Data Processing Addendum

1This addendum and the services agreement

In plain EnglishThis is the data protection part of your contract with Troy. If the rest of the contract disagrees with it about personal data, this part wins.

This Data Processing Addendum (the “Addendum”) forms part of the agreement between Troy Agency Inc., trading as Troy (“Troy”), and the client named in that agreement (the “Client”) for the supply of Troy’s services (the “Services Agreement”). It applies whenever Troy processes personal data on the Client’s behalf.

Troy is incorporating federally, under the Canada Business Corporations Act, with its registered office in Ontario. The registered office is Unit 6, 10651 Keele Street, Maple, Ontario L6A 3Y9, Canada. That incorporation has not completed: there is no corporation number yet, and until there is, Troy Agency Inc. is an intended name rather than a company. Nothing in this draft should be read as saying the company already exists or can already sign.

It covers every way the Client buys Troy, now or later: a free Troy Score, a Fix Sprint, a retainer with Troy’s team, and the Agents and Yourself tiers when they open. A Troy Score prepared before anything else is signed is covered from the moment the Client grants access to an account, because that is the moment personal data starts being processed.

On anything to do with personal data, this Addendum prevails over the rest of the Services Agreement. Everything else in the Services Agreement is unaffected. The full order of precedence is in clause 15.

Troy is established in Ontario, Canada. Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), therefore applies to Troy’s own handling of personal information in the course of commercial activity, and the regulator for that is the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority. Troy’s markets are Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. The live regimes are therefore PIPEDA and the provincial laws that may apply alongside it, together with the US state privacy laws that apply to a given client. PIPEDA sits alongside the obligations Troy takes on in this Addendum as a processor; it does not replace them, and this Addendum does not claim that Troy complies with any of them today. Where two regimes cover the same processing, the stricter requirement is the one Troy applies.

This Addendum starts on the date the Services Agreement starts, or on the day the Client first grants Troy access to an account if that is earlier. It lasts as long as Troy processes Client Personal Data. The clauses on confidentiality, deletion, audit, liability and precedence survive it.

2Definitions

In plain EnglishThe words below mean what they mean in the GDPR. They are defined once here so the rest of the document can be short.

Data Protection Law

Every privacy and data protection law that applies to the processing under this Addendum. That includes the UK GDPR and the Data Protection Act 2018; Regulation (EU) 2016/679 and the national laws made under it; the EU ePrivacy rules and the UK Privacy and Electronic Communications Regulations; Canada’s Personal Information Protection and Electronic Documents Act and Canada’s Anti-Spam Legislation, and the provincial laws that may apply in their place or alongside them, including Quebec’s Law 25 where the Client or the people the data is about are in Quebec — whether any of those provincial laws applies to a given engagement depends on the facts, and Troy has not assessed it; and the US state privacy laws that apply to the Client, including the California Consumer Privacy Act as amended. Where more than one applies to the same processing, the stricter requirement is the one used here.

Controller

The party that decides why and how personal data is processed. GDPR Article 4(7). US state laws call the same party a business.

Processor

A party that processes personal data on the Controller’s behalf and on its instructions. GDPR Article 4(8). California calls the same party a Service Provider.

Sub-processor

Anyone Troy engages to process Client Personal Data on Troy’s behalf: a hosting provider, a model provider, a form or email tool, a contractor who processes on their own systems, and a company in Troy’s own group that holds the data or can reach it. Lunari Group is a Sub-processor on that last basis — see clause 8.4. A platform the Client already uses, such as its ad, commerce or email platform, is not a Sub-processor of Troy. The Client’s relationship with that platform is its own.

Personal Data

Any information about an identified or identifiable living person. GDPR Article 4(1). It includes online identifiers, so a cookie ID, an advertising ID and a hashed email address all count.

Client Personal Data

Personal Data that Troy processes on the Client’s behalf under the Services Agreement, wherever it sits: inside a Connected Account, in a brief or document the Client sends, or in Troy’s own systems while the work is being done.

