Data Processing Agreement
Effective October 22, 2026
This Data Processing Agreement (this DPA) forms part of the agreement between Dynamic Needs Analysis Inc. (DNA) and a customer that signs an Order Form referring to it (Customer). That agreement is made up of the Order Form, DNA's Terms of Service and the documents they incorporate (the Agreement). By signing such an Order Form, Customer accepts this DPA. It applies whenever DNA processes Customer Personal Information in providing the Services.
This is version 1.0, effective October 22, 2026. DNA's Privacy Policy describes how DNA handles information for every customer, including customers without an Order Form.
1. Definitions
- "Authorized User" means an individual Customer permits to use the Services under the Agreement.
- "Customer Personal Information" means Personal Information about Customer's clients and other Individuals that Customer or its Authorized Users submit to the Services, or that DNA otherwise processes on Customer's behalf under the Agreement. It does not include information about Authorized Users themselves, such as their account, billing and usage information, which DNA handles under its Privacy Policy.
- "Data Protection Laws" means the Personal Information Protection and Electronic Documents Act (Canada), the Personal Information Protection Acts of British Columbia and Alberta, Quebec's Act respecting the protection of personal information in the private sector, and any other privacy law that applies to the processing, each as amended.
- "Individual" means the person a piece of Customer Personal Information is about.
- "Order Form" means a document DNA and Customer sign that sets out the Services Customer buys.
- "Personal Information" has the meaning given in the applicable Data Protection Laws.
- "Security Incident" means a breach of DNA's security safeguards leading to the accidental or unlawful loss, destruction, alteration, or unauthorized access to or disclosure of, Customer Personal Information.
- "Services" means the DNA platform and related services provided under the Agreement.
- "Subprocessor" means a third party DNA engages that processes Customer Personal Information in providing the Services.
- "Subprocessor List" means DNA's current list of Subprocessors, described in Section 5.2.
2. Roles and Scope
2.1 Roles. Customer is the organization responsible for Customer Personal Information under Data Protection Laws. DNA is a service provider that processes Customer Personal Information on Customer's behalf. As between the parties, Customer Personal Information belongs to Customer.
2.2 Customer responsibilities. Customer is responsible for collecting Customer Personal Information lawfully, for having a lawful basis and any required consent to have DNA process it as described in this DPA, and for giving Individuals any notices Data Protection Laws require, including notice that their information may be processed outside Canada as described in Section 6.
2.3 Details of processing. The subject matter, nature, purpose and duration of the processing, and the types of Personal Information and Individuals involved, are described in Annex A.
3. DNA's Obligations
3.1 Instructions. DNA will process Customer Personal Information only on Customer's documented instructions, which are the Agreement, this DPA and Customer's use and configuration of the Services, unless the law requires otherwise. If DNA believes an instruction breaks Data Protection Laws, it will tell Customer promptly.
3.2 Purpose limitation. DNA will use Customer Personal Information only to provide the Services to Customer, including to host, secure, support, maintain and troubleshoot them. DNA will not sell Customer Personal Information or use it for any other purpose, including marketing. This Section prevails over any broader licence in the Terms of Service.
3.3 Personnel. DNA will limit access to Customer Personal Information to personnel who need it to provide the Services, and will ensure they are bound by obligations of confidentiality and trained in security.
3.4 Security. DNA will maintain the safeguards described in Annex B, which are appropriate to the sensitivity of Customer Personal Information. DNA may update them, but will not materially reduce the overall level of protection they provide during the term of the Agreement.
3.5 Government requests. If a court, regulator or law enforcement authority asks DNA for Customer Personal Information, DNA will refer the request to Customer where it can, notify Customer promptly unless the law prohibits it, and disclose only what the law requires.
4. AI Processing
4.1 No training. DNA does not use Customer Personal Information, in any form, including de-identified or aggregated, to train, fine-tune or improve an artificial intelligence model. The Subprocessors that provide DNA's AI features may use it only to return a result to DNA, and may not use it to train, fine-tune or improve their models.
4.2 Limited retention. A Subprocessor that provides AI features may keep a limited record of a request for a short period, to operate its service, for security and to detect misuse. Section 4.1 applies to that record.
5. Subprocessors
5.1 Authorization. Customer gives DNA general authorization to engage Subprocessors under this Section, and authorizes the Subprocessors on the Subprocessor List on the date Customer signs its Order Form.
5.2 Subprocessor List. The Subprocessor List names each Subprocessor, the service it provides and where it processes Customer Personal Information. It is published in DNA's Trust Center, and DNA will also send it to Customer on request.
