Data Processing Agreement

1. Purpose

This Data Processing Agreement (“DPA”) describes how AuxioAI processes personal data on behalf of customers when they use AuxioAI services, consistent with the role of a service provider or processor under applicable privacy laws.

2. Roles

Where you use AuxioAI to manage communications or data relating to your end users or staff, you are typically the controller (or business) and AuxioAI processes that data as a processor (or service provider) in accordance with your instructions and our agreements.

3. Processing and security

We implement appropriate technical and organizational measures designed to protect personal data. We remain responsible for the performance of our subprocessors under this DPA to the extent required by law.

4. Subprocessors

We currently use the following subprocessors to provide the Services:

• Twilio — SMS and communications delivery
• Stripe — payment processing and billing
• Sanity — content and structured data storage

We will give you reasonable advance notice, by email or through the Services, before adding or replacing a subprocessor that will process your data, so you have an opportunity to raise an objection.

5. Cross-border data transfers

Some of our subprocessors store or process personal data outside Canada, including in the United States. Where personal data is transferred across borders, we require our subprocessors to maintain protections comparable to those required under Canadian privacy law, through contractual or equivalent safeguards.

6. Data subject requests

Where required, we will assist you in responding to requests from individuals regarding personal data you control, subject to the terms of our commercial agreement.

7. Governing law

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein.

8. Contact

For DPA-related inquiries: support@auxio.ai.