Processing

Anything done with Personal Data: reading it, collecting it, storing it, analysing it, putting it in a report, putting it in a prompt to a model, sharing it, deleting it. GDPR Article 4(2).

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data. GDPR Article 4(12). It covers losing data as well as leaking it.

Supervisory Authority

A public authority that enforces Data Protection Law, such as the Office of the Privacy Commissioner of Canada, the UK Information Commissioner or an EU member state’s data protection authority. Canadian law does not use the term, so where this Addendum says Supervisory Authority it means whichever of those regulators is the right one for the processing in question.

Standard Contractual Clauses

The clauses approved by the European Commission on 4 June 2021 for transfers of personal data to countries outside the EEA, in Commission Implementing Decision (EU) 2021/914, as they are amended or replaced.

UK Addendum

The International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as it is amended or replaced.

Connected Account

An advertising, commerce, analytics or email account that the Client connects to Troy, or grants Troy a user seat on, so that the work can be done. The account, the data in it and the access tokens that reach it belong to the Client.

Services

What Troy agrees to do in the Services Agreement: the Troy Score, a Fix Sprint, marketing run by Troy’s team, and the platform tiers when they open.

Data Subject

A living person the Personal Data is about. Under this Addendum that is almost always one of the Client’s customers, subscribers, prospects or staff.

A reference to an Article is to the UK GDPR and to the EU GDPR, which number these obligations the same way. Words like “including” do not limit what comes before them.

3Roles: who is the controller and who is the processor

In plain EnglishYour data stays yours. You decide what happens to it. Troy does what you have asked for and nothing else.

For Client Personal Data, the Client is the Controller and Troy is the Processor. Nothing in the Services Agreement makes Troy a Controller of that data. Troy does not use Client Personal Data to improve its own product: that would be a purpose of Troy’s own, and a processor that decides its own purpose becomes a controller for it. What Troy may and may not do with the data is in clause 5.1. Where the data physically sits, and who inside Lunari Group can reach it, is in clause 8.4 — read that clause before this one is relied on.

PIPEDA does not use the words controller and processor. It makes the organisation that has control of the personal information accountable for it, including while a third party processes it on that organisation’s behalf, and it expects that organisation to use contractual means to give the information a comparable level of protection while the third party holds it. Where PIPEDA applies to the Client, this Addendum is meant to be that contract. Whether it is enough for a particular engagement is a question for the Client’s own advisers, and nothing here is a legal opinion.

If the Client is itself a processor for someone else — an agency running accounts for its own client, for example — then Troy is a Sub-processor. The controller’s instructions reach Troy through the Client, the Client confirms it has the authority to give them, and this Addendum is read as if “Controller” meant that party.

4The processing, described

In plain EnglishThis is the annex: what data, whose, why, for how long, and where. If you only read one section, read this one.

Article 28(3) requires the contract to set out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject. This section is that description. It is also the description used by the Standard Contractual Clauses under clause 13.

5Processing only on documented instructions

In plain EnglishTroy only does what you have asked for in writing. Anything else needs a new instruction from you.

Troy processes Client Personal Data only on the Client’s documented instructions, including in relation to transfers out of Canada, and out of the UK or the EEA, unless a law Troy is subject to requires otherwise. Where such a law applies, Troy will tell the Client before processing, unless that law forbids it on important grounds of public interest.

The Client’s complete documented instructions are: the Services Agreement, this Addendum, the written brief and goals for the engagement, the access and approval settings the Client configures, and anything else the parties agree in writing. A request made in a call becomes an instruction once it has been written down and confirmed.

If Troy considers that an instruction infringes Data Protection Law, it will tell the Client without delay, and may pause that part of the work until the point is resolved. Troy may also refuse an instruction that would require it to process data it has said it does not want under clause 4.1.

6Confidentiality of the people who do the work

In plain EnglishOnly the people working on your account can see your data, and they are under a duty to keep it to themselves.

Troy ensures that every person authorised to process Client Personal Data is bound by a duty of confidentiality — in their employment or contractor terms, or by a separate written undertaking — and that the duty continues after their engagement with Troy ends.

