[{"data":1,"prerenderedAt":207},["ShallowReactive",2],{"page:en:dpa":3,"$f--mg9zqjRiz6SGiAfBp3iDDBhPsGVXjZzPIUVilpnIs":205},{"lang":4,"urls":5,"meta":47,"header":56,"footer":132,"hero":167,"pageHeader":168,"pageFooter":193,"locale":4,"regionCode":200,"localization":4,"currentLanguage":4,"isEN":201,"isCAEN":202,"isFR":202,"enLanguageUrl":26,"caEnLanguageUrl":203,"frLanguageUrl":204},"en",{"hostname":6,"api":7,"app_url":8,"login":9,"signup":10,"team_map":11,"page_not_found":12,"home":13,"language_alternative_name":14,"security":15,"family_office":16,"advisor":17,"net_worth":18,"robo_advisors":19,"developers":20,"blog":21,"status":22,"terms":23,"privacy":24,"cookies":25,"dpa":26,"sub_processors":27,"about":28,"how_it_works":29,"pricing":30,"export_to_spreadsheet":31,"before_and_after":32,"budget":33,"partner":34,"advisor_insights":35,"management":36,"integrations":37,"contact_us":38,"knowledge":39,"updates":40,"apps":41,"wealthicaJs":44,"billyWealthica":45,"salesWealthica":46},"","https:\u002F\u002Fapp.wealthica.com\u002Fapi","https:\u002F\u002Fapp.wealthica.com","https:\u002F\u002Fapp.wealthica.com\u002Flogin?lang=en","https:\u002F\u002Fapp.wealthica.com\u002Fsign-up","https:\u002F\u002Fvezgo.com\u002Fmap\u002F","\u002F404","\u002F","FR","\u002Fsecurity\u002F","\u002Ffamily-office\u002F","\u002Fadvisor\u002F","\u002Fnet-worth\u002F","\u002Frobo-advisors\u002F","\u002Fdevelopers\u002F","https:\u002F\u002Fwealthica.com\u002Fblog\u002F","https:\u002F\u002Fstatus.wealthica.com\u002F","\u002Fterms\u002F","\u002Fprivacy-policy\u002F","\u002Fcookie-policy\u002F","\u002Fdata-processing-agreement\u002F","\u002Fsub-processors\u002F","\u002Fabout-us\u002F","\u002Fhow-it-works\u002F","\u002Fpricing\u002F","\u002Fexport-to-spreadsheet\u002F","\u002Fbefore-and-after\u002F","\u002Fbudget\u002F","\u002Finstitutional-partner\u002F","\u002Fadvisor-insights\u002F","\u002Fwealth-management-software\u002F","\u002Fintegrations\u002F","\u002Fcontact\u002F","https:\u002F\u002Fdesk.wealthica.com\u002Fhc\u002F3319738952","https:\u002F\u002Fwealthica.com\u002Fblog\u002Fcategory\u002Fproduct-updates\u002F",{"ios":42,"android":43},"https:\u002F\u002Fitunes.apple.com\u002Fca\u002Fapp\u002Fwealthica\u002Fid1189909042","https:\u002F\u002Fplay.google.com\u002Fstore\u002Fapps\u002Fdetails?id=com.wealthica","https:\u002F\u002Fgithub.com\u002Fwealthica\u002Fwealthica.js","https:\u002F\u002Fcalendly.com\u002Fbillywealthica\u002F30min","mailto:sales@wealthica.com",{"og_app_id":48,"og_type":49,"og_image":50,"og_site_name":51,"url":26,"title":52,"description":53,"keywords":54,"og_title":52,"og_description":55},"219180005248739","article","https:\u002F\u002Fwealthica.com\u002Fassets\u002Fimg\u002Fmeta\u002Fog_image.jpg","Wealthica","Data Processing Agreement | Wealthica","Wealthica Data Processing Agreement for enterprise clients whose end-user personal data we process as a data processor.","finance, investments, stocks, mutual funds, ETF, aggregation, consolidation, api, data feed","Data Processing Agreement.",{"language":14,"login":57,"signup":58,"how_it_works":59,"before_and_after":60,"for_institutions":61,"security":62,"more":63,"top":64,"button_get":65,"button_for_professional":66,"top_variants":67,"more_dropdown":82,"for_professional":99,"button_for_investment_api":109,"use_cases":110,"for_investment_api":111,"for_use_cases":115},"Log in","\u003Cb>Get Started\u003C\u002Fb>","How it Works","Before & After","For institutions","Security","More","Wealthica for","Get in Touch","For Professionals",[68,70,72,74,76,78,80],{"url":16,"title":69},"🇨🇦 Canadian Investors",{"url":31,"title":71},"📊 Financial spreadsheets",{"url":17,"title":73},"🧔🏻 Advisors",{"url":34,"title":75},"🏦 Institutional Partners",{"url":16,"title":77},"👨‍👩‍👧 Family Office",{"url":33,"title":79},"💰 Budgets",{"url":20,"title":81},"🧑🏽‍💻 Developer",[83,87,91,95],{"href":28,"title":84,"subtitle":85,"img":86},"About Us","Meet the Team","about-us",{"href":30,"title":88,"subtitle":89,"img":90},"Pricing","Find the best\u003Cbr> plan for you.","pricing",{"href":38,"title":92,"subtitle":93,"img":94},"Contact","Have questions?