Data Processing Agreement

1. Roles

Where we handle personal data of your customers or contacts to deliver services to you (for example, running your CRM, follow-up, or booking), you are the data controller and Digital Dreaming is the data processor. We process that data only on your documented instructions and for the purpose of providing the services.

2. Scope & nature of processing

• Subject matter: provision of website, CRM, marketing, booking, and automation services.
• Duration: for the term of the services agreement.
• Categories of data subjects: your leads, customers, and contacts.
• Categories of data: contact details (name, email, phone), business details, booking and message history, and other data you choose to store.

3. Our obligations

• Process personal data only on your instructions and as needed to provide the services.
• Ensure people authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (Section 5).
• Assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your security, breach-notification, and impact-assessment obligations.
• On termination, delete or return personal data at your choice, except where law requires retention.
• Make available information reasonably necessary to demonstrate compliance and allow for audits on reasonable notice.

4. Sub-processors

You authorize us to engage the sub-processors below to deliver the services. We remain responsible for their performance and will give you reasonable notice of changes so you can object.

5. Security measures

We maintain measures appropriate to the risk, including encryption of data in transit, access controls and least-privilege access, use of reputable infrastructure providers, and regular review of our practices.

6. Data-subject requests

If a data subject contacts us directly about your data, we will forward the request to you and, where appropriate, assist you in responding within the timeframes the law requires.

7. Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you reasonably need to meet your own notification obligations.

8. International transfers

Where personal data is transferred across borders, we rely on lawful transfer mechanisms (such as standard contractual clauses) with our sub-processors.

9. Deletion & return

On expiry or termination of the services, we will, at your choice, delete or return the personal data we process on your behalf, subject to any legal retention requirements.

10. Governing law

This DPA is governed by the laws of the Province of Ontario, Canada, and forms part of the services agreement between the parties.

11. Requesting a signed copy

Need a countersigned DPA for your records or procurement? Email contact@digital-dreaming.app and we’ll send one over.