Personal information processing agreement

Version 2026-10-11 · Part of the terms of use · The French version prevails.

1. Roles. The broker (the "controller") entrusts Dossalys (the "agent") with processing the personal information of the broker's clients found in emails and documents, under section 18.3 of Quebec's Act respecting the protection of personal information in the private sector. The controller remains responsible for that information.
2. Purposes. The agent processes the information only to read emails with attachments, recognize and file transaction documents, store them in the controller's storage, upload them to Prospects when enabled, and produce the service's dashboards, summaries and notices.
3. Agent's commitments. Act only on the controller's instructions (the settings in the service); apply reasonable security measures (encryption in transit and at rest, account isolation, need-to-know access bound by confidentiality, logging); disclose nothing to third parties except the service providers listed in the privacy policy, bound by equivalent obligations, with 30 days' notice before adding one; notify the controller without delay of any confidentiality incident, help assess the risk of serious injury and make the required notices, and record it in the register; help answer access, correction and portability requests; allow reasonable verification.
4. End. At the end of the subscription, data is available for export for 30 days, then securely destroyed (backups within 90 days). Documents filed in the controller's storage remain there.
5. Controller's commitments. The controller declares that collecting its clients' information and having it processed by the service complies with the law and its professional obligations.