Data Processing Agreement — Canada
The service-provider terms under which Cerrax handles your customers' personal information on your instructions.
This agreement forms part of the Terms of Service and applies whenever Cerrax handles personal information on your behalf. It is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (the "Quebec Act"), and the private-sector privacy laws of Alberta and British Columbia where they apply to your business (together, "Canadian privacy law"). Where this agreement and the Terms conflict on data protection, this agreement governs.
1. Which of us is which
You are the organization responsible for your customers’ personal information. We are your service provider for it: we handle it on your behalf, on your instructions, and use it for our own purposes only in the ways section 3 lists. That covers personal information about your customers, the people who inquire with you, your other contacts, and your staff and crew in their working role. For your own account information — your team’s logins, your company’s settings and billing — we are responsible in our own right, and our Privacy Policy covers that.
Your responsibilities. You are responsible for having the consent Canadian privacy law requires for the personal information you give us or ask us to collect, for telling the people concerned about it (our Privacy Policy describes what we do, and you may point to it), and for any consent your messages need under Canada's anti-spam legislation. You have the rights this agreement gives you.
One exception, which is your customer's choice, not yours. When your customer sends a video or photographs of their home, they may tick a separate box allowing Cerrax to keep them to train software that recognizes furniture and rooms. For that use alone, Cerrax is not your service provider: it is accountable for that information in its own right, on the customer's express consent, and our Privacy Policy (section 3) covers it: identifying details are blurred before it is ever used for training, nothing uses it today, and the customer can withdraw at any time, after which the video and photographs are deleted under the ordinary ninety-day rule. Everything else in this agreement applies to them as it does to the rest of your customers’ information.
2. What we process, and for how long
- Purpose: running your moving company on Cerrax — receiving and organizing your inquiries, keeping your customer records (contacts), producing and following up estimates and quotes, booking and running jobs, and sending the messages you set up — on your instructions.
- What we do with it: collecting, storing, organizing, reading (including with AI, to suggest details for a person at your company to confirm), pricing, sending messages on your behalf, anonymizing (section 9), exporting and deleting.
- Duration: for as long as your account is open, and afterwards only as section 8 allows.
- Type of personal information: names, addresses, contact details, move dates, and details of the property and its contents that you or your customer enter; where your crew use Cerrax on the day of the move, photographs of the property, its access and any damage found, together with the name and drawn signature of whoever signs the inventory off; and, where you invite it and your customer chooses to send one, a video of their home. Where you use them: your contacts (names, email addresses, phone numbers, company, preferred language, addresses used, the choices they gave you about your messages and when, where they came from, and your notes); inquiries, including the text of inquiry emails sent to your Cerrax lead address; the messages you send through Cerrax and whether they were delivered; follow-up tasks and their notes; whether a payment has been made (never card details); and reviews and ratings your customers give you.
- People it is about: people who inquire with you (whether or not they become customers); your customers; the people at the properties you move between; other people you keep as contacts; people named in notes, messages, photographs or video; and your staff and crew in their working role.
We do not ask for and do not want sensitive personal information. Please do not enter health, financial-account, social insurance number, government ID or similar information into free-text fields. If it arrives anyway — in an inquiry or a note — we hold it only as part of that record, never use it for pricing or learning, and keep it out of section 9.
A signature captured against an inventory is held as evidence that your customer agreed what was moved and in what condition. Nothing measures, compares or matches it, and nothing recognizes a face in a photograph or video (where faces are blurred, software finds them only to blur them and keeps no measurement of them) — so we do not create or use biometric information. Collecting signatures is optional: if you would rather your crew did not, simply do not use it.
3. We act on your instructions
We use your customers’ personal information only to carry out this agreement, on your documented instructions — which include your use of the product and this agreement — unless the law requires otherwise, in which case we will tell you first unless the law forbids that. If we think an instruction breaks Canadian privacy law, we will tell you promptly and may pause carrying it out until you confirm or change it. We will not sell it, use it for our own marketing or any other purpose of our own, or combine it with information we hold for anyone else — except these, which you instruct or allow: the anonymization in section 9; keeping descriptions of a job's items and rooms, with any email address, phone number or postal code removed, for 30 days to improve how Cerrax recognizes items (we keep no other text sent to our AI sub-processor); keeping the service secure; and meeting our own legal obligations.
