Snapshot 224112
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Addendum
Last updated 2026-10-05
Back to Legal
This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between BEEM Technologies Inc. ("BEEM") and the customer identified in the Quotation ("Customer") and applies to the extent BEEM processes Personal Information on behalf of Customer in connection with the Services. Capitalized terms not defined herein have the meaning set out in the Terms.
1. Definitions
"Applicable Data Protection Laws" means all laws applicable to the processing of Personal Information under the Terms, including, as applicable: the Act respecting the protection of personal information in the private sector (Québec) ("Law 25"); the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"); the EU General Data Protection Regulation 2016/679 ("GDPR") and its UK equivalent; and the California Consumer Privacy Act ("CCPA").
"Personal Information" has the meaning set out in the Terms and includes "personal data" and "personal information" as defined under Applicable Data Protection Laws.
"Processing" (and its derivatives) means any operation performed on Personal Information, whether or not by automated means.
"Subprocessor" means a third party engaged by BEEM to process Personal Information on behalf of Customer.
"Security Incident" means a confidentiality incident within the meaning of Law 25 or a personal data breach within the meaning of the GDPR affecting Personal Information processed by BEEM on behalf of Customer.
2. Roles; Scope of Processing
2.1 As between the parties, Customer is the controller (or, under Law 25 and PIPEDA, the person or organization with control of the Personal Information) and BEEM is the service provider / processor. Under the CCPA, BEEM is a "service provider" and certifies that it understands and will comply with the restrictions applicable to service providers.
2.2 BEEM processes Personal Information solely (i) to provide, secure, maintain and improve the Services in accordance with the Terms; (ii) as documented in Customer's written instructions, including the configuration choices Customer makes in the Platform; and (iii) as required by applicable Law, in which case BEEM informs Customer of that legal requirement before processing, unless prohibited by Law. BEEM will inform Customer without undue delay if, in BEEM's opinion, an instruction infringes Applicable Data Protection Laws.
2.3 The subject matter, duration, nature and purposes of the processing, and the categories of Personal Information and of data subjects, are described in Annex A.
2.4 BEEM shall not sell or share Personal Information (as those terms are defined under the CCPA), nor retain, use or disclose it other than to provide the Services, or combine it with Personal Information obtained from other sources except as permitted for the provision of the Services.
2.5 BEEM will notify Customer if it determines that it can no longer meet its obligations as a service provider under the CCPA. Upon receiving such notice, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information, and may verify BEEM's compliance in accordance with Section 9.
3. Confidentiality
BEEM ensures that persons authorized to process Personal Information (including the ADS Team, as defined in the Professional Services (ADS) Terms & Conditions) are bound by appropriate confidentiality obligations and process Personal Information only as needed to provide the Services.
4. Security
4.1 BEEM implements and maintains industry-standard technical and organizational measures designed to protect the confidentiality, availability and integrity of Personal Information, as described in Annex B. BEEM's information security program follows SOC 2-aligned processes.
4.2 Customer Data is hosted in a dedicated cloud environment, in the AWS region corresponding to Customer's location or preference (for example, AWS Canada ca-central-1 for Canadian customers, or a U.S. AWS region for U.S. customers), as confirmed at deployment. The Platform's AI features use models hosted in AWS (Amazon Bedrock) and operate within that environment; Personal Information processed by AI features is not transmitted to third-party AI model providers outside of it and is not used to train artificial-intelligence models.
4.3 Customer is responsible for configuring and using the Services in a manner consistent with its own obligations under Applicable Data Protection Laws, including access management, sharing controls and the activation of integrations.
5. Subprocessors
5.1 Customer provides general authorization for BEEM to engage the Subprocessors listed in Section C.1 of Annex C. BEEM imposes on each Subprocessor data protection obligations materially equivalent to those in this DPA.
5.2 BEEM will give Customer at least 30 days' prior written notice (which may be by email to the Notification Email Address) of the addition or replacement of a Subprocessor processing Personal Information. Customer may object on reasonable, documented data-protection grounds within that period; the parties will then cooperate in good faith to find a solution and, failing one, Customer may terminate the affected Services in accordance with the Terms.
