Data Processing Agreement
Last updated: October 12, 2026
This Data Processing Agreement ("DPA") forms part of the SaaS Terms of Service between OmniWebb Studio ("Processor", "OmniWebb", "we") and the Customer ("Controller", "you") and governs the processing of personal data by OmniWebb on behalf of the Customer.
This DPA applies where OmniWebb processes personal data on the Customer's behalf in connection with the provision of the Platform. It is designed to meet the requirements of PIPEDA, GDPR (where applicable), Quebec Law 25 (where applicable), and other relevant data protection legislation.
1. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person processed by OmniWebb on behalf of the Customer
- "Processing" means any operation performed on Personal Data, including collection, storage, use, transfer, and deletion
- "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data
- "Subprocessor" means a third party engaged by OmniWebb to process Personal Data on behalf of the Customer
2. Scope and Purpose of Processing
| Element | Detail |
|---|---|
| Subject matter | Provision of the OmniWebb Platform and related services |
| Duration | For the term of the Customer's subscription plus data retention period |
| Nature and purpose | Hosting, processing, and transmitting Customer Data to operate the Platform |
| Categories of data subjects | Customer's employees, end-users, customers, and business contacts |
| Types of Personal Data | Contact information (name, email, phone), usage data, transaction data, and any data submitted by Customer to the Platform |
3. Obligations of the Processor
OmniWebb shall:
- Process Personal Data only on documented instructions from the Customer, unless required by law
- Ensure that persons authorized to process Personal Data are subject to confidentiality obligations
- Implement appropriate technical and organizational security measures (see Section 6)
- Assist the Customer in responding to data subject rights requests
- Assist the Customer in ensuring compliance with breach notification obligations
- Delete or return all Personal Data upon termination of the agreement, at the Customer's choice
- Make available to the Customer all information necessary to demonstrate compliance with this DPA
- Not process Personal Data for any purpose other than providing the Platform, unless instructed by the Customer or required by law
4. Obligations of the Controller
The Customer shall:
- Ensure that it has a lawful basis for the processing of Personal Data and any necessary consents
- Provide documented instructions for the processing of Personal Data
- Comply with all applicable data protection laws in its use of the Platform
- Notify OmniWebb promptly of any data subject requests that require OmniWebb's assistance
5. Subprocessors
OmniWebb engages the following subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, cloud functions | United States / Canada |
| Supabase | Database (PostgreSQL), authentication | United States |
| Cloudflare | DNS, CDN, DDoS protection | Global (USA HQ) |
| Anthropic | AI model inference (Claude) | United States |
| Amazon Web Services | Compute infrastructure (ECS Fargate) | Canada / United States |
5.1 Subprocessor Changes
- OmniWebb will notify the Customer at least 30 days before adding or replacing a subprocessor
- The Customer may object to a subprocessor change within 14 days of notification
- If the objection cannot be reasonably resolved, the Customer may terminate the affected services without penalty
5.2 Subprocessor Obligations
OmniWebb shall ensure that each subprocessor is bound by data protection obligations no less protective than those in this DPA. OmniWebb remains liable for the acts and omissions of its subprocessors.
6. Security Measures
OmniWebb implements the following technical and organizational measures:
- Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest
- Access control: role-based access control (RBAC) with least-privilege principle
- Authentication: multi-factor authentication for all administrative access
- Monitoring: continuous logging and monitoring of access to Personal Data
- Backups: regular encrypted backups with tested recovery procedures
- Network security: firewalls, intrusion detection, DDoS protection
- Employee training: regular security and privacy training for all staff
- Incident response: documented incident response plan with defined roles and procedures
7. Data Breach Notification
- OmniWebb shall notify the Customer of a Data Breach without undue delay and no later than 72 hours after becoming aware of it
- The notification shall include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to mitigate
- OmniWebb shall cooperate with the Customer and take reasonable steps to assist in investigating and mitigating the breach
8. International Data Transfers
Where Personal Data is transferred outside of Canada, the EU, or the UK, OmniWebb ensures appropriate safeguards are in place:
- Transfers to the United States are covered by subprocessor DPAs and Standard Contractual Clauses (SCCs) where required
- Canada benefits from an EU adequacy decision for transfers from the EU under PIPEDA
- The Customer will be informed of the countries where data is processed via the subprocessor list above
9. Audit Rights
- The Customer (or a qualified third-party auditor) may audit OmniWebb's compliance with this DPA once per year with at least 30 days' written notice
- Audits shall be conducted during normal business hours and shall not unreasonably interfere with OmniWebb's operations
- OmniWebb may provide SOC 2 reports or equivalent certifications to satisfy audit requirements where appropriate
- The Customer shall bear the cost of the audit unless the audit reveals material non-compliance
10. Data Retention and Deletion
- Upon termination of the Customer's subscription, OmniWebb will make Customer Data available for export for 30 days
- After the export period, OmniWebb will delete Customer Data from active systems within 60 days
- Copies in encrypted backups will be deleted within 90 additional days
- OmniWebb will provide written confirmation of deletion upon request
11. Liability
Each party's liability arising out of or related to this DPA is subject to the limitations set forth in the SaaS Terms of Service.
12. Term and Termination
This DPA takes effect when the Customer begins using the Platform and remains in effect until all Personal Data is deleted or returned. The data protection obligations in this DPA survive termination.
13. Governing Law
This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada. Where the Customer is subject to GDPR, the provisions of the GDPR shall take precedence in the event of any conflict with this DPA regarding EU/UK Personal Data.
14. Contact
For DPA-related enquiries:
Privacy Officer
OmniWebb Studio Inc.
Ontario, Canada
Email: omniwebb2024@gmail.com