\u003Cbr>Have insights?","contact",{"href":21,"title":96,"subtitle":97,"img":98},"Blog","Find the most interesting\u003Cbr>topics in finance!","blog",[100,103,106],{"href":16,"title":101,"subtitle":102},"For Family Offices","Delight Family Members\u003Cbr>with a Family Finance Dashboard",{"href":17,"title":104,"subtitle":105},"For Financial Advisors","Become the central point\u003Cbr>of your clients",{"href":34,"title":107,"subtitle":108},"For Institutions","360 View\u003Cbr>for Institutional Partners","Investment API","Use Cases",[112],{"href":113,"title":109,"subtitle":114},"\u002Finvestment-api\u002F","Financial Data Aggregation\u003Cbr>beyond custodians",[116,120,124,128],{"href":117,"title":118,"subtitle":119},"\u002Fuse-cases\u002Fcanadian-wealth-data-api\u002F","For Account Data Access","The Single Source for all\u003Cbr>Financial Institutions",{"href":121,"title":122,"subtitle":123},"\u002Fuse-cases\u002Fasset-transfer-onboarding\u002F","For Asset Transfers","Streamline Asset Transfers.\u003Cbr>Accelerate AUM Growth.",{"href":125,"title":126,"subtitle":127},"\u002Fuse-cases\u002Floan-asset-verification\u002F","For Loan Approvals","Accelerate Loan Approvals with\u003Cbr>Instant Asset Verification",{"href":129,"title":130,"subtitle":131},"\u002Fuse-cases\u002Fopen-banking-api\u002F","For Open Banking","Bill C-15 Compliant Open Banking\u003Cbr>API for Canadian Institutions",{"first":133,"information":135,"who":142,"support":151,"legal":157,"follow":164,"copyright":166},{"title":51,"body":134},"\u003Cp>We are a team of passionate entrepreneurs and developers who want to make investment consolidation simple.\u003C\u002Fp>\u003Cp>Learn more \u003Ca href=\u002Fabout-us\u002F>about us\u003C\u002Fa> or \u003Ca href='mailto:hello@wealthica.com' class='freescout-widget-open' target='_blank'>contact us\u003C\u002Fa>. Tell us how we can help streamline your financial life!\u003C\u002Fp>",{"title":136,"about_us":137,"security":62,"how_it_works":138,"pricing":88,"developers":139,"blog":96,"signup":140,"login":141},"Information","About us","How it works","API","Sign up","Login to app",{"title":143,"investors":144,"spreadsheet":145,"advisor":146,"institutional":147,"family_office":148,"budget":149,"developers":150},"Who is it for?","Investors","Financial Spreadsheets","Advisors","Institutional Partners","Family office","Budgets","Developers",{"title":152,"contact":92,"integrations":153,"knowledge":154,"status":155,"updates":156},"Support","Supported Institutions","Knowledge Base","Service Status","Product Updates",{"title":158,"terms":159,"policy":160,"cookies":161,"dpa":162,"sub_processors":163},"Legal","Terms of service","Privacy Policy","Cookie Policy","Data Processing Agreement","Sub-processor List",{"title":165},"Follow","© 2015-2026 Wealthica Financial Technology Inc. \u003Cbr\u002F> \u003Ca href=\"mailto:hello@wealthica.com\">hello@wealthica.com\u003C\u002Fa>",{"title":162},{"language":14,"login":57,"signup":58,"how_it_works":59,"before_and_after":60,"for_institutions":61,"security":62,"more":63,"top":64,"button_get":65,"button_for_professional":66,"top_variants":169,"more_dropdown":177,"for_professional":182,"button_for_investment_api":109,"use_cases":110,"for_investment_api":186,"for_use_cases":188},[170,171,172,173,174,175,176],{"url":16,"title":69},{"url":31,"title":71},{"url":17,"title":73},{"url":34,"title":75},{"url":16,"title":77},{"url":33,"title":79},{"url":20,"title":81},[178,179,180,181],{"href":28,"title":84,"subtitle":85,"img":86},{"href":30,"title":88,"subtitle":89,"img":90},{"href":38,"title":92,"subtitle":93,"img":94},{"href":21,"title":96,"subtitle":97,"img":98},[183,184,185],{"href":16,"title":101,"subtitle":102},{"href":17,"title":104,"subtitle":105},{"href":34,"title":107,"subtitle":108},[187],{"href":113,"title":109,"subtitle":114},[189,190,191,192],{"href":117,"title":118,"subtitle":119},{"href":121,"title":122,"subtitle":123},{"href":125,"title":126,"subtitle":127},{"href":129,"title":130,"subtitle":131},{"first":194,"information":195,"who":196,"support":197,"legal":198,"follow":199,"copyright":166},{"title":51,"body":134},{"title":136,"about_us":137,"security":62,"how_it_works":138,"pricing":88,"developers":139,"blog":96,"signup":140,"login":141},{"title":143,"investors":144,"spreadsheet":145,"advisor":146,"institutional":147,"family_office":148,"budget":149,"developers":150},{"title":152,"contact":92,"integrations":153,"knowledge":154,"status":155,"updates":156},{"title":158,"terms":159,"policy":160,"cookies":161,"dpa":162,"sub_processors":163},{"title":165},"us-en",true,false,"\u002Fca-en\u002Fdata-processing-agreement\u002F","\u002Fca-fr\u002Faccord-traitement-donnees\u002F",{"html":206},"\u003Ch1>Data