Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the TopLeft Terms and Conditions (the "Terms") between TopLeft Technologies Ltd. ("TopLeft", "we") and the customer that accepted them ("Customer", "you"). It applies whenever TopLeft processes Personal Data on your behalf in providing the TopLeft service. Where this DPA and the Terms conflict on the processing of Personal Data, this DPA wins.

Acceptance of the general Terms and Conditions and continued subscription to TopLeft services includes acceptance of this DPA. If you need a signed copy for your records, email privacy@topleft.team and we will send a PDF of this text, signed.

1. Definitions

"Personal Data" means information about an identified or identifiable person that TopLeft processes on your behalf through the service.

"Data Protection Law" means the privacy and data protection laws that apply to that processing, which may include the EU General Data Protection Regulation ("GDPR"), the UK GDPR, Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and US state privacy laws such as the California Consumer Privacy Act ("CCPA").

"Subprocessor" means a third party TopLeft engages to process Personal Data.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

"Controller", "Processor", "Data Subject" and "processing" have the meanings given in the GDPR.

2. Roles

You are the Controller of the Personal Data, or a Processor acting for your own clients. TopLeft is your Processor, or your Subprocessor. TopLeft processes Personal Data only to provide the service, and only on your documented instructions. The Terms, this DPA and your configuration of the service are your instructions. We will tell you if we believe an instruction breaks Data Protection Law.

TopLeft does not sell Personal Data, does not share it for cross-context behavioural advertising, and does not use it to train AI models.

3. Details of the processing

4. Confidentiality

Everyone at TopLeft who can access Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide the service or support.

5. Security

TopLeft keeps the technical and organisational measures in Annex 1. We may change them, but not in a way that lowers the overall protection of Personal Data.

6. Subprocessors

You give general authorization for TopLeft to use Subprocessors. The current list, with where each one processes data, is at TopLeft subprocessors. We will give at least 14 days' notice before adding or replacing one, by updating that page and emailing anyone who has asked for updates. You may object on reasonable data protection grounds within that period. Where we must replace a Subprocessor urgently, for security reasons or because it stops providing its service, we will make the change and tell you as soon as we can, and you may object to it as above. If we cannot address the objection, you may terminate the affected service by written notice before the change takes effect. Fees already paid are handled as the Terms describe.

Each Subprocessor is bound by a written agreement with data protection obligations at least as protective as this DPA. TopLeft remains responsible for its Subprocessors' performance.

7. Data Subject requests

If a Data Subject asks TopLeft directly to exercise their rights, we will pass the request to you and not answer it ourselves unless you tell us to. Most Personal Data in TopLeft is synced from your PSA, so correcting or deleting it in the PSA corrects or deletes it in TopLeft on the next sync. Where you need more help to answer a request, we will provide it at reasonable cost.

8. Security Incidents

TopLeft will notify you without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting your Personal Data. The notice will describe what happened, the data and Data Subjects affected as far as known, and what we are doing about it. We will update you as we learn more and help you meet your own notification duties.

9. Return and deletion

You can export your data from your PSA at any time; TopLeft is not the system of record for it. TopLeft deletes your instance and its database 7 days after you cancel, or 45 days after an account is suspended for non-payment. Nightly backups expire within 27 days of being taken, so the last copy of your database is gone about 34 days after you cancel. Most images pasted into notes are removed from our file storage the night after the note is saved, once they are copied to your PSA. Any that remain when your instance is deleted, we delete on request to privacy@topleft.team. Retention periods for logs and other data during the term are listed in Data retention.

10. Audits and information

TopLeft holds a SOC 2 Type II report. On request, we will send you the current report. That report is our first answer to audit and security questionnaire requests. Where it does not cover something you need to show compliance with Data Protection Law, we will answer reasonable written questions, no more than once a year unless a Security Incident or a regulator requires more. Any on-site audit needs 30 days' notice, takes place during business hours, is at your cost, and is subject to confidentiality.

11. International transfers

TopLeft is based in Canada. You choose the region your instance runs in (United States, Canada, European Union or Asia-Pacific), and its data is hosted in that region, as listed on the Subprocessors page. Some Subprocessors process Personal Data in the United States. The European Commission has found that Canada provides adequate protection for personal data under PIPEDA.

12. Governing law

This DPA is governed by the same law as the Terms, except where Data Protection Law requires otherwise.

13. Contact

Send notices, questions and requests about this DPA to our Privacy Officer at privacy@topleft.team.

Annex 1: Security measures

• Certification: TopLeft holds a SOC 2 Type II report, available on request.
• Isolation: each customer runs in its own application instance with its own database and database login.
• Encryption in transit: all traffic to the application uses TLS through Cloudflare, and the connection from Cloudflare to our servers uses TLS. Database connections between servers use TLS.
• Encryption at rest: database and file volumes on every server that holds customer data are encrypted.
• Access control: administrative access to servers is only over a private network with per-person accounts. The servers' firewalls accept web traffic only from Cloudflare. Staff access to customer data is limited to three tiers by responsibility, each the least access that role needs.
• Authentication: users sign in with a password, hashed with PBKDF2, or with single sign-on through Microsoft Entra ID. Two-factor authentication with time-based one-time passwords is available and can be required. TopLeft user accounts follow the PSA: disabling a user in the PSA disables them in TopLeft. Sessions expire after about two weeks of inactivity.
• Monitoring: runtime security monitoring on servers alerts our team to suspicious activity. Application errors and metrics are monitored.
• Resilience: production databases are copied continuously to a standby server that can take over if the primary fails. Each instance's database and files are backed up nightly to storage in the same region and kept for 27 days.
• AI: AI features are optional. Requests to AI providers through OpenRouter enforce zero data retention on each request, and administrators can restrict AI to anonymized data. If you connect your own Azure OpenAI resource, your agreement with Microsoft governs retention for those requests.
• Least data: TopLeft holds the working copy of your PSA data that the service needs, and keeps logs and other operational data only for the periods in Data retention.