5.3 BEEM remains responsible for the performance of its Subprocessors' obligations under this DPA.
6. Assistance
6.1 Taking into account the nature of the processing, BEEM provides Customer with commercially reasonable assistance to respond to requests from individuals exercising their rights under Applicable Data Protection Laws (access, rectification, deletion, portability, withdrawal of consent). If BEEM receives such a request directly, it will redirect the individual to Customer without undue delay.
6.2 BEEM provides commercially reasonable assistance to Customer with data protection impact assessments, Law 25 privacy impact assessments relating to the Services, and consultations with supervisory authorities, to the extent the required information is available to BEEM.
6.3 Taking into account the nature of the processing and the information available to BEEM, BEEM provides Customer with reasonable assistance in meeting Customer's obligations relating to the security of processing and to the notification of Security Incidents to authorities and affected individuals (Articles 32 to 36 of the GDPR and the equivalent provisions of Law 25 and PIPEDA).
7. Security Incidents
7.1 BEEM notifies Customer without undue delay and in any event within 72 hours after becoming aware of a Security Incident, through the Notification Email Address, and provides information reasonably available to BEEM regarding the nature of the incident, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed. BEEM thereafter provides Customer with updates as further information becomes available.
7.2 BEEM maintains a register of Security Incidents as required by Law 25. As between the parties, Customer is responsible for notifications to individuals and authorities required of a controller; BEEM is responsible for those required of a processor.
8. Cross-Border Transfers
8.1 Personal Information is processed in Canada and the United States, as reflected in Annex C. Before communicating Personal Information subject to Law 25 outside Québec, BEEM conducts and documents, before such communication, the assessment of the factors set out in Law 25, and that contractual safeguards in this DPA support the conclusion that the information receives adequate protection.
8.2 Where BEEM processes Personal Information originating from the EEA or the UK outside those territories, the parties incorporate the Standard Contractual Clauses (controller-to-processor module) or the applicable UK addendum by reference, as set out in Annex D; in case of conflict between the Standard Contractual Clauses and this DPA, the Standard Contractual Clauses prevail.
9. Audits and Information
9.1 Upon written request, no more than once per 12-month period, BEEM makes available information reasonably necessary to demonstrate compliance with this DPA, including a description of its information security program, completed security questionnaires and available third-party attestations or audit summaries.
9.2 Customer (or an independent auditor mandated by Customer and bound to confidentiality) may audit BEEM's compliance with this DPA, upon at least 30 days' prior written notice, no more than once per 12-month period (except following a Security Incident or a demonstrated non-compliance with this DPA), during business hours, and without access to other customers' data or to information protected by law or confidentiality obligations. Audits are conducted remotely and on a documentation basis wherever possible. The costs of Customer's auditor are borne by Customer, and if an audit requires more than one business day of BEEM personnel time, Customer reimburses BEEM's reasonable costs for the additional time at BEEM's then-current ADS rates.
10. Return and Deletion
Upon termination of the Terms, BEEM returns or deletes Personal Information in accordance with Section 19(c) of the Terms (30-day instruction window, transfer or copy on request, deletion thereafter), unless retention is required by applicable Law, in which case BEEM continues to protect the retained information under this DPA and deletes it as soon as legally permitted. Upon Customer's written request, BEEM certifies the deletion in writing. Personal Information residing in encrypted backups is deleted in accordance with BEEM's normal backup rotation cycles and remains protected under this DPA until overwritten.
11. Liability; Order of Precedence
The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms. In case of conflict between this DPA and the Terms with respect to the processing of Personal Information, this DPA prevails; the Standard Contractual Clauses, where applicable, prevail over both.
Annex A - Description of Processing
Subject matter: provision of the BEEM Data Platform and related Services under the Terms.
Duration: the Subscription Term, plus the return/deletion period in Section 10.
Nature and purposes: ingestion, storage, transformation, analysis, visualization and export of Customer Data; account administration; support; security monitoring.
Categories of data subjects: Customer's employees, contractors and other End Users; and any individuals whose Personal Information is contained in the data Customer submits to the Platform (as determined solely by Customer, e.g., its clients, customers, suppliers or employees).
Categories of Personal Information: account data (names, business contact details, credentials, log and device data of End Users); and any categories of Personal Information contained in Customer Data, as determined solely by Customer. Customer agrees not to submit sensitive Personal Information unless it has satisfied itself that the Services are appropriate for such data under Applicable Data Protection Laws.