Processing Agreement (DPA)\u003C\u002Fh1>\n\u003Ch3>Last Updated: August 18, 2026\u003C\u002Fh3>\n\u003Cdiv class=\"dpa-toc\">\u003Cp>\u003Ca href=\"#1.0-introduction\">\u003Cstrong>1.0 Introduction\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#2.0-definitions\">\u003Cstrong>2.0 Definitions\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#3.0-how-this-dpa-applies-to-you\">\u003Cstrong>3.0 How This DPA Applies to You\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#4.0-nature-and-purpose-of-processing\">\u003Cstrong>4.0 Nature and Purpose of Processing\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#5.0-our-obligations-as-data-processor\">\u003Cstrong>5.0 Our Obligations as Data Processor\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#5.1-processing-on-your-instructions-only\">5.1 Processing on your instructions only\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#5.2-confidentiality\">5.2 Confidentiality\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#5.3-security\">5.3 Security\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#5.4-sub-processors\">5.4 Sub-processors\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#5.5-data-subject-rights\">5.5 Data Subject Rights\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#5.6-audit-rights\">5.6 Audit Rights\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#6.0-your-obligations-as-data-controller\">\u003Cstrong>6.0 Your Obligations as Data Controller\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#7.0-international-data-transfers\">\u003Cstrong>7.0 International Data Transfers\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#8.0-security-incident-notification\">\u003Cstrong>8.0 Security Incident Notification\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#9.0-term-and-data-return\">\u003Cstrong>9.0 Term and Data Return\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#10.0-confidentiality-and-data-use\">\u003Cstrong>10.0 Confidentiality and Data Use\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#11.0-liability\">\u003Cstrong>11.0 Liability\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#12.0-general\">\u003Cstrong>12.0 General\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#12.1-governing-law\">12.1 Governing Law\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#12.2-updates-to-this-dpa\">12.2 Updates to this DPA\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#12.3-entire-agreement\">12.3 Entire Agreement\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#12.4-severability\">12.4 Severability\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"#13.0-contact\">\u003Cstrong>13.0 Contact\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fdiv>\n\u003Ch2 id=\"1.0-introduction\">1.0 Introduction\u003C\u002Fh2>\n\u003Cp>This Data Processing Agreement ("DPA") is published by Wealthica Financial Technology Inc. ("we," "us," or "the Company"), a corporation incorporated under the laws of Quebec, Canada.\u003C\u002Fp>\n\u003Cp>This DPA applies to enterprise clients ("you" or "Client") who use our API and\u002For Financial Overview Platform services (the "Services") to serve their own end-users, and who, in doing so, cause personal data of those end-users or other individuals to be processed by us on their behalf. This DPA does not apply to individuals who register directly for a Wealthica Dashboard account in their own capacity; that processing is governed by our Terms and Privacy Policy. By accepting the applicable Terms of Service — whether by clicking "I agree," creating an account, or otherwise using the Services — you agree to this DPA.\u003C\u002Fp>\n\u003Cp>Where you act as a Data Controller and we act as a Data Processor on your behalf, this DPA governs that relationship. Where we process personal data for our own purposes (e.g., your account data), that processing is governed by our Privacy Policy.