Your instructions include these, when you use the features concerned: receiving emails sent to your Cerrax lead address and reading them — using our AI sub-processor where an email has no labelled layout — to suggest details you confirm; keeping contact records and the choices your customers make about your messages; and sending the reminder, thank-you and referral messages you switch on, in your name, identifying you, with your mailing address and a statement that they are sent for you by Cerrax, honouring every unsubscribe at once and for all of those messages from you to that person. We keep a record of each choice and each unsubscribe, and a scrambled record of an unsubscribe for as long as it must be honoured.
Also on your instructions, when you use the features concerned: sending your customers the messages about a job that you set up (by WhatsApp where you have connected it, otherwise by email), including a review request and the private rating and comment a customer may give you; creating links you choose to share — a job sheet for your crew, or evidence (the customer's name, photographs, video and signatures, never their contact details) for your insurer, broker or claims handler; publishing your jobs to calendar subscriptions you create; and keeping follow-up tasks and their notes.
4. Confidentiality
Everyone we allow to access your customers’ personal information is bound by a written duty of confidentiality that continues after they leave, and only sees what their role requires. Access inside the product is governed by roles and individual permissions, checked on the server for every request.
5. Security
We protect the information with security safeguards appropriate to its sensitivity, described in our security overview — encryption in transit and at rest, role-based access control, an audit trail of consequential actions, point-in-time recovery and separate daily backups — giving it a level of protection comparable to the one Canadian privacy law requires of you. That page states plainly what we do not yet have. We will not materially reduce the overall level of security described there while this agreement lasts.
6. Sub-processors
You authorize us to use sub-processors. The current list is in section 8 of our Privacy Policy and is kept current there. We bind each of them by written contract to obligations no less protective than these, and we remain fully responsible to you for their performance. We will email your account owner at least 30 days before a new sub-processor starts handling your customers’ information (sooner only in an emergency, such as a provider failing, and then we tell you as soon as we can). You may object within that time on reasonable data protection grounds; if we cannot resolve it, you may end the affected service or your subscription and we will refund any fees paid in advance for the unused period. Services you connect yourself under your own account with them — your own Stripe, WhatsApp Business or Xero account — act on your instruction under your agreement with them, and are not our sub-processors.
If you subscribe your own calendar to your Cerrax calendar link, your calendar provider fetches your jobs under your own agreement with it; it is not our sub-processor.
7. Helping you meet your own obligations, and incidents
Taking into account the nature of the processing, we will help you respond to requests from individuals — to access, correct, port, delete or de-index their information, or to withdraw consent — and with your safeguarding, breach-reporting and privacy-impact-assessment duties. If an individual contacts us directly about information we hold for you, we will tell them to contact you rather than answer for you. You can find, export, correct and delete a contact or a job yourself in the product; for anything the product cannot do, we will act within 10 working days of your written instruction.
We will notify your person in charge of the protection of personal information without delay, and in any event within 48 hours, of any breach of security safeguards or confidentiality incident affecting your customers’ information, and of any violation or attempted violation by anyone of an obligation concerning its confidentiality — with the information you need to assess the risk, report to the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information or a provincial commissioner, notify the people affected, and keep your own records.
8. Deletion and return
Your instruction on how long we keep it. Unless you tell us otherwise, you instruct us to keep each job record — the quote, its booking and outcome, the crew's sheets and the photographs attached to them — for six years after the move (or after the quote, if the job did not go ahead), or for longer while a claim or dispute about that job is open, and then to delete it. A video, and any photographs your customer sends with it, are deleted 90 days after the job's last date unless your customer has separately agreed to their longer use. You can change this instruction by telling us.
Unless you tell us otherwise, you also instruct us to delete: an inquiry that was never priced or sent, 12 months after its last activity; a quote that was sent but never accepted, 24 months after it was sent; and a contact record 12 months after the last job record linked to it is deleted (or 12 months after it was made, if it was never linked to a job). A record of a person's consent is kept while their contact record is kept and for six years after; a scrambled record of an unsubscribe is kept for as long as it must be honoured.