Access is limited to the people who need it to do the work: the strategists on the account, an engineer investigating a fault, and the founder. Before anyone is given access they will be briefed on what this Addendum requires, and Troy will keep a record of who has access to which account.

That describes Troy’s own people. It does not describe everyone who can reach the data, because the data sits on systems Lunari Group runs and the companies in the group can see each other’s data. clause 8.4 says so in full, and this clause should not be read as narrowing it.

A contractor is engaged on the same confidentiality terms as an employee. A contractor who processes Client Personal Data on their own systems is also a Sub-processor and is named on the list under clause 8.2.

7Security measures

In plain EnglishTroy will describe the measures it actually has, and it will not claim a certification it has not earned.

Troy will take and maintain appropriate technical and organisational measures to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as Article 32 requires, taking into account the state of the art, the cost of implementation, and the risk to the people the data is about.

PIPEDA asks a similar question in different words: it requires safeguards appropriate to the sensitivity of the information, whoever is holding it. The measures below are written to the stricter of the two readings. They are undertakings either way, not a claim that any of them has been audited.

Troy will implement and maintain at least the following measures, and will describe what is actually in place — and what is not yet — in its security statement:

• Access on the principle of least privilege, reviewed when someone joins, changes role or leaves, and removed the same day someone leaves.
• Multi-factor authentication on every account that can reach Client Personal Data, including the platform connectors and the email accounts that receive client material.
• Encryption in transit for data moving between Troy, the Client and the platforms, and encryption at rest for data Troy stores.
• Separation between clients, so that one client’s account data cannot be read from another client’s workspace.
• Tokens, secrets and API credentials held in a managed secret store — never in code, a spreadsheet, a message or a shared document.
• Logging of access to Client Personal Data, and the permanent change log described in clause 4.2.
• Backups, and a written procedure for restoring from them that has been tested.
• A written incident procedure: who decides that something is a Personal Data Breach, who tells the Client, and what goes in the notice.
• A device policy for any laptop used for client work: full-disk encryption, automatic locking, and the ability to wipe it remotely.
• Vetting of anyone given access, proportionate to what that access reaches.

Where one of these measures is not yet in place on the day the Services Agreement is signed, Troy will say so in writing before the Client connects an account. Troy may change a measure, and will not reduce the overall level of protection when it does.

Troy’s own systems run on Vercel Inc., which is a Sub-processor and is named on the published list under clause 8.2. It deploys to Vercel's Washington, D.C. region (iad1), in the United States, so the data is held in the United States; clause 13 deals with what that means.

One thing in this section is a fact rather than a measure, and it cuts against the separation described above. Troy, Louin and Lunari Group share systems and data. Client data is held on systems Lunari Group runs, and the companies in the group can see each other's data. Troy cannot describe its security position honestly without saying so, and clause 8.4 sets out what follows from it.

8Sub-processors

In plain EnglishTroy can use other companies to help. They are on a public list, they are bound by these same terms, and you are told before a new one starts.

The Client gives Troy a general written authorisation to engage Sub-processors, on the terms in this section. Article 28(2) allows this, provided the Client is told about changes and can object to them.

9Helping with requests from data subjects

In plain EnglishIf one of your customers asks to see or delete their data, Troy helps you answer. Troy will not answer for you.

Data Subjects exercise their rights against the Client, because the Client is the Controller. If a Data Subject contacts Troy directly about Client Personal Data, Troy will not respond on the substance. It will tell them to contact the Client, and tell the Client without undue delay.

Troy will help the Client meet a request, by appropriate technical and organisational measures, taking into account the nature of the processing and the information available to Troy. In practice that means finding the data inside a Connected Account, exporting it in a usable form, correcting it, deleting it, restricting its processing, or confirming what an opt-out has done — as far as the platform holding it allows. Because Client Personal Data sits on systems Lunari Group runs, a search or a deletion under this clause covers those systems too.

