Data Processing Addendum
Effective date: [EFFECTIVE DATE]
This Data Processing Addendum ("DPA") supplements the Terms of Service (the "Terms") between [COMPANY LEGAL NAME], located at [BUSINESS ADDRESS] ("Canopy Ledger," "we," "us," or "our"), and the customer that has agreed to the Terms ("Customer," "you," or "your"). It applies when we process personal information contained in Customer Data on your behalf, as described in Terms §5.5 and Section 1 of our Privacy Policy. Capitalized terms not defined here (such as "Service," "Customer Data," "Customer Scripts," "Users," and "Order") have the meanings in the Terms.
If this DPA conflicts with the Terms, this DPA controls only for the processing of Customer Personal Data. All other terms, including the cannabis-specific terms in Terms §8, the disclaimers in Terms §12, and the limitation of liability in Terms §13, continue to apply.
Plain-English summary (not a substitute for the DPA below): You control the personal information in your Canopy Ledger records, and we process it only to run the Service for you. We use a short list of vendors (see Subprocessors), we'll tell you before we add one, and we'll tell you without undue delay if a security breach affects your data. We are not connected to METRC or any state system, so nothing in this DPA means we report anything to a regulator for you.
1. Definitions
- "Customer Personal Data" means personal information or personal data contained in Customer Data that we process on your behalf in providing the Service.
- "Data Protection Laws" means the privacy and data protection laws that apply to our processing of Customer Personal Data. Depending on the circumstances, these may include the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), other U.S. state privacy laws, the EU General Data Protection Regulation ("GDPR"), and the UK GDPR.
- "Security Breach" means a breach of security that leads to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data in systems we or our Subprocessors control. It does not include unsuccessful attempts that do not compromise Customer Personal Data, such as failed logins, pings, or port scans.
- "Subprocessor" means a third party we engage that processes Customer Personal Data.
- "Controller," "processor," "business," "service provider," "data subject," and "processing" have the meanings given in the applicable Data Protection Laws.
2. Roles and Scope
2.1 Roles. You are the business or controller of Customer Personal Data. We are your service provider or processor. If you process Customer Personal Data on behalf of another controller, you confirm that your instructions to us are authorized by that controller.
2.2 Details of processing. Annex 1 describes the subject matter, nature, purpose, and duration of the processing, and the types of personal information and people involved.
2.3 Your responsibilities. You are responsible for:
- having a lawful basis for the Customer Personal Data you enter, and for giving any notices and getting any consents required by law;
- the accuracy of Customer Personal Data, and the logic and results of any Customer Scripts that create, change, or delete it (see Terms §7); and
- not entering sensitive information the Service is not designed for, such as medical-cannabis patient records, health information, government ID numbers, or full payment card numbers, unless we agree to it in a signed Order.
2.4 No regulatory reporting. The Service is not connected to METRC or any state track-and-trace or regulatory system (Terms §2.2). Nothing in this DPA makes us responsible for reporting, filing, or reconciling any data with a regulator (Terms §8.4).
3. Processing Instructions
3.1 Instructions. We will process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, any Order, and your configuration and use of the Service (including your Customer Scripts and custom fields). We may also process Customer Personal Data where the law requires it; if so, we will tell you first unless the law prohibits it.
3.2 Unlawful instructions. We will tell you if we believe an instruction violates Data Protection Laws. We are not required to carry out that instruction.
4. CCPA/CPRA Service Provider Terms
To the extent the CCPA/CPRA applies, we will not:
- sell or share Customer Personal Data (as "sell" and "share" are defined in the CCPA/CPRA);
- retain, use, or disclose Customer Personal Data for any purpose other than the business purposes set out in the Terms and this DPA, including for any commercial purpose other than providing the Service;
- retain, use, or disclose Customer Personal Data outside our direct business relationship with you; or
- combine Customer Personal Data with personal information we receive from other sources or collect ourselves, except as the CCPA/CPRA permits.
We will comply with the CCPA/CPRA obligations that apply to service providers, give Customer Personal Data the level of protection the law requires, and tell you if we can no longer meet these obligations. You may take reasonable and appropriate steps to stop and fix any unauthorized use of Customer Personal Data. We certify that we understand and will comply with these restrictions.
5. Our Personnel
We will make sure that anyone we authorize to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide, support, maintain, or secure the Service, or as required by law, consistent with our Security page.
6. Subprocessors
6.1 Authorization. You authorize us to use the Subprocessors listed on our Subprocessors page, which matches the list in Section 5 of our Privacy Policy.
6.2 Subprocessor obligations. We will have a written agreement with each Subprocessor that requires it to protect Customer Personal Data in a manner appropriate to the services it provides. We remain responsible for our Subprocessors' performance of their obligations as described in this DPA.
