Data Processing Addendum (DPA)

Overview

This page summarizes Gammal Software, Inc.'s position as a processor of personal data on behalf of business customers ("Controllers") and provides our standard Data Processing Addendum (DPA) for execution under the EU GDPR, the UK GDPR, Quebec Law 25, and Canadian PIPEDA.

MetaDock is primarily a desktop product where the user's browsing data, workspaces, and profiles are stored locallyon the user's device. We typically do not process personal dataabout end users of your application through MetaDock itself. The DPA below applies when:

• You use MetaDock as part of a workflow that processes personal data of EU/UK/Quebec/Canadian residents and you require a processor agreement under GDPR Art. 28 or equivalent;
• You purchase MetaDock seats on behalf of an organization and need a DPA for your privacy programme;
• You request Standard Contractual Clauses (SCCs) for transfers of personal data to our Canadian-based service.

Requesting Our DPA

To execute our standard DPA, email [email protected] with subject line "DPA Request" and include:

• Your organization's legal name and country of registration
• The data-protection regime(s) you are subject to (GDPR / UK GDPR / Quebec Law 25 / PIPEDA / CCPA / other)
• The MetaDock account email or subscription identifier
• Whether you require EU SCCs (Module 2 — controller to processor), UK Addendum, or Quebec-specific terms

We will return a counter-signed DPA within 5 business days. Our standard DPA incorporates the European Commission Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, and Quebec Law 25 cross-border transfer requirements where applicable.

Subprocessors

We engage the following subprocessors. Where personal data of EU/UK/Quebec residents is transferred outside the customer's jurisdiction, the transfer is governed by Standard Contractual Clauses or an equivalent transfer mechanism.

We will provide written notice before adding or replacing any subprocessor that processes personal data of customers covered by an executed DPA, giving you a reasonable opportunity to object.

Security & Audits

Security measures are described in our Privacy Policy — Data Security section. We will reasonably cooperate with Controller audits required by GDPR Art. 28(3)(h) or equivalent, subject to confidentiality, scoping, and frequency limits set out in the DPA.

International Transfers

Personal data transferred from the EEA, UK, or Switzerland to Gammal Software in Canada is covered by the European Commission's adequacy decision for Canadian commercial organizations under PIPEDA. That adequacy decision applies only to organizations and processing subject to PIPEDA and remains under periodic review by the European Commission; where an EEA, UK, or Swiss customer requires it, we will enter into Standard Contractual Clauses (or the applicable transfer mechanism) as a supplementary measure. Transfers to subprocessors located in the United States or globally are governed by the EU Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, the Swiss DPA equivalence mechanism, or the EU–U.S. Data Privacy Framework where the subprocessor is certified.

For transfers of personal data of Quebec residents outside Quebec, we conduct a privacy impact assessment as required by Law 25 s. 17 and select subprocessors that maintain adequate protection.

Contact

Privacy Officer
Gammal Software, Inc.
303D-2967 Dundas Street West
Toronto, Ontario M6P 1Z2, Canada
[email protected] / [email protected]