\u003C\u002Fp>\n\u003Cp>This DPA is incorporated by reference into our Terms of Service, available at \u003Ca href=\"https:\u002F\u002Fwealthica.com\u002Fterms\u002F\">https:\u002F\u002Fwealthica.com\u002Fterms\u002F\u003C\u002Fa>. In the event of any conflict between this DPA and the Terms of Service on data protection matters, this DPA prevails.\u003C\u002Fp>\n\u003Ch2 id=\"2.0-definitions\">2.0 Definitions\u003C\u002Fh2>\n\u003Cdiv class=\"table-wrap\">\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth align=\"left\">Term\u003C\u002Fth>\n\u003Cth align=\"left\">Meaning\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Applicable Law\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">All applicable data protection legislation governing the processing of Personal Data under this DPA, including at minimum: (a) Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); and (b) where Personal Data relates to individuals in the European Union or European Economic Area, the EU General Data Protection Regulation (GDPR) to the extent that you, as Data Controller, are subject to it.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Anonymized Data\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Data irreversibly de-identified so that no individual can reasonably be re-identified.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Data Controller\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">You — the Client who determines the purposes and means of processing Personal Data through the Services.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Data Processor\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Us — which processes Personal Data on your behalf in connection with the Services.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Data Subject\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">An individual whose Personal Data is processed under this DPA (typically your end-users).\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Providers (or Data Sources)\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Refers to any third-party entities — including financial institutions, custodians, aggregators, exchanges, public blockchain networks, or other platforms — that hold, produce, or make available data related to financial accounts, digital assets, or non-fungible tokens (NFTs). Such entities may act either as Data Sources (originating the data) or Data Providers (facilitating access or aggregation).\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Personal Data\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Any information relating to an identified or identifiable natural person, retrieved from Providers or other data sources, including financial account holdings, balances, transaction histories, investment and portfolio data, digital asset and cryptocurrency data, NFT records, and associated metadata.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Processing\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Security Incident\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Any confirmed breach of security leading to unauthorized access to, loss of, or alteration of Personal Data.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Services\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">The API and Financial Overview Platform services provided by the Company for enterprise Clients, enabling them to aggregate and access financial and digital asset data on behalf of their own end-users, as described in our Terms of Service.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Sub-processor\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Any third party we engage to assist in processing Personal Data on your behalf.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"3.0-how-this-dpa-applies-to-you\">3.0 How This DPA Applies to You\u003C\u002Fh2>\n\u003Cp>This DPA applies when you use the Services provided by the Company and, in doing so, cause Personal Data of your end-users to be processed on your behalf. We act as Data Processor; you remain the Data Controller and are responsible for the lawfulness of your processing instructions.