Annex B - Technical and Organizational Measures (summary)
Maintained under BEEM's Information Security Program (full descriptions available to Customer on request):
Governance: documented security policies, reviewed periodically; designated security ownership; corporate ethics and whistleblower policy; SOC 2-aligned control framework; AWS Foundational Technical Review (FTR) validated ISV and AWS authorized distribution reseller, subject to AWS-reviewed technical and security requirements.
Access control: role-based access (Organization Admin / Editor / Viewer), least-privilege provisioning through documented onboarding approvals, timely revocation on departure, MFA on systems handling confidential data, SSO support, password policy.
Infrastructure: dedicated per-customer cloud environments; hosting in the AWS region corresponding to the customer's location or preference; workspace isolation; encryption in transit and at rest per cloud-provider standards.
Operations: change management policy with approvals and post-implementation review; patching; error and security monitoring; complete audit trail of platform events (Monitor).
Resilience: backup and restoration policy; business continuity and disaster recovery policy with business impact analysis, recovery strategy and periodic testing.
Data lifecycle: data retention and disposal policy; secure deletion practices; acceptable use policy for staff and contractors; device security requirements.
Incident response: incident identification, escalation, register of confidentiality incidents, notification procedures.
Annex C - Subprocessors and Service Providers
The providers in Section C.1 are Subprocessors that process Customer Personal Information on behalf of Customer under this DPA; the providers in Section C.2 process account, billing and communications data for BEEM's own purposes, with BEEM acting as controller, and are therefore not Subprocessors under this DPA.
C.1 Subprocessors of Customer Personal Information
Subprocessor Location Purpose
Amazon Web Services (AWS) Canada, USA or other available AWS regions per Customer's request Cloud infrastructure hosting
Auth0 (Okta) USA Authentication of platform users
Fivetran USA Data connector / extraction services
Sentry USA Error monitoring
Atlassian (Jira) USA Professional services delivery management (ADS engagements only)
Anthropic (Claude, business plan) USA AI-assisted data services performed by BEEM's Advanced Data Services team (ADS engagements only)
C.2 Service providers of BEEM acting as controller (account, billing and communications data)
Service provider Location Purpose
Stripe USA Credit card payment processing
GoCardless USA/UK Preauthorized debit processing
Chargebee USA Subscription management and invoicing
HubSpot USA CRM, communications, quoting, customer support (live chat)
Mixpanel USA Product usage analytics
Zoho USA Invoicing (ADS engagements only)
Note: the Platform's AI features use models hosted in AWS (Amazon Bedrock) within Customer's dedicated cloud environment; Customer Data processed by these features is not transmitted to third-party AI model providers, which are therefore not Subprocessors for the Platform. Anthropic is listed in Section C.1 solely for Advanced Data Services engagements, in which the ADS Team uses Claude under a business plan that does not use Customer Data to train models.
Annex D - Standard Contractual Clauses (EU) and UK Addendum
Where the transfer of Personal Information originating from the EEA requires a transfer mechanism under the GDPR, the Standard Contractual Clauses adopted by the European Commission under Decision (EU) 2021/914 (the "SCCs"), Module Two (controller to processor), are deemed entered into between Customer (as data exporter) and BEEM (as data importer) and are incorporated into this DPA by reference, completed as follows:
Clause 7 (docking clause): included.
Clause 9(a): Option 2 (general written authorization) applies, with a prior notice period of 30 days, as set out in Section 5 of this DPA.
Clause 11(a): the optional language regarding an independent dispute resolution body is not included.
Clause 13: the competent supervisory authority is that of the EU Member State in which the data exporter is established.
Clauses 17 and 18: in the absence of a valid choice by the data exporter, the SCCs are governed by the law of Ireland and disputes are resolved before the courts of Ireland.
Annex I of the SCCs is completed with the information in Annex A of this DPA and the parties' identities and contact details set out in the Quotation; Annex II is completed with Annex B of this DPA; Annex III is completed with Section C.1 of Annex C of this DPA.
For transfers subject to UK data protection law, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (in its version in force) applies mutatis mutandis, completed with the information above. For transfers subject to the Swiss Federal Act on Data Protection (FADP), the SCCs apply as adapted to the FADP, including as to the competent Swiss supervisory authority and applicable Swiss law where required.
Companies that trust us