Which rights a person has depends on where they live. A person in the UK or the EEA has the rights in Articles 15 to 22: access, rectification, erasure, restriction, portability, objection, and rights about automated decisions. A person in Canada has a right under PIPEDA to be told whether an organisation holds personal information about them and to be given access to it, and to challenge its accuracy and have it corrected; the right to have it deleted is narrower than the GDPR’s, and some provincial laws go further than PIPEDA does. A California resident has rights to know, delete and correct, to limit the use of sensitive personal information, to opt out of sale and sharing, and not to be discriminated against for using them. A person elsewhere may have fewer rights, or none. Troy will apply the same process to every request it is asked to help with, whichever law it falls under.

Some of the data lives in platforms that neither party controls, and Troy’s help is limited by what those platforms allow. Where something cannot be deleted — an audience already built, a log the platform keeps for its own purposes — Troy will say so plainly rather than report a deletion that did not happen. This Addendum sets no response time for that help: Troy has not measured how long it takes and will not publish a number it cannot stand behind.

This help is included in the fees for the Services. Where a request is repetitive, or so large that it becomes a project of its own, Troy may charge for the work, and will agree the charge with the Client in writing before starting it.

10Breaches, impact assessments and other assistance

In plain EnglishIf something goes wrong with your data, Troy tells you quickly with what it knows — not a tidy story a week later.

This section covers the assistance Articles 32 to 36 require a processor to give: security, breach notification, impact assessments and prior consultation.

11Return or deletion at the end

In plain EnglishWhen the work ends, Troy stops reading your accounts and deletes what it holds. You can ask for it back first. If you say nothing, Troy deletes.

At the end of the Services, the Client chooses whether Troy returns Client Personal Data or deletes it, and tells Troy in writing. If the Client says nothing within a reasonable time after the end, Troy deletes.

Return means a copy, in a common machine-readable format, of the Client Personal Data Troy holds outside the Client’s own accounts: reports, exports, working files, briefs and the change log. Data that never left the Client’s own Connected Accounts does not need returning — the Client already has it.

Access ends first. On the last day of the engagement, or sooner if the Client revokes it, Troy stops using the Client’s tokens and user seats and removes them from its systems. The Client should also revoke them at each platform, which is the only step that is fully within the Client’s control. Troy will confirm in writing when its side is done.

Data read from a Connected Account and held by Troy is deleted within 30 days of the account being disconnected or the engagement ending, whichever is first (a proposed default, not yet approved)?. Records Troy keeps as a Controller — the contract, invoices and correspondence — are kept for 7 years after the engagement ends (a proposed default, not yet approved)?, and enquiries that never became an engagement are kept for 24 months from your last contact with us, unless you ask us to delete it sooner (a proposed default, not yet approved)?. Server and access logs are kept for 90 days (a proposed default, not yet approved)?. The record of which work was made with AI, and the change log behind it, is kept for as long as the client record, so a question about a piece of work can always be answered (a proposed default, not yet approved)?. Data inside a backup is deleted on that backup’s own cycle, and stays protected by this Addendum until it is gone.

Deletion means deletion from the systems Lunari Group runs as well, because that is where the data sits. A confirmation of deletion under this clause covers those systems, and Troy will not confirm a deletion it has only done on its own side.

The reason the contract records outlive the account data is that a claim can be brought long after the work ends. In Ontario the basic limitation period is two years from the day a claim is discovered, with an ultimate period of fifteen years from the act complained of, and tax and corporate records carry their own minimums. Which period applies to a particular claim, and whether another province’s or another country’s law applies instead, depends on the facts. The periods above are working defaults, not a considered answer to that question.

Troy may keep a copy only where a law it is subject to requires it. If that happens, Troy will tell the Client what it has kept and why, will keep processing it only for that purpose, and will keep it protected by this Addendum for as long as it holds it.

Troy will confirm deletion in writing when the Client asks for confirmation.

12Audits and information

In plain EnglishYou can check that Troy does what it says. Troy would rather send the evidence than host a visit, and for a company this small that is also the honest answer.

Troy will make available to the Client all information necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, carried out by the Client or an auditor it appoints.