6.3 New Subprocessors. We will update the Subprocessors page at least [SUBPROCESSOR NOTICE PERIOD, e.g., 30] days before a new Subprocessor begins processing Customer Personal Data. You can ask to receive these notices by email by writing to [CONTACT EMAIL].
6.4 Objections. You may object to a new Subprocessor on reasonable data protection grounds by emailing [CONTACT EMAIL] during the notice period. We will discuss your concerns in good faith. If we cannot resolve them, you may terminate the affected subscription before the new Subprocessor is used, and we will refund any prepaid fees for the unused portion of the term. This is your only remedy for an objection.
7. Security
7.1 Our measures. We will maintain reasonable administrative, technical, and organizational measures designed to protect Customer Personal Data, taking into account the nature of the processing and the risks involved. Annex 2 summarizes our current measures. We may change them over time, but we will not make changes that materially reduce the overall protection of Customer Personal Data.
7.2 No certifications. We do not currently hold SOC 2, ISO 27001, or any other third-party security certification or attestation. Certifications held by our Subprocessors apply to their services, not to Canopy Ledger.
7.3 Your measures. You are responsible for using the Service securely, including telling us who should have access to your deployment and when to remove someone (the Service does not yet have individual logins), and testing Customer Scripts before you rely on them.
8. Security Breach Notification
8.1 Notice. We will notify you without undue delay, and in any event within [BREACH NOTICE PERIOD, e.g., 72 hours], after we become aware of a Security Breach.
8.2 Contents. Our notice will describe, to the extent we know at the time: what happened; the types and approximate amount of Customer Personal Data and number of people affected; the likely consequences; and what we have done or plan to do about it. We will send updates as we learn more.
8.3 Response. We will take reasonable steps to contain and investigate the Security Breach and reduce its effects, and we will reasonably help you meet any obligation you have to notify regulators or affected individuals. Unless the law requires otherwise, we will not notify affected individuals or regulators about Customer Personal Data on your behalf without your approval.
8.4 How we notify you. We will send notice by email to the account owner and to any security contact you give us. Please keep these contacts current.
8.5 No admission. Notifying you of a Security Breach is not an admission of fault or liability.
9. Assistance
9.1 Individual requests. If we receive a request from an individual about Customer Personal Data, we will direct them to you and will not respond ourselves unless the law requires it. Taking into account the nature of the processing, we will provide reasonable help, including through the Service's export and editing features, so you can respond to requests to access, correct, delete, or port personal information.
9.2 Assessments. We will provide reasonable information to help you complete any data protection impact assessment or consultation with a regulator that Data Protection Laws require of you in connection with the Service.
10. Audits and Information Requests
10.1 Information. Once a year, or after a Security Breach, you may ask us in writing for information reasonably needed to show that we comply with this DPA. We will answer a reasonable security questionnaire and provide summaries of relevant practices.
10.2 Audits. If that information is not enough to meet a requirement of Data Protection Laws, you may conduct an audit at your own expense, with at least [AUDIT NOTICE PERIOD, e.g., 30] days' written notice, during normal business hours, under confidentiality obligations, and in a way that does not unreasonably disrupt our operations or expose other people's data. Audits of our Subprocessors are limited to the reports and information they make available.
11. Government and Law Enforcement Requests
Consistent with Terms §5.6, if we receive a subpoena, warrant, court order, or other demand from a government authority (federal, state, or local) for Customer Personal Data, we will:
- try to redirect the authority to request the data from you directly;
- where legally permitted, notify you promptly and give you a reasonable opportunity to seek a protective order or other remedy;
- challenge demands we reasonably believe are unlawful or overbroad; and
- disclose only the minimum Customer Personal Data needed to comply with a valid, legally binding demand.
12. International Transfers
12.1 Location. We and our Subprocessors store and process Customer Personal Data primarily in the United States, as listed on our Subprocessors page. Our hosting provider's edge network may route traffic through other countries.
12.2 Transfer safeguards. If Customer Personal Data subject to the GDPR, UK GDPR, or Swiss law is transferred to the United States or another country without an adequacy decision, the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module Two (controller to processor) and, where applicable, Module Three (processor to processor)), together with the UK International Data Transfer Addendum and any required Swiss amendments, are incorporated into this DPA. Annexes 1 and 2 of this DPA complete the appendices to those clauses, Clause 9 Option 2 (general authorization) applies with the notice period in Section 6.3, and Clauses 17 and 18 are governed by the laws and courts of [EU MEMBER STATE FOR SCCs, e.g., Ireland]. [Confirm with counsel whether this section is needed, given that the Service is designed for U.S. state-licensed businesses.]
