Data Processing Agreement

1. Parties and roles

This Data Processing Agreement is between Soomi Inc. (corporation number 1801775-1, "Soomi") and the business customer that accepts it ("you"). It forms part of the Soomi Terms of Service and applies whenever Soomi handles personal information in your workspace's content on your behalf.

You decide; we act on your behalf. For the content your organization and its users store in Soomi (mail, files, documents, calendars, contacts, chats and meetings, together "Customer Content"), you decide why and how it is used, and you remain accountable for it under the privacy laws that apply to you. Soomi handles it only to provide the Services to you and only on your instructions, as a service provider to you.

This agreement does not cover the account and billing information Soomi holds to run your subscription (for example, your administrators' names and email addresses, and your billing address). Soomi handles that information under its own Privacy Policy.

2. Definitions

• Customer Content — everything your organization and its users store in or send through Soomi, including any personal information in it.
• Personal information — information about an identifiable individual, as defined in the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec's Act respecting the protection of personal information in the private sector.
• Processing — anything done with Customer Content: storing, backing up, transmitting, indexing, converting, displaying or deleting it.
• Sub-processor — a company Soomi engages that stores or processes Customer Content for us.
• Security incident — unauthorized access to, use of, disclosure of, or loss of Customer Content; under Quebec law, a "confidentiality incident".
• Your users — the people your organization gives a Soomi account in its workspace, and anyone they invite as a guest.

3. Processing only on your instructions

Soomi processes Customer Content only:

• to provide, secure and support the Services you subscribe to, as described in the Terms of Service;
• as you or your administrators instruct through the Services (for example, sharing a file, setting retention, removing a user); and
• where Canadian law requires it (section 10).

The Terms of Service, this agreement and your use of the Services' settings are your complete instructions. Soomi does not use Customer Content for its own purposes: not for advertising, not for profiling, not to train AI models, and it never sells it. If Soomi believes an instruction would break the law, we will tell you and need not follow it.

4. Confidentiality

Only the people at Soomi who operate the Services can access production systems, and only as far as their work needs. Each of them is bound by a duty of confidentiality that continues after they leave. People at Soomi do not open Customer Content except at your request (for example, a support case), to investigate abuse, or when Canadian law requires it.

5. Security

Soomi protects Customer Content with the technical and organizational measures in Annex B, appropriate to its sensitivity. We may change those measures over time, but never in a way that lowers the overall protection of Customer Content. Annex B also states plainly what Soomi does not do (for example, end-to-end encryption), so you can judge whether the Services suit your needs.

6. Where Customer Content is held

Soomi stores and processes Customer Content in Canada, in data centres run by Canadian providers, and its backups are held in Canada too. Soomi does not move Customer Content outside Canada.

Customer Content leaves Canada only when you or your users send it there: an email to a recipient abroad, a file shared with someone outside Canada, or a user signing in while travelling. That is your communication, not a transfer by Soomi.

The few services Soomi relies on that are outside Canada or foreign-owned receive no Customer Content; they are listed, with what each receives, in the Soomi Privacy Policy.

7. Sub-processors

You authorize Soomi to use the sub-processors in Annex C. Each is bound by written terms that protect Customer Content at least as well as this agreement, and Soomi remains responsible to you for them.

Changes. Soomi may add, remove or make changes to our sub-processors at any time, with no obligation to provide advance notice or require approval provided that the sub-processor agreement protects Customer Content at least as well as this agreement, and Soomi remains responsible to you for them.

Soomi will not use a sub-processor that would store or process Customer Content outside Canada without your prior written agreement.

8. Helping you answer privacy requests

When one of your users or another person asks you to access, correct, export or delete their personal information, most of it can be done by your administrators in the Services: export a user's mailbox and files, correct an account's details, remove a user. Where you need more, Soomi will help within a reasonable time. If such a request comes to Soomi directly, we will pass it to you rather than answer it ourselves, unless the law requires otherwise.

9. Security incidents

If Soomi becomes aware of a security incident affecting Customer Content, we will:

• notify your administrators without undue delay, and in any case within 72 hours of becoming aware, even if we do not yet know everything;
• tell you what happened, when, what Customer Content and roughly how many people are involved, what we have done to contain it, and who to contact at Soomi;
• keep you updated as we learn more, and give you what you reasonably need to assess the risk and to notify your users, regulators (the Office of the Privacy Commissioner of Canada, and Quebec's Commission d'accès à l'information where it applies) or anyone else; and
• record the incident in our incident register.

As the organization in control of Customer Content, you decide whether to notify affected people and regulators about your content. If the law requires Soomi to notify anyone directly, we will tell you first where we lawfully can. Notifying you is not an admission of fault.

10. Requests from authorities

Soomi discloses Customer Content to a government or police authority only when valid Canadian legal process requires it, and only what that process requires. A request from outside Canada must go through Canadian legal process authorized by a Canadian court. We will tell you about a demand for your content before we respond, unless the law or a court order forbids it, so you can challenge it, and where we can we will ask the authority to come to you directly. Soomi has built no capability for authorities to access or intercept Customer Content.

Records the law requires us to keep. If Canadian law requires Soomi to keep records about how the Services are used — for example, records about communications such as who sent a message to whom and when, but not their content — we keep them for the period that law sets and no longer, hold them in Canada with the same protection as Customer Content, and disclose them only as described above. Where the law does not require us to keep such records, we do not keep them beyond what the Services need to operate.