5.3 Changes. DNA will give notice of a new or replacement Subprocessor by updating the Subprocessor List. Customer may subscribe in DNA's Trust Center to receive those updates by email. DNA aims to give notice 30 days before a new Subprocessor begins processing Customer Personal Information, and will give at least 10 days' notice unless Data Protection Laws require otherwise. Customer may object on reasonable grounds relating to the protection of Customer Personal Information by written notice within 7 days of DNA's notice; otherwise Customer is taken to accept the change. If Customer objects, the parties will work in good faith to resolve the objection.
5.4 Subprocessor terms. DNA will have a written agreement with each Subprocessor that requires it to protect Customer Personal Information to a standard at least as protective as this DPA, to the extent relevant to the service it provides. DNA remains responsible to Customer for each Subprocessor's performance of those obligations.
5.5 Services Customer chooses. Software and services that Customer or its Authorized Users choose to connect to or use with the Services, such as an email or calendar account, a meeting notetaker, or the features of their own web browser, are not Subprocessors. They process information under Customer's or the Authorized User's own agreement with that provider.
5.6 Address lookup. When an Authorized User types an address, the Services send the text to Google Maps Platform to suggest matching addresses. Google processes it as an independent controller under its own terms, which Google does not offer as a processor agreement, so Section 5.4 does not apply to it. The Subprocessor List names it, and Customer authorizes this disclosure.
6. Data Location and Transfers
6.1 Storage. DNA hosts its application, database, file storage and backups in data centres in Canada.
6.2 Processing outside Canada. Some Subprocessors process Customer Personal Information in the United States, including the AI services behind DNA's AI features. A few services used for specific features run on infrastructure in several countries. The Subprocessor List identifies each of them. Apart from those, DNA does not process Customer Personal Information outside Canada and the United States.
6.3 Foreign law. Personal Information processed in another country is subject to that country's laws and may be accessed by its courts, law enforcement and national security authorities under those laws.
6.4 Changes in location. DNA will give Customer at least 30 days' notice before processing Customer Personal Information in any other country. Customer may terminate the affected Services by notice before the change takes effect and receive a refund of prepaid fees for the remainder of the term.
7. Security Incidents
7.1 Notice. DNA will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident.
7.2 Content. The notice will describe, to the extent then known: what happened and when; the Customer Personal Information and approximate number of Individuals affected; the likely consequences; the steps DNA has taken and will take to contain and remedy it; and a contact for more information. DNA will update Customer as it learns more. A notice is not an admission of fault.
7.3 Cooperation. DNA will give Customer the information and help it reasonably needs to assess the Security Incident, determine whether it creates a real risk of significant harm, and meet its own reporting, notification and record keeping obligations. DNA will not notify Individuals or regulators on Customer's behalf without Customer's consent, unless the law requires it.
7.4 Records. DNA will keep a record of every Security Incident for at least as long as Data Protection Laws require.
7.5 Quebec. Where Quebec's Act respecting the protection of personal information in the private sector applies to Customer Personal Information, DNA will also notify Customer's person in charge of the protection of personal information, without delay, of any violation or attempted violation of the confidentiality obligations in this DPA of which DNA becomes aware, and will allow that person to verify DNA's compliance with them under Section 10, as section 18.3 of that Act requires.
8. Requests from Individuals
8.1 Self service. Authorized Users can view and correct Customer Personal Information in the Services.
8.2 Assistance. On Customer's request, DNA will help Customer respond to requests from Individuals to access, correct or delete their Personal Information, including by exporting or deleting the Customer Personal Information about a particular Individual. Backups are not edited: deleted information leaves them as they expire, under Section 11.4.
8.3 Direct requests. If DNA receives a request directly from an Individual about Customer Personal Information, DNA will forward it to Customer within 5 business days and act on it only on Customer's instructions. DNA will complete its part of any request within 30 days of Customer's instruction.
9. Assessments and Regulators
9.1 Assessments and regulators. DNA will give Customer reasonable help with privacy impact assessments, including assessments of processing outside Quebec or Canada, and with any inquiry from a privacy regulator about DNA's processing of Customer Personal Information.
10. Audits
10.1 Reports. On request, and subject to the confidentiality terms of the Agreement or a nondisclosure agreement, DNA will provide its most recent SOC 2 report and a summary of its most recent penetration test, and will answer one reasonable security questionnaire each year.
10.2 On-site audits. If those materials do not reasonably answer Customer's questions, or following a Security Incident, or if a regulator requires it, Customer may audit DNA's compliance with this DPA, subject to these limits:
- at least 30 days' written notice, or 10 business days' notice following a Security Incident;
- no more than once in any 12-month period, except following a Security Incident or where a regulator requires it;
- during business hours, without unreasonably disrupting DNA's operations, and at Customer's cost;
- under confidentiality obligations, and without access to other customers' information or DNA's trade secrets.