\u003C\u002Fp>\n\u003Cp>This DPA is designed to satisfy the requirements of a data processing agreement under Canadian law (PIPEDA) and, where relevant, Article 28 of the EU General Data Protection Regulation (GDPR). If your end-users are located in the EU or EEA, this DPA governs our processing on your behalf in that capacity as well. This DPA is intended to satisfy Article 28 processor agreement requirements.\u003C\u002Fp>\n\u003Cp>If you have questions about how this DPA applies to your GDPR obligations, please contact us as specified in Section 13.0.\u003C\u002Fp>\n\u003Ch2 id=\"4.0-nature-and-purpose-of-processing\">4.0 Nature and Purpose of Processing\u003C\u002Fh2>\n\u003Cp>We process Personal Data only to deliver the Services. The table below describes our processing activities.\u003C\u002Fp>\n\u003Cdiv class=\"table-wrap\">\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth align=\"left\">\u003C\u002Fth>\n\u003Cth align=\"left\">Service Description\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Purpose\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Aggregation of financial account, investment, and digital asset data via API and\u002For the Financial Overview Platform to enable portfolio tracking, reporting, and related functionality in your product.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Data Subjects\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Your end-users accessing the Services via the API or Financial Overview Platform; your authorized personnel.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Data Processed\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Financial account data, investment holdings, transaction records, wallet addresses and digital asset data, and technical metadata (e.g. IP addresses, API Keys, session data), as retrieved from Providers on the Client's behalf.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Source\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Provider-supplied data returned via Provider APIs and\u002For retrieved by web scraping method pursuant to the Client's instruction.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Legal Basis\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Your instructions as Data Controller, pursuant to the Terms of Service and this DPA.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Frequency\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">Periodic, as configured by the Client or triggered by Client API calls.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd align=\"left\">\u003Cstrong>Retention\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd align=\"left\">For the duration of your subscription plus any legally required period. Upon termination, see Section 9.0.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>We do not process special categories of personal data (e.g. health, biometric, or religious data) through the Services. You must not instruct us to process such data without a separate written agreement.\u003C\u002Fp>\n\u003Ch2 id=\"5.0-our-obligations-as-data-processor\">5.0 Our Obligations as Data Processor\u003C\u002Fh2>\n\u003Ch3 id=\"5.1-processing-on-your-instructions-only\">5.1 Processing on your instructions only\u003C\u002Fh3>\n\u003Cp>We process Personal Data only as necessary to deliver the Services and in accordance with your instructions, including as set out in the Terms of Service and this DPA. If we are required by law to process beyond those instructions, we will inform you to the extent legally permitted.\u003C\u002Fp>\n\u003Ch3 id=\"5.2-confidentiality\">5.2 Confidentiality\u003C\u002Fh3>\n\u003Cp>Our personnel who access Personal Data are subject to binding confidentiality obligations and receive regular data protection training. Access is limited to those who need it to deliver the Services.\u003C\u002Fp>\n\u003Ch3 id=\"5.3-security\">5.3 Security\u003C\u002Fh3>\n\u003Cp>We implement and maintain appropriate technical and organizational security measures, including:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent);  \u003C\u002Fli>\n\u003Cli>Role-based access controls and the least-privilege principle; MFA for privileged access;  \u003C\u002Fli>\n\u003Cli>Annual penetration testing by qualified third-party specialists;  \u003C\u002Fli>\n\u003Cli>SOC 2 Type II audits by independent auditors; alignment with ISO\u002FIEC 27001;  \u003C\u002Fli>\n\u003Cli>Documented incident response and business continuity procedures.