11. Your administrators and your users' accounts

Accounts in your workspace belong to your organization. Your administrators can create, suspend and remove them. When a user leaves, you decide what happens to their mail and files: where the law allows, Soomi will, on an authorized administrator's written request, give another person in your organization access to a departed or suspended user's content. Today this is arranged with Soomi support rather than in the Services.

You are responsible for telling your users that their workspace accounts and content belong to your organization and may be accessed this way, and for having a lawful basis to do so under the privacy and employment laws that apply to you.

12. When the service ends: return and deletion

Before you leave, your administrators can export your Customer Content in standard formats (mail as .eml, calendars as .ics, contacts as .vcf, files as stored). Soomi will help if you need it.

After you leave, or when you ask us to delete your workspace, Soomi holds your Customer Content for 30 days in case you change your mind, then deletes it. If your domain's mail still points to Soomi, we ask you to confirm first, so incoming mail is not lost without warning.

Backups exist only so Soomi can restore the service after a failure; Soomi does not restore individual items from them on request. They are encrypted, held in Canada, and expire within 90 days, after which deleted Customer Content is gone from them too.

Kept after deletion: records of the agreements and consents accepted, billing records Canadian tax law requires, records Canadian law requires us to keep (section 10) for the period it sets, and a record that the workspace existed and was deleted, with no Customer Content. On request, Soomi will confirm in writing that your Customer Content has been deleted.

13. Information and audits

Soomi will give you the information you reasonably need to show that this agreement is being met: answers to a reasonable security questionnaire once a year, a description of our current measures (Annex B), our sub-processor list (Annex C), and a summary of any security incident affecting you. If a regulator with authority over you requires more, we will cooperate with it. Given our size, we do not offer on-site audits; where an independent review is needed, we will agree its scope and cost with you in writing.

14. Term, liability and precedence

This agreement lasts as long as Soomi processes Customer Content for you, including the deletion period in section 12. Liability under it is governed by the Terms of Service. If this agreement and the Terms disagree about how Customer Content is handled, this agreement prevails. Like the Terms, it is governed by the laws of Ontario and the federal laws of Canada. Changes follow the Terms of Service: a material change is notified in advance and accepted again.

Annex A — Details of the processing

Subject matter	Hosting and operating your organization's Soomi workspace
Nature of processing	Storage, backup, transmission (mail, sharing, meetings), indexing for search, document conversion and previews, spam and malware filtering of mail, and deletion
Purpose	Providing, securing and supporting the Services you subscribe to
Categories of people	Your users; the people they correspond with, meet or share with; anyone whose personal information your users store
Categories of personal information	Whatever your users store or send: names, contact details, the content of mail, files, calendars, contacts, chats and meeting audio and video. Soomi does not choose or limit what this is.
Sensitive information	Only as your users choose to store it. If you store health, financial or children's information, tell us if you need specific handling (Acceptable Use Policy, section 9).
Duration	For the life of your subscription, then the 30-day hold and backup expiry in section 12

Annex B — Security measures (as built, October 2026)

Area	What Soomi does
Location and custody	Production servers, storage and backups in Canadian data centres run by Canadian providers, operated by Soomi
Separation between customers	Each business workspace has its own file and collaboration instance and its own sign-in realm, not a shared one
Network	Production, operations and backup systems sit in separate isolated networks behind Soomi's own firewall. Outbound connections are denied by default: production can reach only a short reviewed list of destinations, and every attempt is logged
Encryption in transit	All connections to Soomi use TLS. Mail between Soomi and other mail providers is encrypted whenever the other provider supports it
Encryption at rest	Every production disk is encrypted. The keys are held by Soomi, on key servers it runs outside its hosting provider, with an offline backup key held by the privacy officer
Sensitive account data	Names, email addresses, phone numbers, addresses and dates of birth in Soomi's own database are additionally encrypted field by field
Secrets	Kept in a self-hosted secrets store on a separate server, which can be opened for administration only by combining two of three separately stored key shares
Backups	Databases every 15 minutes, files and mail every 6 hours, encrypted on the server before they leave it, with a key the server itself cannot use to read them. Copied hourly to a separate backup system that production cannot reach. Restore tested
Administrative access	Only through a private network, with cryptographic keys rather than passwords; limited to the people who operate the service
Sign-in	Passwords are never stored by Soomi in readable form. Mail and calendar apps use separate per-device passwords that can be revoked one at a time. Signing out of Soomi also ends webmail sessions
Mail filtering	Spam and malware filtering run on Soomi's own servers; no mail content or hashes are sent to outside services for checking
Monitoring	Automated alerts when backups stop, when the secrets store is unavailable, or when scheduled security tasks fail
Incidents	A written incident procedure and an incident register kept for at least five years

What Soomi does not do, so you can decide whether it fits your needs:

• Soomi is not end-to-end encrypted. Like any hosted office suite that offers search, previews and co-editing, its systems process your content in readable form while providing those features.
• Soomi rents its servers. While a server is running, its unlocked key is in memory the hosting provider's systems could in principle reach; encryption protects stored data and backups, not a running system from the operator of its hardware.
• Soomi does not currently offer customer-managed encryption keys or a service-level agreement.

Annex C — Sub-processors (October 2026)

Sub-processor	What it does	Customer Content it handles	Where
ThinkOn	Hosts Soomi's production servers, storage and backup systems	All Customer Content, stored encrypted with keys Soomi holds	Canada

That is the complete list. Payment processing (Moneris) handles your organization's billing, not Customer Content, and is covered by the Privacy Policy.