Data Processing Addendum

0. About this addendum

This Data Processing Addendum ("DPA") is incorporated by reference into the Terms of Service between Campix Inc. ("Campix") and the organization ("Customer") using the Service. It applies whenever Customer's use of the Service involves Campix processing personal information on Customer's behalf, such as registrations, attendance records, medical information, payments, and similar operational data.

The DPA is a self-serve agreement: by configuring an account and using the Service in production, Customer accepts these terms in addition to the Privacy Policy and Terms of Service. Customers requiring a countersigned copy on enterprise letterhead may request one at legal@campix.io; the substance will not differ from the version on this page. Where this DPA conflicts with the Terms of Service on a data-processing matter, this DPA controls.

1. Definitions

• "Personal Information", any information about an identifiable natural person processed by Campix on behalf of Customer through the Service. The categories Campix processes are listed in the Privacy Policy (§2).
• "Processing", any operation performed on Personal Information, including collection, storage, use, transfer, disclosure, and erasure.
• "Sub-processor", a third party engaged by Campix to process Personal Information on behalf of Customer (current list).
• "Applicable Privacy Laws", PIPEDA (Canada), Quebec Law 25, PHIPA (Ontario), GDPR (where Customer or its data subjects are in the EEA/UK), CPRA / VCDPA / CTDPA / CPA / UCPA / TDPSA (where U.S. state residents are involved), COPPA (where children under 13 in the U.S. are involved), and CASL (commercial electronic messages to Canadian recipients).
• "Service", the Campix platform and all related modules (operator dashboard, public booking widget, guardian / counselor portals, kiosk, transactional email, CampMate AI).

2. Roles of the parties

For purposes of Applicable Privacy Laws, Customer is the controller (under GDPR / equivalent terms) or the organization (under PIPEDA / Law 25) of the Personal Information processed through the Service. Campix is the processor / service provider / agent (under PHIPA), processing Personal Information only on the documented instructions of Customer.

Customer is responsible for: (a) the lawfulness of the processing it instructs Campix to perform, (b) obtaining and recording any consents required from data subjects (including Quebec Law 25 §14 consent and COPPA verifiable parental consent for U.S. children under 13), (c) accuracy and minimization of the data it submits, and (d) responding to data-subject rights requests as the data controller. Campix supports Customer's response by providing the data-export and deletion tooling described in §6.

3. Scope and instructions

Campix processes Personal Information only to: (a) provide and maintain the Service per the Terms of Service, (b) prevent or address service or technical issues, (c) comply with Customer's documented instructions issued through the Service's configuration surfaces (settings, API calls, support tickets), and (d) comply with applicable law. Campix will inform Customer if it believes a Customer instruction violates Applicable Privacy Laws.

Campix will not sell Personal Information, will not use it for cross-context behavioural advertising, and will not use it to train AI models other than as required to provide the CampMate feature on Customer's own data when that feature is enabled.

4. Sub-processors

Customer authorizes Campix to engage the sub-processors listed at /sub-processors as of the date of this DPA. Campix will: (a) maintain the public sub-processor list, (b) impose on each sub-processor, by written contract, data-protection obligations at least as protective as those in this DPA, (c) remain liable for the acts and omissions of its sub-processors, and (d) provide reasonable advance notice of material additions or changes to the list.

Where Customer reasonably objects to a new sub-processor on documented data-protection grounds, Customer may suspend or terminate the affected portion of the Service before the sub-processor is activated, with a pro-rated refund for any pre-paid term remaining.

5. International transfers

Campix and its sub-processors may process Personal Information outside Canada (typically in the United States). Campix relies on the contractual safeguards listed in Privacy Policy §10, Standard Contractual Clauses, the EU-US Data Privacy Framework where applicable, and Zero-Data-Retention contracts with AI sub-processors where contractually offered.

Customer agrees that the sub-processor list at /sub-processors is the operative cross-border-transfer notice required by Quebec Law 25 §17 and equivalent provisions, and that Customer has obtained any additional consents from data subjects that its own jurisdiction may require for those transfers.