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"5.4-sub-processors\">5.4 Sub-processors\u003C\u002Fh3>\n\u003Cp>We may engage Sub-processors to help deliver the Services. By accepting this DPA, you grant us general authorization to do so, subject to: (a) we maintain an up-to-date Sub-processor list at \u003Ca href=\"https:\u002F\u002Fwealthica.com\u002Fsub-processors\u002F\">https:\u002F\u002Fwealthica.com\u002Fsub-processors\u003C\u002Fa>; (b) we give at least 30 days' advance notice of material changes; (c) all Sub-processors are bound by obligations no less protective than this DPA; and (d) we remain fully responsible for their compliance.\u003C\u002Fp>\n\u003Ch3 id=\"5.5-data-subject-rights\">5.5 Data Subject Rights\u003C\u002Fh3>\n\u003Cp>We will assist you in responding to Data Subject rights requests (access, correction, deletion, portability). If we receive such a request directly from one of your end-users, we will not act on it unilaterally — we will redirect the individual to you as the Data Controller and notify you promptly, unless we are required by law to respond directly.\u003C\u002Fp>\n\u003Ch3 id=\"5.6-audit-rights\">5.6 Audit Rights\u003C\u002Fh3>\n\u003Cp>We will demonstrate compliance with this DPA primarily through our current SOC 2 Type II report, which we will share upon written request. On-site or third-party audits are available only where you have reasonable documented grounds to believe the SOC 2 report is insufficient to demonstrate compliance with a specific obligation under this DPA, and are subject to our prior written approval, reasonable notice of no less than 60 days, a confidentiality agreement, and conducted at your expense. Audits may not be conducted more than once per calendar year absent a confirmed Security Incident.\u003C\u002Fp>\n\u003Ch2 id=\"6.0-your-obligations-as-data-controller\">6.0 Your Obligations as Data Controller\u003C\u002Fh2>\n\u003Cp>As Data Controller, you are responsible for:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Ensuring you have a lawful basis for all processing instructions you give us;  \u003C\u002Fli>\n\u003Cli>Providing end-users with appropriate privacy notices and obtaining all required consents or otherwise establishing a lawful basis for processing;  \u003C\u002Fli>\n\u003Cli>Keeping access credentials, API keys, and authentication mechanisms secure;  \u003C\u002Fli>\n\u003Cli>Ensuring your end-users and personnel comply with our Terms of Service;  \u003C\u002Fli>\n\u003Cli>Notifying us promptly if you become aware of a Security Incident originating from your environment.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>You represent and warrant that your instructions comply with Applicable Law. We are not responsible for your failure to meet data protection obligations that rest with you as Controller.\u003C\u002Fp>\n\u003Ch2 id=\"7.0-international-data-transfers\">7.0 International Data Transfers\u003C\u002Fh2>\n\u003Cp>We primarily process Personal Data in Canada, in compliance with PIPEDA. Some Sub-processors are located outside Canada, including in the United States. Where Personal Data is transferred internationally, we ensure appropriate safeguards are in place — such as contractual clauses or recognized adequacy mechanisms — to maintain a level of protection equivalent to Canadian standards. Details are available in our Sub-processor list; refer to Section 5.4.\u003C\u002Fp>\n\u003Cp>If your end-users are located in the European Union or European Economic Area, any transfer of their Personal Data to us is subject to GDPR Chapter V. We rely on Canada's adequacy status under EU law and, where applicable, appropriate transfer mechanisms with our Sub-processors to ensure lawful international transfers. If you have specific questions about transfer mechanisms, please contact us as specified in Section 13.0.