PIPEDA Data Processing Addendum

This DPA forms part of your Subscription Agreement. Simplilux acts as a Processor; you remain the Controller of your customer data. We process personal information only on documented instructions, ensure persons authorized to process are bound by confidentiality, and implement appropriate technical and organizational measures (AES-256 at rest, TLS 1.3 in transit, SOC 2 Type II audited). Sub-processors are listed at /legal/sub-processors and you will be notified of changes 30 days in advance. International transfers are governed by the Standard Contractual Clauses where applicable.