Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between JoB Orange Marketing ( “we”, the Processor), operating TrafficDefenseIQ from Québec, Canada, and the customer using the Service (“you”, the Controller). It applies when we process personal information on your behalf in the lead data you upload, and it takes effect when you accept the Terms. If you need a signed copy, email privacy@trafficdefenseiq.com.

If this DPA conflicts with the Terms on how personal information is processed, this DPA wins. Terms such as “personal information”, “processing” and “confidentiality incident” have the meaning they have under the privacy law that applies to you, including Québec's private-sector privacy law, PIPEDA and, where they apply, the GDPR.

• You decide why and how the personal information in your uploads is used. We process it only to provide the Service to you, following your documented instructions: these Terms, this DPA, and what you do in the product.
• We will tell you if we believe an instruction breaks the law, and we may stop processing until it's resolved.
• You are responsible for having the notices, consents and other legal basis needed for us to process the data you upload, and for the accuracy and lawfulness of that data.

• Subject matter and duration: scoring the lead data you upload and storing the results, for as long as your account is open or until you delete the data.
• People concerned: the people who appear in your uploads (typically consumers who submitted a lead or conversion), and your own team members.
• Types of personal information: email addresses, phone numbers, IP addresses, names, and related identifiers such as affiliate, offer and transaction IDs, payout amounts and timestamps, plus the fraud scores and flags we produce.
• Nature and purpose: storing, analyzing and scoring, displaying and exporting results, matching against your lists, and sending results to destinations you configure.

• Confidentiality. People who can access the data are bound by confidentiality, and access is limited to what the work requires.
• Security. We keep appropriate technical and organizational measures, described in section 8.
• Helping you meet your obligations. We provide self-service export and deletion in the product, and will reasonably help you respond to requests from the people in your data, and with impact assessments, within what we can technically do.
• Requests sent to us. If someone asks us for their information in your data, we'll direct them to you and let you know, unless the law forbids it.
• Legal demands. If a public authority demands your data, we'll tell you first where the law allows and share only what we're legally required to.

If we learn of a confidentiality incident (unauthorized access to, use of or disclosure of the personal information we process for you, or its loss) we will tell you without undue delay, and in any case within 72 hours of confirming it. We will share what we know about what happened and what data was involved, and keep you updated as we learn more. You are responsible for any notices you owe to the people affected or to regulators.

You authorize us to use the subprocessors below. We remain responsible for them, we bind them to data-protection terms no less protective than these, and we limit what each receives. The current list, with locations, is on the Subprocessors page. We'll give at least 30 days' notice by email to account owners before adding or replacing one, and you may object on reasonable data-protection grounds. If we can't resolve an objection, you may cancel the affected Service.

• Supabase: Database, authentication and file storage.
• Vercel: Application hosting and content delivery.
• Stripe: Payment processing and subscription billing.
• Resend: Delivery of transactional email.
• Sentry: Error monitoring, to find and fix bugs.
• Cloudflare: Bot protection (Turnstile) on the sign-in, sign-up and password-reset pages.

Your data is stored in Canada (Central), in the Montréal region. It may be processed by our subprocessors in the United States and other regions listed on the Subprocessors page. Because that can take personal information outside Québec and Canada, we rely on the contractual and technical safeguards of those providers, and we limit what each one receives. If you need us to confirm those safeguards for an assessment you are doing, ask us and we'll help.

• Encryption of data in transit (HTTPS); provider-managed encryption of stored data.
• Each account's data is separated from other customers' at the database level, and access rules are enforced on the server for every request.
• Sign-in protected by bot detection, sign-in and sign-up rate limits, and password rules; sessions can be ended everywhere from Settings.
• Owner and member roles, with account-level actions (billing, team and role changes) limited to owners.
• An activity log of important account actions, including deletions, exports and integration changes.
• Webhook deliveries are signed, and destination addresses are checked so the Service can't be pointed at internal networks.
• Rate limiting on routes that could be abused, and error monitoring.

You can export your data and delete it at any time from the product, and you can set automatic deletion of older uploads. When you delete an upload, its leads, scores, match history and original file are removed; when you delete your account, everything tied to it is removed. Data may remain in our provider's routine backups until they expire, after which it is gone. We may keep records the law requires us to keep, such as billing records.

On request, and no more than once a year unless there is a confidentiality incident, we will provide reasonable information showing that we meet this DPA, such as a description of our security measures and answers to a security questionnaire. If that isn't enough, we'll discuss a reasonable, confidential way for you to verify it without disrupting the Service or exposing other customers' data.

The limits on liability in the Terms apply to this DPA. This DPA is governed by the laws of the Province of Québec and the federal laws of Canada that apply there, and the courts of the judicial district of Montréal have jurisdiction, as set out in the Terms.

Questions about this DPA: privacy@trafficdefenseiq.com.