Legal

Data Processing Addendum

Last updated: October 21, 2026

This Data Processing Addendum (“DPA”) is part of the Terms of Service between CIPHRA SOFTWARE INC. (“Ciphra”, “we”, “us”), which operates ReceptionWorks, and the business using ReceptionWorks (“you”). It applies when we process personal data on your behalf and the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or another data protection law applies to that processing (“data protection law”). You accept this DPA when you accept the Terms; no signature is needed. If this DPA and the Terms conflict on the processing of personal data, this DPA applies.

1. Definitions

• Customer personal data: personal data that you, your team or your customers submit to ReceptionWorks and that we process on your behalf, such as conversations and customer records.
• Subprocessor: a third party we engage to process customer personal data.
• Personal data breach: a breach of security that leads to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, customer personal data.
• Controller, processor, data subject and processing have the meanings given in data protection law.

2. Roles and instructions

• You are the controller of customer personal data, or a processor acting for another controller. We are your processor.
• We process customer personal data only on your documented instructions. Your instructions are the Terms, this DPA, the settings you choose and the actions you take in ReceptionWorks, such as setting up AI employees, connecting channels and deleting data, and any other written instructions we agree to. If the law requires us to process customer personal data in another way, we will tell you first unless the law forbids it.
• We will tell you if we believe an instruction breaks data protection law.
• You are responsible for having a lawful basis for the processing, for giving your customers the notices the law requires, including telling them they are talking to an AI where required, and for the lawfulness of the data you provide.

3. Details of the processing

• Subject matter and duration: providing ReceptionWorks to you while you use it, and the deletion period in section 9.
• Nature and purpose: hosting and storing data; receiving and delivering messages on the channels you connect; producing AI replies, summaries and translations; keeping bookings, requests and customer records; notifying your team; providing support; and securing the service.
• Data subjects: your customers and other people who contact you through ReceptionWorks, your team members, and people mentioned in the content you add.
• Categories of personal data: names; contact details such as email addresses, phone numbers and messaging usernames and IDs; message content and attachments; booking and request details; notes and AI-written summaries about customers; technical details such as channel identifiers and message times; and any other information you or your customers choose to share.
• Special categories: ReceptionWorks is not designed to collect special categories of personal data, such as health information. You decide whether your customers may share such data with you through ReceptionWorks and are responsible for having a lawful basis for it.

4. Confidentiality

People we authorise to process customer personal data are bound by confidentiality obligations and access it only as needed to provide the service.

5. Security

We keep technical and organisational measures appropriate to the risk, including:

• encryption of data in transit between users, channels, our services and our providers;
• encryption of stored channel access tokens;
• separate production and development environments that do not share databases, storage or credentials;
• access to our administration tools only through Cloudflare Access, for staff who need it;
• access to each business’s data limited to its team members, according to their roles;
• regular database backups in private storage separate from the database servers, with backup checkpoints protected from change or deletion by Object Lock.

We may update these measures as long as the overall level of protection does not decrease.

6. Subprocessors

• You give us general authorisation to engage subprocessors. The current list is on our Subprocessors page.
• We require each subprocessor to protect customer personal data at least as well as this DPA requires for the service it provides, and we remain responsible to you for its work.
• We email the owner of your business at least 30 days before a new subprocessor starts processing customer personal data. You can object on reasonable data protection grounds within that period by writing to us. We will discuss your concerns in good faith. If we cannot resolve them, you can stop using the affected service, and we will refund any prepaid fees for the period after you stop.
• If we must replace a subprocessor urgently to keep the service secure or running, we will tell you as soon as possible after the change, and you can object in the same way.

7. Help with requests and compliance

• ReceptionWorks lets you view, correct and delete a customer’s data in that customer’s record. If you need more help to answer a data subject’s request, we will assist you, taking into account the nature of the processing.
• If a data subject contacts us directly about customer personal data, we will pass the request to you or ask them to contact you, and we will not answer it ourselves unless you ask us to or the law requires it.
• We will give you reasonable information and help for data protection impact assessments and consultations with supervisory authorities that concern the service.

8. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting customer personal data. We will describe its nature, its likely consequences and the measures taken or proposed, as far as this information is available, and update you as we learn more. We will take reasonable steps to contain the breach and limit its consequences.

9. Deletion and return

• When a business is deleted from an account, its customer personal data is kept for 90 days so we can restore it at the owner’s request, then deleted permanently.
• When your account is closed, we delete customer personal data within 30 days, except data the law requires us to keep. Before the account is closed, you can ask us at contact@ciphra.ca for a copy of customer personal data in a commonly used format.
• Deleted data can remain in backups until they expire on their rolling schedule. We keep backups protected and use them only to restore the service.

10. Audits

We will make available the information reasonably needed to show that we meet our obligations under this DPA, such as answers to security questionnaires. If this information is not enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit our compliance with at least 30 days’ notice, at your cost, during business hours and no more than once a year, unless a personal data breach or a supervisory authority makes another audit necessary.

11. International transfers

• We are based in Canada, and our database is hosted in Canada. The European Commission, the United Kingdom and Switzerland recognise Canada as providing adequate protection for organisations subject to its federal private-sector privacy law, as we are, so transfers of customer personal data from you to us need no further safeguards.
• When a subprocessor processes customer personal data in a country without such recognition, we rely on a transfer mechanism allowed by data protection law, such as the subprocessor’s certification under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions, or the Standard Contractual Clauses adopted by the European Commission with the UK and Swiss additions.
• If the recognition of Canada stops applying, the Standard Contractual Clauses (module two, controller to processor) apply between you as data exporter and us as data importer, completed with the information in this DPA, together with the UK and Swiss additions for transfers from those countries.

12. US state privacy laws

Where US state privacy laws, such as the California Consumer Privacy Act, apply, we act as your service provider or processor. We do not sell or share customer personal data, and we do not keep, use or disclose it for any purpose other than providing ReceptionWorks to you, or outside our direct business relationship with you, except as those laws allow.

13. Duration and liability

This DPA applies for as long as we process customer personal data on your behalf. Each party’s liability under it is subject to the limitation of liability in the Terms, to the extent data protection law allows.

14. Changes to this DPA

We may update this DPA in the same way as the Terms. We will not reduce the protection it gives to customer personal data unless the law requires it.

Contact

CIPHRA SOFTWARE INC., British Columbia, Canada. Email: contact@ciphra.ca.