Troy will answer first with information, because that answers most questions faster than a visit. On request, and in a reasonable time, Troy will provide:

• A written answer to the Client’s security and data protection questionnaire.
• The current list of Sub-processors, with what each does and where it processes.
• A description of the technical and organisational measures actually in place on the date of the request, marked where a measure is intended rather than implemented.
• The Client’s own access log and change log.
• Any audit report or certification Troy holds. Troy holds none today, and will say that rather than send something that looks like one.

If that does not answer the Client’s question, the Client may audit Troy directly, on these conditions: reasonable written notice; during business hours; without unreasonable disruption to Troy’s other work; under an obligation of confidentiality; and not carried out by a competitor of Troy.

An audit may take place once in any 12 months, and again after a personal data breach, at the client's own cost unless the audit finds a material failure (a proposed default, not yet approved)?, and in addition whenever Data Protection Law or a Supervisory Authority requires it. Where an audit goes beyond one working day, Troy may charge for the additional work, at a price agreed in writing before that audit starts.

An audit does not entitle the Client to another client’s data, to Troy’s own commercially sensitive information, or to anything that would put Troy in breach of a duty owed to someone else. Where the Client wants to audit a Sub-processor, it asks Troy, and Troy will pass the request on and give the Client what it receives. Lunari Group is the Sub-processor most likely to be asked about, because the data is held on its systems.

13International transfers

In plain EnglishTroy is Canadian. Its systems are not: the site and the data run on Vercel in Washington, D.C. So a Canadian client’s data leaves Canada and is stored in the United States, under US law. That is worth knowing before you connect an account.

Start with the fact rather than the law. Troy is established in Ontario, Canada, and its systems run on Vercel Inc. in Vercel's Washington, D.C. region (iad1), in the United States. Client Personal Data that reaches Troy is therefore stored and processed in the United States, whichever country it came from, and it is subject to the law of that country while it is there — including the access powers of US authorities. A Canadian client’s data leaves Canada. Troy would rather say that plainly than leave it to be discovered in an annex.

Client Personal Data also sits on systems Lunari Group runs, and Troy will not assert a country for those systems in this draft until it has confirmed where they are. See clause 8.4.

PIPEDA does not forbid any of this. It does not require personal information to stay in Canada. What it does is hold the organisation that controls the information accountable for using contractual means to give it comparable protection wherever it is processed, and the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority expects people to be told that their information may be handled in another country and be subject to that country’s law. Where the Client is the organisation in control, that notice is the Client’s to give; this Addendum is offered as part of the contractual means. Some provincial public-sector and health privacy laws restrict where information may go, and this draft does not assess whether any of them applies to a given engagement.

The mechanism relied on for transfers that need one is the Standard Contractual Clauses, with the UK Addendum where the United Kingdom is involved, entered into through each supplier's own data processing agreement (a proposed default, not yet approved)?. Troy will not transfer Client Personal Data out of a territory whose law restricts the transfer, and will not allow a Sub-processor to, unless a valid mechanism covers it. Troy will not rely on a mechanism it has not checked applies.

Canada’s adequacy recognition does not do the work here, and this draft does not assert that it does. The European Commission’s decision covers Canadian organisations subject to PIPEDA, and only personal data processed in the course of commercial activity; the United Kingdom recognises Canada on a similar footing. Both are reviewed periodically and either can be narrowed or withdrawn. More to the point, the data does not stay in Canada: it lands in the United States, so a transfer from the EEA or the UK would have to be justified to that destination rather than to this one. Troy’s markets are Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. No such transfer arises today, and the clause is here for the day one does.

Where the Standard Contractual Clauses are needed — for a transfer from the EEA or the UK to Troy’s systems in the United States, or to a Sub-processor sitting outside a country the relevant regime treats as adequate — they are incorporated into this Addendum and their annexes are completed from it: the parties are the Client and Troy, the description of the processing is clause 4, the technical and organisational measures are those in clause 7, and the Sub-processors are those on the published list. Module Two applies where the Client is the Controller and Troy the Processor, and Module Three where the Client is itself a processor and Troy its sub-processor. The Client authorises Troy to enter into the Clauses with a Sub-processor on the Client’s behalf.