We do not keep your customers’ personal information after this agreement ends. When your subscription ends you can export it for 30 days; we then delete it, or return it if you ask, within 90 days, and it leaves our backups as they expire (within 98 days) — except where the law requires us to keep it. Committed pricing records are never silently altered — personal identifiers within them are removed, which is how deletion is honoured without falsifying a record of what was quoted. Section 9 records are not your customers’ personal information and are not affected.
Two records keep their own periods: email delivery records (recipient, subject and whether it was delivered), 90 days; and the audit trail of actions in your account, up to six years after your account closes, with a customer's details removed when that customer is erased.
9. Anonymized job data
Cerrax gets more accurate as it sees real outcomes. You instruct us, as part of the service, to anonymize your job data and to use the anonymized result to improve the pricing engine. A record made this way holds only the shape and economics of a job — volume, a distance band, access features, crew, trucks, hours, price and cost, whether the quote was won and why not, the month of the move, and an area no finer than the first letter of a postal code — and never a name, contact detail, full postal code, address, map position, free text, photograph, video, signature, your company's identity, or any reference that links it back to the job. While we still hold the original job it stays under this agreement as personal information; once the original is destroyed, the record is anonymized. It is then ours, and we may keep and use it to improve and provide Cerrax, including after this agreement ends. We never show another company, or anyone else, your individual prices or anything that identifies your company.
We only treat data as anonymized once it is reasonably foreseeable that it irreversibly no longer allows anyone to be identified, directly or indirectly; we anonymize according to generally accepted best practices and, for information about people in Quebec, the criteria the Quebec Act and its regulation set; we will not try to re-identify it; and we require anyone we share it with to make the same commitment.
10. Learning across companies
We use anonymized records under section 9, and statistics made from them, from across all companies using Cerrax, in every country, to improve the pricing engine for everyone, including you. This is stated here rather than assumed, because it is how the product gets better and we would rather you knew than found out.
11. Your numbers stay yours
Your rates, your margins, your customers and your prices are never visible to another company, and never shown to the people you are quoting. The learning in section 10 runs on aggregated, anonymized signal — not on access to any one company’s data by anybody else.
12. Verification and audit
We will make available the information you reasonably need to verify that we are meeting these obligations, including those on confidentiality — first by written answers and our security documentation — and will allow and contribute to a reasonable verification by you or an independent assessor you appoint where those are not enough or a regulator requires it: at your cost, on 30 days' notice, under confidentiality, without access to other companies' data, and no more than once a year unless a regulator, an incident or a breach requires otherwise.
13. Where the information is
We hold your customers’ personal information in the United Kingdom, in London, and you authorize that. Some sub-processors process it in the United States — the AI provider named in our Privacy Policy is the case today. Where the information is held outside Canada it is subject to the laws of that country and may be accessible to its courts and authorities; you are responsible for telling your customers so, and we give you the words in our Privacy Policy (section 9).
If your business is in Quebec: the Quebec Act requires you to assess the transfer before communicating personal information outside Quebec. Section 9 of our Privacy Policy sets out our assessment of its sensitivity, purpose, safeguards and the law of the United Kingdom, and we will give you any further information you reasonably need for your own assessment. This agreement is the written agreement that governs the transfer, and we will agree reasonable additional measures your assessment identifies. Where your data is stored on any given day is a question you can ask us at any time, and we will answer it for the day you ask.
Liability. Section 11 of the Terms of Service (limitation of liability) applies to this agreement.
14. Contact
Data protection questions, individuals’ requests and incident notifications: hello@cerrax.io.
15. Canadian-law terms, in one place
For your own records, this agreement gives you the terms Canadian privacy law expects of a contract with a service provider: the purpose, type of information and duration (section 2); use only to carry out the agreement and on your instructions (section 3); confidentiality and security measures giving comparable protection (sections 4 and 5); sub-processors bound by written contract (section 6); assistance with individuals’ requests, and notification without delay of incidents and of any violation or attempted violation of confidentiality (section 7); no keeping of the information after the agreement ends (section 8); anonymized data (section 9); your right to verify compliance (section 12); and the written agreement for communication outside Quebec (section 13). If Canadian privacy law that applies to you requires a term this agreement does not contain, that term is treated as included, to the extent the law requires it.