13. Return and Deletion
13.1 Export. During your subscription, you can export Customer Data using the Service's export features. For [DATA EXPORT WINDOW, e.g., 30] days after your subscription ends, we will make Customer Data available for export on request, as described in Terms §15.5.
13.2 Deletion. After the export window ends, we will delete Customer Personal Data from our active systems within a reasonable time. Copies in backups maintained by our database provider will be deleted as those backups expire in the provider's normal backup cycle. Until then, they remain protected by this DPA. We may keep Customer Personal Data longer only if the law requires it.
13.3 Your records. You are solely responsible for exporting and keeping any records you are legally required to retain, including records required by cannabis regulations. The Service is not an archive for regulatory record-keeping (Terms §8.6).
14. Liability and Term
14.1 Liability. Each party's liability under this DPA is subject to the exclusions and limitations of liability in Terms §13.
14.2 Term. This DPA remains in effect while we process Customer Personal Data on your behalf, including during the export and deletion periods in Section 13.
14.3 Governing law. Except as stated in Section 12.2, this DPA is governed by the law and venue provisions in Terms §17.
Annex 1: Details of Processing
| Item | Description |
|---|---|
| Subject matter | Providing the Canopy Ledger Service under the Terms. |
| Nature of processing | Hosting, storing, organizing, retrieving, displaying, calculating (including running Customer Scripts and custom fields), transmitting, exporting, and deleting data, as needed to provide the Service. |
| Purpose | Providing, supporting, maintaining, and securing the Service for Customer. |
| Duration | The subscription term, plus the export and deletion periods in Section 13. |
| People whose data is processed | Customer's Users (employees and contractors), and any other individuals whose information Customer chooses to record, such as buyers, vendors, drivers, or other business contacts. |
| Types of personal information | Names; business contact details (email, phone, business address); employee names, email addresses, and roles entered in the Service; the operator name recorded on changes (for example, who created or changed a plant, batch, package lot, tag, or sale); driver, vehicle, and carrier details entered on shipments; IP addresses and browser information in our hosting provider's request logs; and any other information Customer enters in records, custom fields, or Customer Scripts. |
| Sensitive information | None intended. Customer will not enter medical-cannabis patient records, health information, government ID numbers, or full payment card numbers unless agreed in a signed Order. |
| Frequency | Continuous during the subscription term. |
| Subprocessors | As listed on our Subprocessors page. |
Annex 2: Technical and Organizational Measures
This summary reflects the Service as it operates today. It is consistent with our Security page. We will update it as our measures change.
| Area | Current measures |
|---|---|
| Encryption in transit | Connections to the Service use HTTPS (TLS), as provided by our hosting provider's default configuration. Connections between our application and our database are encrypted in transit. |
| Encryption at rest | Data stored in our database is encrypted at rest using our database provider's default encryption. |
| Deployment model | The Service currently runs as a single-customer deployment. [UPDATE THIS ROW, AND THE SECURITY PAGE, BEFORE SERVING MORE THAN ONE CUSTOMER FROM THE SAME DEPLOYMENT.] |
| User access | The Service does not yet have individual user accounts. Access to the deployment is restricted at the hosting layer (Vercel Deployment Protection). In-app roles control which menus people see; they are not a security boundary. [UPDATE THIS ROW, AND THE SECURITY PAGE, WHEN PER-USER SIGN-IN SHIPS.] |
| Internal access | Our team's access to production systems and Customer Data is limited to people who need it to operate, support, or secure the Service. |
| Customer Scripts | Customer Scripts run in a separate V8 isolate (using the isolated-vm library) with a 32 MB memory limit, a 1-second execution limit (with a 1.5-second hard stop), and a 20,000-character source limit. Scripts have no direct access to the file system, network, or server modules, but they can read and change Customer Data through the script interface. The isolation is not a guaranteed security boundary, so only trusted Customer staff should write scripts. We may suspend a script that threatens the security or stability of the Service (Terms §7.4). |
| Backups | We rely on our database provider's built-in backup and point-in-time recovery features, with a restore window of [RESTORE WINDOW] on our current plan. Backups are stored with that provider in the United States. |
| Incident response | If we become aware of a Security Breach, we investigate, contain it, and notify you as described in Section 8. |
| Vendors | We use the limited set of Subprocessors listed on our Subprocessors page, under written terms. |
| Certifications | None. See Section 7.2. |
Signatures (only if Customer requires a signed copy)
| [COMPANY LEGAL NAME] | Customer |
|---|---|
| Name: | Name: |
| Title: | Title: |
| Date: | Date: |