Data Processing Agreement

1. Roles of the Parties

For personal information that you and your users upload to or generate in the Service (“Customer Personal Data”), the Customer is the controller (or equivalent, such as “business” or “enterprise” under applicable law) and Jobyo is the processor (or “service provider”). Jobyo processes Customer Personal Data only on the Customer’s documented instructions, which include the Terms of Service, this DPA, and your configuration and use of the Service.

2. Scope and Details of Processing

• Subject matter: provision of the Jobyo field-service and job-costing platform.
• Duration: for the term of your subscription, plus any limited post-termination retention period.
• Nature and purpose: hosting, storing, transmitting, and processing Customer Personal Data to provide, secure, support, and improve the Service.
• Types of data: contact details, employee and user records, customer and supplier records, work orders, tasks, projects, quotations, invoices, attachments, geolocation (where enabled), and usage data.
• Categories of data subjects: your authorized users, employees, contractors, customers, and suppliers.

3. Customer Obligations

You are responsible for the accuracy and lawfulness of Customer Personal Data and for having a valid legal basis and any required notices or consents to collect it and have it processed by us. Your instructions to us must comply with applicable data-protection laws.

4. Jobyo Obligations

• Process Customer Personal Data only on your documented instructions, except where required by law (in which case we will notify you unless legally prohibited).
• Not sell Customer Personal Data and not use it for our own purposes, including advertising or (except as needed to provide the Service) our own product development.
• Ensure that personnel authorized to process Customer Personal Data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (Section 7).
• Assist you, taking into account the nature of the processing, with data-subject requests, security, breach notification, and, where applicable, data-protection impact assessments.

5. Sub-Processors

You authorize Jobyo to engage sub-processors to help provide the Service. We impose data-protection obligations on each sub-processor that are substantially consistent with this DPA, and we remain responsible for their performance. Our current sub-processors include:

• Google (Firebase & Google Cloud) — authentication, notifications, hosting, and storage.
• Anthropic — AI-based optical-character-recognition (OCR) extraction of documents you upload. Anthropic processes this data under its own data-processing addendum, does not use it to train its models, and deletes it in accordance with its retention terms (by default within approximately 30 days).
• Stripe — subscription payment processing.
• Microsoft / Google email services — optional invoice-inbox import when connected by you.
• Transactional email providers (e.g., Resend / MailerSend) — sending Service emails.

We will provide notice of new or replacement sub-processors. If you have a reasonable, data-protection-based objection to a new sub-processor, you may notify us; if we cannot reasonably accommodate the objection, your remedy is to stop using the affected feature or to terminate the affected subscription.

6. Data-Subject Requests

Taking into account the nature of the processing, we will provide reasonable assistance and appropriate tools to help you respond to requests from data subjects to exercise their rights (such as access, correction, deletion, and portability). If we receive such a request directly regarding Customer Personal Data, we will, where permitted, direct the individual to you.

7. Security Measures

We maintain appropriate technical and organizational measures designed to protect Customer Personal Data, including encryption in transit and at rest, role-based access controls, multi-tenant data isolation, network and infrastructure security provided through Google Cloud, logging, and internal access restrictions. We periodically review and update these measures.

8. Breach Notification

If we become aware of a confirmed personal-data breach affecting Customer Personal Data, we will notify you without undue delay and provide information reasonably available to us to help you meet your own notification obligations. Our notification is not an acknowledgment of fault or liability.

9. International Transfers

Customer Personal Data is processed and stored on Google Cloud infrastructure primarily located in the United States, and may be processed by sub-processors in other countries. Where required, we rely on appropriate transfer mechanisms, such as Standard Contractual Clauses, to provide an adequate level of protection for cross-border transfers.

10. Audits

Upon reasonable written request, and subject to confidentiality, we will make available information reasonably necessary to demonstrate our compliance with this DPA. Where applicable law requires more, the parties will cooperate in good faith to agree on a reasonable audit scope that does not compromise the security or confidentiality of other customers.

11. Return and Deletion of Data

On termination of the Service, we will make Customer Data available for export for a limited period (typically up to 30 days), after which we will delete or anonymize Customer Personal Data, except where retention is required by law. Backups are deleted in the ordinary course of our retention cycle.

12. Contact

For questions about this DPA or to submit a data-protection request, contact us at info@jobyo.io.
NidSons Inc. (o/a Jobyo), Montréal, Québec, Canada