-processors, and changes
We impose on each sub-processor, by written contract, data-protection obligations at least as protective as those in this Agreement, including purpose limitation, confidentiality, security, notice of any violation, and a prohibition on using Customer Content to train an artificial-intelligence model. We remain responsible to you for the acts and omissions of our sub-processors in the performance of the mandate, subject to Section 14.
We will give you at least 30 days prior notice before adding or replacing a sub-processor, by updating this page and by email to your account address. You may object on reasonable data-protection grounds; if we cannot address your objection, you may terminate the affected part of the Service by written notice. Section 5 of the Terms of Service governs fees.
8. Hosting and communication outside Quebec
8.1 Hosting. We host and process Customer Content in Canada, in the AWS ca-central-1 region (Montreal, Quebec). That hosting is therefore not a communication outside Quebec.
8.2 The one flow that leaves Quebec. The Service's transactional email is delivered by Resend, Inc., in the United States. Those messages carry the recipient's name and email address and the content of the message. We minimize the personal information in the body of those messages: access requests and incidents are identified by number, not by their content.
8.3 The assessment required by section 17. Before any communication of personal information outside Quebec, we conduct and document the privacy impact assessment required by section 17 of Law 25, which takes into account the sensitivity of the information, the purposes for which it is to be used, the protection measures it would receive, including contractual measures, and the legal framework applicable in the destination jurisdiction. The communication is the subject of a written agreement with the provider. We will provide you with a summary of that assessment on written request, to support your own analysis.
8.4 Your configuration. Your configuration of the Service determines who receives these emails and what they contain. We disclose this flow precisely so that you can account for it in your own assessment.
9. Confidentiality incidents and notice
9.1 Our legal obligation. Section 18.3 of Law 25 requires us to notify your privacy officer without delay of any violation or attempted violation, by any person, of any of the obligations relating to the confidentiality of the information you entrust to us.
9.2 Timing and recipient. We will notify you without delay and, at the latest, within 72 hours of becoming aware. The notice is sent to the privacy officer address you have recorded in the Service and, failing that, to the account owner's address. We recommend you keep that address current.
9.3 Content of the notice. The notice will include, to the extent known: the nature of the event, the categories and approximate volume of information and the number of individuals affected, the likely consequences, and the measures taken or proposed to reduce the risk, so as to allow you to meet your own obligations.
9.4 Your obligations remain yours. You are the enterprise holding the information: assessing the risk of serious injury, notifying the Commission d'accès à l'information and the individuals concerned where the law requires it, and maintaining your incident register are your responsibility. We provide reasonable cooperation and the information in our possession, including through the features of the Service.
9.5 Mitigation. We take reasonable measures to reduce the consequences of the event and the risk of recurrence.
10. Verification
Section 18.3 gives you the right, through your privacy officer, to carry out any verification relating to the confidentiality of the information you entrust to us. We undertake to allow it.
In practice, on written request, we will provide within 30 days: a description of our security measures, our answers to a reasonable security questionnaire, our current sub-processor list, the summary of our assessment under Section 8.3, and any third-party audit report or certification we hold.
Any verification involving access to our systems or technical testing is agreed in advance in writing and organized so as to protect other customers' information, the Service being multi-tenant.
These arrangements organize the exercise of the right under section 18.3; they do not limit it.
11. Assistance
Taking into account the nature of the processing and the information available to us, we assist you:
- when an individual exercises with you their rights of access, rectification, withdrawal of consent, cessation of dissemination or de-indexing, and the portability right under section 27 of Law 25, through the export and deletion features of the Service;
- when you carry out a privacy impact assessment required by section 3.3 of Law 25;
- when you must meet your own obligations following a confidentiality incident (Section 9).
If an individual sends a request about Customer Content directly to us, we do not answer it on your behalf: we forward it to you without delay.
12. Retention, deletion, and end of the mandate
12.1 During the mandate, we keep Customer Content only as long as necessary to provide the Service or as you configure.
12.2 The mandate ends at the expiry of the transition period described below. That period forms part of the performance of the mandate: it lets you export your data and, where applicable, reactivate your account.
12.3 Our default periods are as follows:
- Customer Content: deleted within a grace period of 30 days after your account is closed or expires.
- Account and organization data (in respect of which LeapVision is the responsible enterprise, not your mandatary): 90 days after the account is closed, then destroyed or anonymized.
- Backups: an overwrite cycle of at most 35 days. Backups remain subject to the same confidentiality and security obligations and are used only for a full system restore.
12.4 On written request made before the end of the grace period, we will delete Customer Content earlier, or provide you with an exportable copy. We will confirm deletion in writing on request.
12.5 We keep no Customer Content after the mandate ends, except to the extent the law requires us to keep it. In that case it remains subject to the confidentiality and security obligations of this Agreement until it is destroyed.
13. Requests from public authorities
If a public authority sends us a legally binding request for Customer Content, we will notify you before disclosing anything, unless the law prohibits us from doing so, and we will disclose only the minimum required. We give no voluntary access to Customer Content to any public authority.
14. Liability
The parties' liability under this Agreement is subject to the exclusions and the limitation of liability set out in Section 10 of the Terms of Service. Nothing in this Agreement limits any liability that cannot be limited under applicable law.
15. Term, changes, and order of precedence
This Agreement applies for as long as we process Customer Content on your behalf.
We may change it to reflect a change in the law or in the Service. Any significant change is posted on this page with a new version number and a new effective date, and notified to you at least 30 days in advance at your account address.
In the event of a conflict regarding the processing of personal information, the order of precedence is: this Agreement, then the Terms of Service.
16. Governing law and language (Bill 96)
This Agreement is governed by the laws of the Province of Quebec and the federal laws of Canada applicable there, and Section 13 of the Terms of Service governs the competent courts.
In accordance with the Charter of the French Language, the French version of this Agreement is the official and prevailing version. The English version is provided for convenience.
17. Contact us
LeapVision Technologies Inc. (brand: HelionAI)
206 Rivermere, Saint-Lambert, Quebec, Canada J4R 2G1
Legal questions: legal@helionai.ca
Privacy officer: privacy@helionai.ca
General questions: hello@helionai.ca