11. Return and Deletion
11.1 Export. On request during the term, and for 90 days after the Agreement ends, DNA will export Customer Personal Information to Customer in a commonly used electronic format.
11.2 Deletion. DNA keeps Customer Personal Information for 90 days after the Agreement ends, so Customer can export it or reopen its account, and then deletes it from its production systems. Compliance records and the history of changes to client records are kept longer, under Section 11.3.
11.3 Compliance records. Customer instructs DNA to keep its compliance records, and the history of changes to its client records, for 7 years after the Agreement ends, so that Customer can produce them if a regulator audits it. During that time DNA will give them to Customer on request and will not use them for any other purpose. Customer may instead instruct DNA, at any time, to return them or to delete them sooner.
11.4 Backups. Backups are not edited. Deleted information leaves them as they expire, within 60 days.
11.5 Legal requirements. DNA may keep information longer where the law requires it. Anything DNA keeps under this Section remains subject to this DPA.
11.6 Confirmation. On request, DNA will confirm the deletion in writing.
12. General
12.1 Liability. Each party's liability under this DPA is subject to the limitations of liability in the Agreement.
12.2 Precedence. If this DPA conflicts with any other part of the Agreement on the processing of Customer Personal Information, this DPA prevails.
12.3 Term. This DPA applies for as long as DNA processes Customer Personal Information.
12.4 Changes. DNA may update this DPA by giving Customer at least 30 days' notice. An update will not reduce the protection of Customer Personal Information during Customer's current term. DNA will provide any earlier version on request.
12.5 Governing law. This DPA is governed by the law and courts set out in the Agreement.
12.6 Notices. DNA sends notices under this DPA to the email address in Customer's Order Form, which Customer may change by notice. Notices to DNA, and privacy questions and requests, go to legal@dynamicneedsanalysis.com, for the attention of DNA's Data Protection Officer.
Annex A: Details of Processing
| Subject matter | Providing the Services: a needs analysis, compliance and client management platform for life insurance and financial advisors |
|---|---|
| Nature of processing | Hosting, storage, organization, analysis (including with AI), document generation, retrieval, transmission at Customer's direction, export and deletion |
| Purpose | Providing the Services to Customer under the Agreement, and nothing else |
| Frequency | Continuous, while Customer uses the Services |
| Duration | The term of the Agreement, plus the periods in Section 11 |
| Individuals | Customer's clients and prospective clients; their spouses, dependants (including minors), beneficiaries and trustees; clients Customer invites to the client portal; and other people named in documents, emails and meeting records Customer brings into the Services |
Types of Personal Information
| Identity and contact | Name, date of birth, sex, address, email, phone |
|---|---|
| Household | Spouse, dependants (including minors), beneficiaries, trustees |
| Financial | Income, assets, debts, estate and business interests |
| Insurance | Existing policies, policy numbers, beneficiaries, quote details |
| Health | Smoking status, health class, and any health details Authorized Users record |
| Government identifiers | Social Insurance Numbers and similar numbers, when Authorized Users record them |
| Documents and notes | Uploaded statements, policies and identification; advisor notes; AI conversations |
| Email and meetings | If an Authorized User connects an email account or a meeting notetaker: messages and meeting records involving Customer's clients, including other people who take part in them |
| Compliance records | Generated compliance documents and electronic signature records |
| Client portal users | Name, email address, sign-in activity, and the documents they upload |
Health information, government identifiers and information about minors are sensitive. Customer should submit them only where needed for the advice being given.
Annex B: Security Measures
DNA maintains the following administrative, technical and physical safeguards for Customer Personal Information, subject to Section 3.4.
| Security program and audits | A written information security program, examined by an independent auditor in a SOC 2 Type II examination against the AICPA Trust Services Criteria for Security. The report is available to Customer under Section 10.1. |
|---|---|
| Encryption | TLS 1.2 or higher on every connection, and AES-256 encryption at rest. Credentials for services Customer connects carry an additional layer of encryption. |
| Access control | Access to production systems and Customer Personal Information is limited to personnel who need it and granted by role. Administrative access requires multi-factor authentication. Access is logged and reviewed regularly. |
| Customer accounts | Customer manages its Authorized Users and their access. Sign-in runs through a dedicated identity provider, and DNA does not store passwords. |
| Malware protection | Uploaded files are scanned for malware and cannot be opened or downloaded until the scan finds them clean. |
| Vulnerability management | Routine vulnerability scanning and penetration testing. |
| Backups | Automated, encrypted backups, stored in Canada. |
| Incident response | A documented incident response plan. Security events and incidents are recorded and reviewed. |
| Personnel | Confidentiality agreements and security training. |