Data Processing Agreement (DPA)

Last Updated: July 15, 2026

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions ("Agreement") between Etrica Review Management and Automation ("Etrica", "Processor", "we", "our", or "us") and the customer using the Services ("Customer", "Controller", "you", or "your").

This DPA governs Etrica's processing of Personal Information on behalf of the Customer in connection with the Services.

If there is any conflict between this DPA and the Agreement regarding the processing of Personal Information, this DPA shall prevail.

1. Definitions

For purposes of this DPA:

Applicable Privacy Laws means all laws governing the processing of Personal Information that apply to the parties, including, where applicable:

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA);
applicable provincial privacy legislation, including Quebec's Law 25 where applicable;
any successor legislation.

Controller

means the Customer who determines the purposes and means of processing Personal Information.

Processor

means Etrica Review Management and Automation.

Personal Information

has the meaning assigned under Applicable Privacy Laws.

Processing

includes collecting, storing, organizing, accessing, using, transmitting, deleting, or otherwise handling Personal Information.

Subprocessor

means a third party engaged by Etrica to process Personal Information in support of the Services.

2. Scope

This DPA applies whenever Etrica processes Personal Information on behalf of the Customer while providing:

Review request automation
Review management
Reputation management
Customer communication automation
AI-powered messaging features
Customer feedback collection
CRM integrations
Workflow automation
Related SaaS services

3. Roles of the Parties

The Customer acts as the Controller.

Etrica acts as the Processor.

The Customer determines:

what Personal Information is collected;
which customers receive communications;
what messages are sent;
how long information is retained within the Customer's account.

Etrica processes Personal Information only as instructed by the Customer through use of the Services.

4. Categories of Personal Information

Depending on how the Customer uses the Services, Personal Information may include:

names;
email addresses;
telephone numbers;
business names;
appointment information;
service history;
customer communications;
review requests;
review responses;
customer feedback;
CRM identifiers;
IP addresses;
device information;
browser information;
usage analytics; and
any additional information submitted by the Customer.

Etrica does not intentionally collect sensitive personal information unless the Customer chooses to upload such information.

Customers should avoid uploading unnecessary sensitive Personal Information.

5. Categories of Data Subjects

Data subjects may include:

customers;
prospective customers;
employees;
contractors;
business contacts;
website visitors;
review recipients; and
individuals whose Personal Information is uploaded by the Customer.

6. Purpose of Processing

Etrica processes Personal Information solely to:

provide the Services;
send review invitations;
automate customer communications;
manage customer reviews;
improve platform functionality;
provide customer support;
detect fraud and abuse;
maintain platform security;
comply with legal obligations; and
perform other services requested by the Customer.

Etrica does not sell Customer Personal Information.

7. Customer Responsibilities

The Customer represents and warrants that:

it has all necessary rights to provide Personal Information to Etrica;
it has obtained all required consents where required by law;
its use of the Services complies with Applicable Privacy Laws;
it has an appropriate privacy policy;
it complies with Canada's Anti-Spam Legislation (CASL) where applicable;
it will not upload unlawful or unauthorized Personal Information.

The Customer remains solely responsible for the legality of Personal Information processed through the Services.

8. Processor Obligations

Etrica agrees to:

process Personal Information only in accordance with Customer instructions;
maintain appropriate technical and organizational safeguards;
restrict employee access to authorized personnel;
ensure confidentiality obligations apply to personnel;
implement reasonable security measures;
assist Customers where reasonably possible with privacy-related requests;
promptly investigate suspected security incidents.

9. Confidentiality

All personnel authorized to process Personal Information are subject to confidentiality obligations.

Access to Personal Information is limited to personnel who require access to perform their job responsibilities.

10. Security Measures

Etrica maintains administrative, technical, and organizational safeguards appropriate to the nature of the Services, including measures designed to protect against unauthorized access, disclosure, alteration, loss, or destruction of Personal Information.

Examples may include:

encrypted communications (HTTPS/TLS);
role-based access controls;
secure authentication procedures;
password protection;
infrastructure monitoring;
security logging;
software updates;
vulnerability management;
backup procedures; and
incident response processes.

No system can guarantee absolute security.

11. Subprocessors

The Customer authorizes Etrica to use trusted third-party subprocessors where necessary to provide the Services.

These may include providers for:

cloud hosting;
payment processing;
email delivery;
SMS messaging;
analytics;
customer support;
CRM integrations;
artificial intelligence services; and
infrastructure management.

Etrica will take reasonable steps to ensure subprocessors are subject to appropriate contractual privacy and security obligations.

A current list of primary subprocessors may be made available upon reasonable request.

12. International Transfers

Some subprocessors may process Personal Information outside Canada.

Where Personal Information is transferred internationally, Etrica will use reasonable safeguards designed to protect Personal Information in accordance with Applicable Privacy Laws.

Such safeguards may include contractual protections, security certifications, or other legally recognized transfer mechanisms.

13. Assistance with Privacy Requests

Where reasonably possible, Etrica will assist the Customer in responding to requests involving:

access requests;
correction requests;
deletion requests;
portability requests where applicable;
regulatory inquiries.

The Customer remains responsible for responding to individuals.

14. Security Incidents

If Etrica becomes aware of a confirmed security incident affecting Customer Personal Information, Etrica will notify the Customer without unreasonable delay after becoming aware of the incident.

The notification may include, where available:

the nature of the incident;
affected information;
likely consequences;
mitigation steps taken;
recommended Customer actions.

Notification does not constitute an admission of fault.

15. Data Retention and Deletion

Personal Information will be retained only as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

Upon termination of the Services, Customer Personal Information may be deleted or anonymized in accordance with Etrica's data retention practices unless retention is required by law.

Customers are encouraged to export their information before account termination.

16. Audits

Because Etrica is a multi-tenant SaaS platform, Customers may not conduct on-site audits that could affect other customers or compromise platform security.

Upon reasonable written request, Etrica may provide information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality obligations and protection of proprietary information.

17. Liability

Each party's liability under this DPA is subject to the limitations of liability contained in the Agreement unless prohibited by Applicable Privacy Laws.