\u003C\u002Fp>\n\u003Ch2 id=\"8.0-security-incident-notification\">8.0 Security Incident Notification\u003C\u002Fh2>\n\u003Cp>If we become aware of a Security Incident affecting Personal Data we process on your behalf, we will notify you without undue delay and, where feasible, within 72 hours. Our notification will include: the nature of the incident; the categories and estimated volume of affected Personal Data and Data Subjects; the likely consequences; and the measures taken or planned. We will cooperate with you on any notifications required to regulators or Data Subjects, and will not make public statements about an incident involving your data without your prior consent, which may be given by email, except as required by law.\u003C\u002Fp>\n\u003Ch2 id=\"9.0-term-and-data-return\">9.0 Term and Data Return\u003C\u002Fh2>\n\u003Cp>This DPA remains in effect for as long as we process Personal Data on your behalf under the Terms of Service. Upon termination or expiration of your subscription, we will — at your written request made within 30 days of termination — return your Personal Data via the API or, where that is no longer available, in a commonly used electronic format upon request, or securely delete it within a reasonable period. We may retain Personal Data in secure backup systems for up to 3 months following termination, after which it will be permanently deleted. We may also retain Personal Data beyond that period only where required by law, and will continue to protect it in accordance with this DPA. Upon your request, we will confirm deletion in writing, which may be by email. Sections 1, 2, 8, 10, 11, and 12 survive termination.\u003C\u002Fp>\n\u003Ch2 id=\"10.0-confidentiality-and-data-use\">10.0 Confidentiality and Data Use\u003C\u002Fh2>\n\u003Cp>We will not use Personal Data processed on your behalf for any purpose other than delivering the Services. We will not sell, rent, or otherwise make available for commercial gain your end-users' Personal Data, and will not combine it with other clients' data without your explicit consent. We may generate and use Anonymized Data for service improvement and performance monitoring. Both parties agree to keep confidential any non-public information exchanged in the course of using the Services.\u003C\u002Fp>\n\u003Ch2 id=\"11.0-liability\">11.0 Liability\u003C\u002Fh2>\n\u003Cp>Our liability under this DPA is subject to the limitation of liability provisions in the applicable Terms of Service. We are liable for direct losses arising from our material breach of this DPA. Neither party is liable for indirect, consequential, or punitive damages, except as required by Applicable Law. You are liable for losses arising from unlawful instructions, failure to obtain required consents, or unauthorized use of the Services by you or your end-users. Where both parties bear responsibility for a breach, liability is allocated in proportion to each party's responsibility.\u003C\u002Fp>\n\u003Ch2 id=\"12.0-general\">12.0 General\u003C\u002Fh2>\n\u003Ch3 id=\"12.1-governing-law\">12.1 Governing Law\u003C\u002Fh3>\n\u003Cp>This DPA is governed by the laws of the Province of Quebec and the federal laws of Canada. Disputes shall be resolved before the courts of Quebec.\u003C\u002Fp>\n\u003Ch3 id=\"12.2-updates-to-this-dpa\">12.2 Updates to this DPA\u003C\u002Fh3>\n\u003Cp>We may update this DPA from time to time. We will post the updated version at \u003Ca href=\"https:\u002F\u002Fwealthica.com\u002Fdata-processing-agreement\">https:\u002F\u002Fwealthica.com\u002Fdata-processing-agreement\u003C\u002Fa> and notify you via email or in-product notice at least 30 days before material changes take effect. Continued use of the Services after the effective date constitutes acceptance.\u003C\u002Fp>\n\u003Ch3 id=\"12.3-entire-agreement\">12.3 Entire Agreement\u003C\u002Fh3>\n\u003Cp>Together with the applicable Terms of Service and Privacy Policy, this DPA constitutes the full agreement between the parties on data processing and supersedes any prior understandings on this subject.\u003C\u002Fp>\n\u003Ch3 id=\"12.4-severability\">12.4 Severability\u003C\u002Fh3>\n\u003Cp>If any provision of this DPA is found unenforceable, the remaining provisions continue in full force.\u003C\u002Fp>\n\u003Ch2 id=\"13.0-contact\">13.0 Contact\u003C\u002Fh2>\n\u003Cp>For questions about this DPA or data protection matters, please contact us at \u003Ca href=\"mailto:privacy@wealthica.com\">privacy@wealthica.com\u003C\u002Fa>.\u003C\u002Fp>\n",1788867235285]