Last updated: 6 November 2026

Data processing agreement (DPA)

The contractual framework for SignalOrange's processing of personal information on the Client's behalf.

This is an English translation of the French document. If the two versions differ, the French version prevails.

Who it applies to: this Agreement applies automatically to any Client that uses our Services to process personal information about other people (employees, clients, prospects, etc.). It is deemed accepted when the Client subscribes to the Services and forms an integral part of the Terms of use.

1. Definitions

  • Client / Controller : the legal or natural person that subscribed to the Services and determines the purposes and means of the processing.
  • SignalOrange / Processor : SignalOrange Inc., processing Personal data on the Client's behalf.
  • Personal data : any information about an identified or identifiable natural person, processed by SignalOrange in connection with the Services.
  • Applicable laws : the federal PIPEDA, Quebec's Law 25, and any other applicable provincial or federal law on the protection of personal information.
  • Breach : any confidentiality incident within the meaning of Law 25 (unauthorized access, use, disclosure or loss).
  • Subprocessor : a third party engaged by SignalOrange to process Personal data on the Client's behalf.

2. Purpose and scope

This Agreement governs SignalOrange's processing of Personal data provided by the Client or generated in connection with the Services (Meridian, Router and Estrade). It applies for the whole term of the Services and survives for the purposes set out in section 11.

3. Roles and responsibilities

  • The Client acts as controller: it decides which Personal data is processed and for what purposes, and obtains the required consents from the people concerned.
  • SignalOrange acts as processor: it processes Personal data only on the Client's documented instructions, in accordance with this Agreement.
  • Each party remains responsible for complying with the Applicable laws for the matters that concern it.

4. Nature, duration and purpose of the processing

SignalOrange processes Personal data only to provide, maintain, secure and improve the Services, and in accordance with the Client's instructions.

  • Nature: storage, organization, consultation, use, disclosure by transmission, dissemination, matching, restriction, erasure.
  • Duration: for the whole term of the Services, plus the retention periods set out in the Terms of use.
  • Purpose: performing the Services the Client subscribed to.

5. Categories of Personal data and of people concerned

Depending on how the Client uses the Services, the following categories may be processed:

  • Identity: name, email address, phone number, title, organization.
  • Professional: communication history, business interactions, proposals, invoices, contracts.
  • Financial: amounts invoiced, payment history (no card data).
  • Technical: IP address, user agent, access logs.
  • Content: any content the Client uploads, enters or generates in the Services.

People concerned: the Client's prospects, clients, partners, suppliers and employees, and any other person whose Personal data is processed in the Services.

6. SignalOrange's obligations

SignalOrange agrees to:

  • Process Personal data only on the Client's documented instructions (subscribing to the Services is a general instruction).
  • Ensure that the people authorized to process Personal data are bound by confidentiality (by contract or by law).
  • Take all the security measures described on our Security page, including encryption, access control, logging and training.
  • Help the Client answer requests from people concerned who exercise their rights (access, correction, deletion, portability).
  • Help the Client meet its obligations for privacy impact assessments, breach notification and consultation of the supervisory authority.
  • At the end of the Services, delete or return all Personal data to the Client, as the Client chooses, subject to legal retention obligations.
  • Make available to the Client all the information needed to show that these obligations are met.

7. Subprocessors

The Client authorizes SignalOrange to engage the subprocessors listed below. SignalOrange will impose on each subprocessor obligations substantially equivalent to those in this Agreement and remains fully responsible to the Client for their performance.

7.1 Current list of subprocessors

  • OVH Canada — Hosting (Beauharnois, Quebec, Canada).
  • Stripe — Payment processing (Canada and United States). PCI DSS Level 1.
  • Anthropic, PBC — Claude AI models (United States). Zero-retention agreement. Reachable only through Router with Guard turned on.
  • OpenAI, LLC — GPT AI models (United States). Zero-retention agreement. Reachable only through Router with Guard turned on.
  • Google LLC — Gemini AI models (United States / EU). Reachable only through Router with Guard turned on.

7.2 Changes

SignalOrange will notify the Client at least 30 days before adding or replacing a subprocessor that processes Personal data. The Client may object to a new subprocessor on reasonable grounds related to the protection of Personal data; if it does, the parties will work together in good faith to find a solution, failing which the Client may terminate the affected Services without penalty.

8. Transfers outside Quebec and Canada

Some subprocessors (in particular the AI providers) may process Personal data outside Quebec and outside Canada, mainly in the United States and the European Union.

As required by Law 25, SignalOrange carries out a privacy impact assessment before any transfer outside Quebec, covering in particular:

  • The personal information involved and how sensitive it is.
  • The purpose of the transfer.
  • The legal framework at the destination.
  • The contractual and technical safeguards (protection clauses, encryption, Guard, zero retention).

The assessments are documented and available on the Client's reasonable written request.

9. Breach notification

SignalOrange will notify the Client without undue delay, and in any case within 72 hours of confirming a Breach involving the Client's Personal data. The notification will include:

  • The nature of the breach, and the categories and approximate number of people concerned.
  • The likely consequences.
  • The measures taken or proposed to remedy it and limit its effects.
  • The contact point for more information.

As controller, the Client is responsible for notifying the supervisory authority (the CAI in Quebec, or another) and the people concerned under the Applicable laws. SignalOrange will give it reasonable help in doing so.

10. Help with the rights of people concerned

SignalOrange gives the Client, as far as possible through features of the Services, the tools needed to answer requests from people concerned:

  • Access and portability: data exports through the administration interface.
  • Correction and deletion: directly through the editing and deletion features.
  • De-indexing: on written request for publicly indexed content.

For any request the Client cannot handle directly, SignalOrange will help within a reasonable time at privacy@signalorange.ca.

11. Termination and end of processing

When the Services end, SignalOrange:

  • Lets the Client export Personal data for 30 days.
  • Permanently deletes Personal data from production systems within 30 days of termination.
  • Deletes Personal data from backups within a further 90 days at most.
  • Keeps only the information strictly needed to meet legal obligations (e.g. invoices, for the 7-year Canadian tax requirement).

12. Audits

No more than once every 12 months and at its own expense, the Client may request a documentary audit of SignalOrange's security measures. SignalOrange will answer in writing with a report or a written attestation. SignalOrange does not hold an ISO/IEC 27001 certification or a SOC 2 attestation. For on-site audits, the parties will agree on the terms beforehand (at least 30 days' notice, confidentiality, costs).

13. Liability

The limits of liability in the Terms of use apply, subject to the exceptions the law provides for matters of personal information protection.

14. General provisions

  • Precedence: if this Agreement and the Terms of use differ on the processing of Personal data, this Agreement prevails.
  • Changes: SignalOrange may change this Agreement to reflect legal or technical changes, with at least 30 days' notice by email.
  • Language: the parties have expressly required that this Agreement be drawn up in French. Les parties ont expressément demandé que le présent Accord soit rédigé en français.
  • Governing law: the laws of the Province of Quebec and the applicable federal laws of Canada.

15. Contact us

For any question about this Agreement or the processing of your Personal data: privacy@signalorange.ca.

This Agreement is an English translation of the French text at signalorange.ca/dpa. If the two versions differ, the French version prevails. Last revised: 6 November 2026.