Data Processing Agreement

1. Definitions

• "Personal Information" means information about an identifiable individual that Customer submits to, or CINERA processes through, the Service on Customer's behalf.
• "Controller" means the party that determines the purposes and means of processing Personal Information. For processing under this DPA, the Customer is the Controller.
• "Processor" means the party that processes Personal Information on behalf of the Controller. For processing under this DPA, CINERA is the Processor.
• "Sub-processor" means a third party engaged by CINERA to process Personal Information in connection with the Service.
• "Applicable Privacy Law" means the Personal Information Protection and Electronic Documents Act (PIPEDA), the Alberta Personal Information Protection Act (PIPA), and any other data-protection law applicable to Customer's use of the Service.

2. Roles of the Parties

As between the parties, Customer is the Controller of the Personal Information it submits to the Service, and CINERA is the Processor acting on Customer's behalf. Customer is responsible for the lawfulness of the Personal Information it submits and for having the necessary rights, notices, and consents to permit CINERA to process it as described in this DPA.

3. Scope and Details of Processing

• Subject matter: CINERA's provision of the Service to Customer.
• Duration: the term of Customer's use of the Service, plus the retention and deletion periods in Section 9.
• Nature and purpose: hosting, storing, organizing, transmitting, and displaying Personal Information so Customer and its authorized collaborators can carry out location scouting, production coordination, and related workflows.
• Categories of data subjects: Customer's personnel, scouts, property owners, production contacts, crew, and clients.
• Types of Personal Information: names, contact details, account identifiers, location and property information, photographs and associated metadata, and communications submitted through the Service.

4. CINERA's Obligations

CINERA will:

• process Personal Information only on Customer's documented instructions, including as set out in this DPA and the Terms of Service, and as necessary to provide the Service;
• ensure that personnel authorized to process Personal Information are bound by confidentiality obligations;
• not sell Personal Information, and not use it for advertising or to train artificial intelligence or machine-learning models;
• implement and maintain appropriate technical and organizational security measures as described in Section 6; and
• assist Customer, taking into account the nature of the processing, in meeting Customer's own obligations under Applicable Privacy Law.

5. Sub-processors

Customer authorizes CINERA to engage the sub-processors below to process Personal Information in connection with the Service. CINERA imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for their performance.

CINERA will give Customer reasonable prior notice of any intended addition or replacement of a sub-processor. If Customer reasonably objects on data-protection grounds, the parties will work in good faith to resolve the concern.

6. Security Measures

CINERA maintains technical and organizational measures designed to protect Personal Information against unauthorized access, loss, or disclosure, including: encryption of data in transit (TLS) and at rest; role-based access controls and row-level security; least-privilege administrative access; audit logging; and regular review of its security posture. Customer is responsible for configuring access within its own organization (including project codes, memberships, and roles) appropriately.

7. International Data Transfers

The Service's application infrastructure and primary database are currently hosted in the United States, and the sub-processors above may process Personal Information in the United States. Where Personal Information is transferred outside its country of origin, CINERA relies on appropriate safeguards and the contractual protections in this DPA. CINERA is working to migrate its primary infrastructure to Canadian-region hosting; until that migration is complete and announced, Customer should assume Personal Information is processed and stored in the United States. This aligns with our Privacy Policy.

8. Assistance and Data Subject Rights

Taking into account the nature of the processing, CINERA will provide reasonable assistance to enable Customer to respond to requests from individuals to access, correct, or delete their Personal Information, and to meet Customer's obligations under Applicable Privacy Law. Where CINERA receives a request directly from an individual regarding Personal Information processed on Customer's behalf, CINERA will, unless legally prohibited, direct the individual to Customer.

9. Breach Notification, Return and Deletion

• CINERA will notify Customer without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Information processed on Customer's behalf, and will provide information reasonably available to it to assist Customer's own notification obligations.
• On termination or expiry of Customer's use of the Service, CINERA will, at Customer's choice, return or delete Personal Information in accordance with the retention and deletion periods described in the Privacy Policy, except where retention is required by law.

10. Audit

On reasonable written request, and no more than once per year (unless required by a regulator or following a security incident), CINERA will make available information reasonably necessary to demonstrate its compliance with this DPA, subject to confidentiality obligations and without compromising the security of other customers.

11. Governing Law

This DPA is governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein, consistent with the governing-law provisions of the Terms of Service.

12. Contact

To exercise rights under this DPA or ask questions about data processing, contact us at privacy@cinera.ca.