Data processing addendum

Last updated October 26, 2026

This addendum is part of the terms of service between Keyvera Tech Ltd. ("Keyvera", "we", "us") and each customer (the agent, team or brokerage that holds a Keyvera account, "you"). It sets out how we handle the personal information you put into Keyvera on your behalf. It applies automatically, with no signature needed. If your brokerage would like a signed copy, email support@keyvera.ca.

1. What this addendum covers

• "Client information" means the personal information in the content you or your team put into Keyvera or collect through it: your contacts, leads and clients, the people on your deals, the people who register on your pages or reply on your portals, and the emails, texts, calls, notes and documents about them.
• "Privacy law" means the Personal Information Protection and Electronic Documents Act (PIPEDA), the provincial private sector privacy laws that apply to you (such as British Columbia's and Alberta's Personal Information Protection Act), and Canada's Anti-Spam Legislation (CASL) where it applies to how client information is used.
• "Service provider" means a company we use to run Keyvera that may handle client information, as listed in section 6 of our privacy policy.
• Information about you as a Keyvera user (your account, billing and support) is handled under our privacy policy, not this addendum.

2. Our roles

You are responsible for client information and decide why and how it is collected and used. Keyvera handles it on your behalf, as your service provider, only to run Keyvera for you. Your instructions to us are the terms of service, this addendum, the features and settings you use, and any other written request you or your workspace owners and admins make, such as a support request.

3. Your responsibilities

• Collect client information lawfully, with the consent or authority privacy law requires for you to put it into Keyvera and use it as you do.
• Tell your clients how you handle their information, including that it is stored and processed outside Canada by your service providers, where privacy law requires it.
• Get the consent CASL requires before sending commercial emails or texts, and the consent the law requires before recording a call.
• Keep client information accurate and up to date, and make sure your instructions to us comply with privacy law.
• Decide who in your workspace can see what, and keep your sign-in details secure.

4. Our commitments

• We handle client information only on your instructions, to provide, secure and support Keyvera, and to meet our legal obligations. If we believe an instruction breaks privacy law, we will tell you.
• We do not sell client information, use it for advertising, give it to anyone for their own marketing, or use it to train AI models. We may use counts and statistics that identify no one to run and improve Keyvera.
• Our staff and contractors who may see client information are bound by confidentiality, and see it only as our privacy policy describes (for example, read-only support access you turn on).
• We keep administrative, technical and physical safeguards suited to how sensitive the information is, as described in section 9 of our privacy policy, and review them as Keyvera changes.

5. Service providers

You agree that we may use the service providers listed in section 6 of our privacy policy to handle client information. Each is bound by a written contract that requires it to protect the information at least as well as this addendum does, and we remain responsible to you for their work under it. We keep that list up to date. If you object to a new service provider on reasonable privacy grounds, tell us within 30 days of the change. We will try to address your concern; if we can't, you may cancel your subscription and we will refund any fees you have prepaid for the time after you cancel. Services you connect yourself, such as your own Google, Microsoft, Dropbox, Meta, LinkedIn, Twilio, Canva or DocuSign account or an AI app, are not our service providers: you direct us to share information with them, and your own agreement with them applies.

6. Where information is stored

Client information is stored and processed in the United States and the other countries listed in our privacy policy. You agree to these transfers. While there, it is subject to the laws of those countries, and their authorities may be able to access it under those laws.

7. Requests from individuals

If one of your clients asks us to see, correct or delete their information, we will pass the request to you without unreasonable delay and will not answer it ourselves unless the law requires us to. Keyvera's tools let you find, correct, export and delete records, and we will help you answer a request where you can't do it with those tools.

8. Requests from authorities

If a court, law enforcement or other government authority asks us for client information, we will disclose only what we reasonably believe the law requires, and we will tell you first unless the law forbids it.

9. Breaches

• If we learn of a breach of our security safeguards involving client information, we will tell your workspace owners without unreasonable delay, by email, with what we know about what happened, the information involved, and what we are doing about it, and keep you updated as we learn more.
• We will take reasonable steps to contain the breach and reduce the risk of harm, and cooperate with you so you can meet your own obligations, including assessing whether there is a real risk of significant harm and notifying your clients and the privacy commissioner.
• Unless the law requires us to do it ourselves, you decide whether and how to notify your clients, and we will not name you to them or to a regulator without telling you first.
• We keep a record of every breach of our security safeguards for at least 24 months.

10. When your account ends

You can export client information at any time while your account is open and for 60 days after it closes. After that, we delete it within 30 days, and copies in our backups are overwritten within a further 30 days. We may keep information longer only where the law requires it, and it stays covered by this addendum for as long as we hold it.

11. Information about our safeguards

Once a year, or after a breach, you may send us a reasonable written security or privacy questionnaire, and we will answer it. What we tell you about our security is confidential and is for checking that we meet this addendum. We don't offer on-site audits.

12. The rest of the agreement

• This addendum lasts for as long as we hold client information for you.
• If this addendum and the terms of service disagree about client information, this addendum applies. Otherwise the terms apply, including their limits on liability, which cover this addendum too.
• We may update this addendum as Keyvera and the law change, in the same way as the terms of service. A change will not reduce the protection it gives client information without telling you at least 30 days before it takes effect.
• This addendum is governed by the laws of British Columbia and the federal laws of Canada that apply there.

Contact

Questions about this addendum go to our Privacy Officer at support@keyvera.ca, Keyvera Tech Ltd., 800-15355 24 Ave, Surrey, BC V4A 2H9, Canada.