6. Data-subject rights and assistance

Campix will provide Customer with the technical tooling needed to respond to data-subject access, rectification, erasure, portability, and consent-withdrawal requests:

• Access / portability, every guardian portal includes a self-serve data-export function (/api/guardian/data-export); Customer admins can export per-camper data via the dashboard.
• Rectification, Customer admins can directly edit camper, guardian, and enrollment records via the dashboard.
• Erasure, soft-delete with anonymization on configurable retention, per the data-retention settings under Settings → Privacy & Security; immediate-erasure requests can be honored manually within 30 days of receipt.
• Consent withdrawal, every non-transactional email carries an unsubscribe link tied to bk_email_preferences; explicit opt-out is honored per CASL §11 within 10 business days.

Where Campix receives a data-subject request directly, Campix will not respond on the merits and will forward the request to Customer for action, unless legally required to respond directly (e.g. by a regulator-issued order).

7. Security

Campix maintains the technical and organizational safeguards described in Privacy Policy §5. These include, without limitation, TLS in transit, AES-256 encryption at rest, multi-tenant Row Level Security isolation enforced at the database, audit logging on every privileged mutation, EXIF stripping on image uploads, PII scrubbing on observability payloads, plan-tier gating on financial and reporting surfaces, and per-org Stripe Connect routing so Customer payouts never co-mingle with Campix funds. A summary of Campix's privacy impact assessment, which describes these safeguards, is available on request at legal@campix.io.

Customer is responsible for: (a) keeping its own admin credentials secret, (b) configuring data-retention settings appropriate to its regulatory environment, (c) enabling MFA on owner / admin accounts as it becomes available, and (d) revoking access for staff who leave the organization.

8. Personnel and confidentiality

Campix limits access to Personal Information to its personnel who need it to deliver the Service. All personnel with such access are bound by written confidentiality obligations, are informed of the confidential nature of the data, and are trained on Campix's privacy and security practices.

9. Breach notification

Campix will notify Customer without undue delay, in all cases within 72 hours of becoming aware, of any confirmed Breach of Security Safeguards (PIPEDA wording) / personal data breach (GDPR Art. 33) / confidentiality incident (ss. 3.5 to 3.8 of the Quebec Act respecting the protection of personal information in the private sector) affecting Customer's data. The notice will include, to the extent then known: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and the measures taken to address the breach. A summary of Campix's incident response procedure is available on request at legal@campix.io.

Customer remains responsible for any direct notification it must provide to its own data subjects or to regulators based on its own assessment of harm. Campix will reasonably cooperate with Customer's notification effort.

10. Audits and information requests

On reasonable written request and not more than once per twelve-month period (except in the event of a confirmed breach or regulator order), Campix will provide Customer with: (a) the most recent version of this DPA, (b) the current sub-processor list, (c) the current Privacy Impact Assessment summary, (d) the most recent third-party security attestations available to Campix from its core sub-processors (Supabase, Stripe, Vercel), and (e) reasonable written responses to security-questionnaire items. Direct on-site audits are not generally available given Campix's SaaS architecture; Customers with regulatory obligations that require deeper inspection should contact legal@campix.io to discuss alternatives.

11. Term and deletion at termination

This DPA continues for as long as Campix processes Personal Information on Customer's behalf. On termination of the underlying agreement, Campix will, at Customer's direction, return or delete all Personal Information held on Customer's behalf within 90 days, except where the law requires it to be kept. For example, Campix keeps financial records for 7 years, which covers the CRA requirement to keep them for 6 years from the end of the tax year to which they relate, and keeps audit logs for the retention period set in Customer's settings. Backups are purged on the standard backup-rotation cycle.

12. Liability

Each party's liability under this DPA is subject to the limitation-of-liability provisions of the underlying Terms of Service. Nothing in this DPA limits liability for which limitation is prohibited under Applicable Privacy Laws.

13. Order of precedence and governing law

In the event of conflict between this DPA and the Terms of Service or Privacy Policy on a data-processing matter, this DPA controls. This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, except where Applicable Privacy Laws of another jurisdiction mandatorily apply.

14. Contact

Questions about this DPA, sub-processor changes, audit requests, or breach-related matters: write to legal@campix.io with subject line "DPA, <your organization name>". Campix's designated Privacy Officer is reachable at privacy@campix.io.

Notice address: Campix Inc., Suite 1004, 2148 Carling Avenue, Unit #2, Ottawa, ON K2A 1H1, Canada.