Endorza™ Business Data Processing Addendum

1. Roles

The business is the controller of its customer personal information. Refer Me Technologies Inc., operating as Endorza™, is the processor and handles that information only on the business’s documented instructions, which are: to provide Endorza™ as described in the Business Terms and in the app.

Endorza™ is a controller in its own right for its account records, sign-in and security records, billing records and product analytics. Those are covered by the Privacy Policy, not by this addendum.

2. What is processed

• Subject matter: running a referral and reward programme.
• Duration: for as long as the business account is open, plus the wind-down period in section 8.
• Categories of people: the business’s customers, people they refer, and the business’s own team members.
• Categories of information: name, email address, optional mobile number, referral and reward history, messages sent through Endorza™, and delivery outcomes.
• Not permitted: health records, financial account details, government identifiers or other sensitive categories. Do not put them into Endorza™.

3. Confidentiality

Everyone at Endorza™ with access to customer personal information is bound by confidentiality obligations and only has the access they need to do their job.

4. Security

• Encryption in transit and at rest.
• Row-level access rules in the database so a business can only reach its own records, and a team member only what their role permits.
• Individual logins, no shared credentials, and audit logging of sensitive actions.
• Support access to a business account is time-limited, requires an explicit support session, and is recorded in the audit trail.
• Managed hosting with automatic backups and point-in-time restore.

5. Sub-processors

The business authorises these sub-processors:

• Supabase — database, authentication and file storage. Canada / United States.
• Cloudflare — application hosting and edge delivery. Global network.
• Resend — outbound email delivery. United States.

We will give notice before adding or replacing a sub-processor. If the business reasonably objects, it may close its account without penalty for the remaining paid period.

6. International transfers

Information may be processed in Canada and the United States. Where information leaves the jurisdiction it was collected in, we rely on contractual protections with each sub-processor that require an equivalent standard of protection.

7. Helping the business meet its obligations

• Individual requests. If a customer contacts Endorza™ directly about the business’s records, we refer them to the business and help the business respond. Export and deletion tools are built into the app.
• Breach notice. If we become aware of a personal information breach affecting the business’s records, we will notify the business without undue delay and in any case within 72 hours, with what we know and what we are doing.
• Assessments and audits. On reasonable request, and no more than once a year unless required by a regulator, we will provide the information needed to assess our processing.

8. Return and deletion

When the business account closes, the business can export its data for 30 days. After that we delete or anonymise it within 90 days, except records we are required to keep by law (for example billing records) and backups, which expire on their normal cycle.

A customer’s own Endorza™ account is not deleted when a business closes — only their relationship with that business ends.

9. Priority

If this addendum conflicts with the Business Terms on the handling of customer personal information, this addendum applies.

10. Contact

Privacy Officer: hello@endorza.me