Troy will assess the risk of a transfer before relying on the Clauses for a new destination, and will tell the Client if it concludes that the Clauses alone are not enough for that destination. If a mechanism is invalidated or withdrawn, the parties will work in good faith to put a valid one in place, and Troy will suspend the transfer in the meantime where there is no lawful way to continue.

14Liability

In plain EnglishThe limits in your main contract apply here too. Some things the law does not allow a contract to limit.

Each party’s liability under this Addendum is subject to the limitations and exclusions in the Services Agreement. The two documents share one cap between them: this Addendum does not create a second one, and a claim under it counts against the same limit.

Nothing in this Addendum or in the Services Agreement excludes or limits either party’s liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for anything else the law applying to that party does not allow to be excluded or limited. A cap that tried to cover those would not survive review, so this one does not try.

What a contract may not exclude differs by province and by state. Ontario’s consumer protection legislation and its equivalents elsewhere restrict contracting out of certain terms, and some of those restrictions depend on who the client is rather than on what the contract says. This clause therefore defers to whichever rule applies instead of listing them, and neither party should read it as a statement that a particular exclusion holds up where they are.

Nothing in this Addendum limits a Data Subject’s rights, or either party’s liability to a Data Subject or to a Supervisory Authority. Article 82 makes a processor liable directly to a Data Subject in some cases, and a contract between Troy and the Client cannot sign that away.

Where both parties are responsible for the same damage, each is responsible for its share. A party that has paid more than its share may recover the difference from the other.

Troy holds no professional indemnity and no cyber insurance. This Addendum therefore promises none, and no reader should assume that a claim under it would be met by an insurer. A client that needs cover behind this contract should ask for it before signing rather than after; if Troy takes out cover, this clause will say so and say what it covers.

The liability cap itself is in the Services Agreement, not here. Ontario’s basic limitation period is two years from the day a claim is discovered, so a claim under this Addendum can be brought well after the work ends; the record-keeping periods in clause 11 are set with that in mind. Which limitation period applies to a particular claim, and under which province’s or country’s law, depends on the facts.

15Conflicts, changes and governing law

In plain EnglishIf two documents disagree about personal data, this one wins — unless the standard clauses say otherwise, because they outrank everything.

Where there is a conflict about personal data, the order of precedence is:

1. The Standard Contractual Clauses or the UK Addendum, where they apply, on anything they cover.
2. This Addendum.
3. The Services Agreement.
4. Any order form, statement of work or brief.
5. Anything else, including any page on troy-agency.com.

A term in the Client’s own purchase order, supplier portal or standard terms does not change this Addendum unless Troy agrees to it in writing and names it.

Troy may update this Addendum where Data Protection Law changes, or where a transfer mechanism is replaced, on written notice to the Client and only in a way that does not reduce the protection the Client has. Any other change needs both parties to agree in writing. If a clause is held invalid, the rest stands.

This Addendum is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in it, and the courts identified in the Services Agreement have jurisdiction: the courts of the Province of Ontario. Where the Standard Contractual Clauses apply, they carry their own governing law and choice of forum, and those govern the Clauses.

Notices under this Addendum go to troy@louin.io, and to the Client’s contact point named in the Services Agreement. A notice about a Personal Data Breach may also be given by any faster means, and confirmed in writing afterwards.

16This text is a draft

In plain EnglishNo lawyer has read this. Do not sign it as it stands, and do not rely on it as though it were signed.

This is a working draft, written alongside Troy’s website so that the company’s position on data protection is written down before it has clients rather than after. It has not been reviewed by a lawyer. It is not an offer, and on its own it binds nobody.

Where a fact is not settled, this draft shows a blank and the question behind it instead of a plausible answer. Where a conventional default has been written in so the document can be read end to end, the page marks it as a proposal nobody at Troy has approved. Both are deliberate. An invented retention period, hosting location or security certification in a public document is a worse problem than an obvious gap, because a regulator treats the first as a statement the company has to live up to.

The version signed by both parties governs the relationship between them. If the signed version and this page ever disagree, the signed version wins and this page will be corrected.