Data Processing Addendum (DPA)

This DPA applies when Belle Biz processes Customer Personal Information on behalf of a Business Partner in connection with Business Services.

1. Roles

• The Business Partner is the “Controller” of Customer Personal Information it submits or collects through Business Services for its own purposes, and is solely responsible for the lawfulness of its collection, its customer-facing notices, and its consent practices.
• Belle Biz is the “Processor/Service Provider” processing such information to provide and support Business Services.

2. Processing Instructions and Purpose

Belle Biz will process Customer Personal Information to:

• Provide CRM, scheduling, booking management, check-in tools, messaging delivery, and reporting
• Maintain security, prevent fraud, and ensure platform stability
• Provide support and troubleshooting
• Maintain billing/account administration for Business Services
• Create and use Aggregated Data as permitted by Section 15 of the Terms of Service

The Business Partner's instructions are limited to those set out in this DPA, the Terms of Service, and the configuration options available within the Business Services. Belle Biz is not obliged to act on instructions that are outside the scope of the Business Services, that would require material development work, or that Belle Biz reasonably believes would breach applicable law; where practicable Belle Biz may offer such work as chargeable Professional Services.

3. Confidentiality

Belle Biz will ensure personnel with access to Customer Personal Information are subject to confidentiality obligations.

4. Security Measures

Belle Biz maintains reasonable safeguards appropriate to the sensitivity of the information, including access controls and monitoring. No system is perfectly secure. Belle Biz may update its security measures from time to time provided it does not materially reduce the overall level of protection. The Business Partner is responsible for the security of its own accounts, devices, credentials, and staff practices, and for configuring available security features appropriately.

5. Subprocessors

The Business Partner grants Belle Biz general authorization to engage subprocessors (e.g., hosting, communications, analytics, artificial intelligence, security, and support tooling) to provide Business Services. Belle Biz will use reasonable contractual safeguards with subprocessors and remains responsible for their performance to the extent required by applicable law. See our Subprocessors List for details; posting an updated list to that page constitutes notice of any change.

6. Data Subject Requests

Belle Biz will provide reasonable assistance to help the Business Partner respond to access/correction/deletion requests where the Business Partner cannot address them using self-serve tools. Assistance beyond the self-serve tools is provided at the Business Partner's expense at Belle Biz's then-current professional services rates. Belle Biz will redirect any request it receives directly from an individual to the Business Partner.

7. Breach Notification

Belle Biz will notify the Business Partner of a confirmed breach involving Customer Personal Information without undue delay after becoming aware and will share reasonable details available for response. Such notification is provided for the Business Partner's information and is not an acknowledgment of fault, liability, or of any breach of this DPA or of applicable law. The Business Partner is responsible for determining whether it must notify individuals or regulators, and for making any such notification.

8. Cross-Border Processing

Customer Personal Information may be processed in Canada and other jurisdictions where Belle Biz or subprocessors operate (including the United States). Reasonable safeguards will be used where required. The Business Partner is responsible for making any disclosure of cross-border processing required by its own privacy notices or by applicable law.

9. Return/Deletion

The Business Partner may request an export of Customer Personal Information within thirty (30) days after termination or expiry of Business Services, subject to security verification and payment of outstanding amounts. After that period, Belle Biz will delete or de-identify Customer Personal Information processed on behalf of the Business Partner within a reasonable time, except where retention is required by law or retained in backups subject to controls, and Belle Biz has no further obligation to retain or produce that information.

10. Verification and Audit

Upon reasonable written request, and no more than once in any twelve (12) month period, Belle Biz will provide a written summary of its then-current security practices sufficient to allow the Business Partner to verify compliance with this DPA. On-site inspections, penetration testing, vulnerability scanning, and access to Belle Biz systems, facilities, personnel, or records are not permitted. Each party bears its own costs, and Belle Biz may charge a reasonable fee for any request that exceeds this scope.

11. Liability

All liability arising under or in connection with this DPA is subject to the exclusions and limitations of liability set out in Section 18 of the Terms of Service, which apply in the aggregate across the Terms of Service and this DPA and are not duplicated.

12. Order of Precedence

If this DPA conflicts with the Terms of Service regarding processing of Customer Personal Information, this DPA controls. For clarity, Sections 17 (Disclaimers), 18 (Limitation of Liability), 19 (Indemnification), and 22 (Governing Law and Venue) of the Terms of Service continue to apply to this DPA and are not displaced by it.

Contact