Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service (or other written agreement) between Atlantic Learn LMS, doing business as Guardian Expense ("we", "us") and the customer organization ("Customer"). It applies whenever we process Customer Personal Information in providing the Service. Capitalised terms not defined here have the meaning given in the Terms.

Customer is the organization that controls, and is responsible for, Customer Personal Information (a "controller", or a "business" under some U.S. state laws). We process it as Customer's service provider and processor, only on Customer's behalf. Where Customer acts for its affiliates or operating companies, Customer confirms it is authorized to give instructions for them. We are separately responsible, as described in our Privacy Policy, for information about Customer's account, administrators and billing, and about visitors to our website.

2. Definitions

• Data Protection Law: the laws on personal information that apply to the processing, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), substantially similar provincial private-sector laws, and other laws to the extent they apply.
• Customer Personal Information: personal information within Customer Data that we process on Customer's behalf.
• Security Incident: a breach of our security safeguards leading to the accidental or unlawful loss of, or unauthorized access to, disclosure, alteration or destruction of, Customer Personal Information.
• Subprocessor: a third party we engage to process Customer Personal Information.

3. Details of the processing

Subject matter and duration: providing the Service under the Terms, for as long as we provide it and until Customer Personal Information is deleted under section 11.

Nature and purpose: hosting, storing, organizing, displaying, transmitting, routing for approval, reporting on, exporting and deleting expense information, so that Customer can capture receipts and card charges, prepare, approve and report on expenses, and export them to its accounting system.

Individuals concerned: Customer's Authorized Users (employees, contractors, managers, approvers and administrators), and people who appear in Customer Data, such as names on receipts or in expense descriptions.

Types of personal information:

• identity and work contact details: name, work email address, role, operating company, manager or approver, delegates;
• account and security data: sign-in metadata, email verification and two-step verification status, notification preferences, audit-log entries;
• expense data: merchants, dates, amounts, taxes, purposes, descriptions, comments, mileage routes and distances, approval history;
• receipts: images and PDFs, text recognized on the user's device, and the details read from it;
• card data: bank name, account name and last four digits, and posted charges (date, amount, currency, description) from statement files or bank connections;
• device data: push-notification tokens and device platform.

Sensitive information: the Service is not designed for sensitive information (such as health information). Customer will instruct its users not to include it beyond what a receipt unavoidably shows.

4. Customer's instructions

We process Customer Personal Information only on Customer's documented instructions. Customer's instructions are the Terms and this DPA, Customer's configuration and use of the Service (for example inviting members, setting policies, connecting NetSuite or a bank, or exporting data), and any other written instructions we agree. We will tell Customer if we believe an instruction breaches Data Protection Law, and we may decline to follow it. If the law requires us to process Customer Personal Information otherwise, we will tell Customer first unless the law prohibits it.

We will not sell Customer Personal Information, use it for advertising, or retain, use or disclose it for any purpose other than providing the Service, or outside our direct business relationship with Customer, except as the law requires.

Customer is responsible for the lawfulness of its instructions and of the Customer Personal Information it provides, and for giving notices to and obtaining consents from individuals as Data Protection Law requires, including about the cross-border processing described in section 13.

5. Our personnel

We give access to Customer Personal Information only to personnel who need it to provide, secure or support the Service, who are bound by obligations of confidentiality, and who are trained in their responsibilities. By design, our operator tools let our staff manage organizations, plans and billing without access to Customer's reports, expenses or receipts.

6. Security

We implement and maintain the technical and organizational measures described in Annex 2, designed to protect Customer Personal Information against Security Incidents and appropriate to its sensitivity. We may update these measures over time, provided that the overall level of protection is not reduced.

7. Subprocessors

Customer gives us general authorization to engage Subprocessors. Our current Subprocessors, what they do and where, are listed on the Subprocessors page. We impose on each Subprocessor, by written contract, data-protection obligations that protect Customer Personal Information at least as well as this DPA, and we remain responsible for their performance of those obligations.

We will notify Customer's administrators by email, and update the list, at least 30 days before a new Subprocessor begins processing Customer Personal Information. Customer may object on reasonable data-protection grounds by writing to privacy@guardianexpense.com within that period. We will then work with Customer in good faith to address the objection; if we cannot, Customer may terminate the affected part of the Service before the change takes effect and receive a refund of prepaid fees for the remainder of the Subscription Period.

Services that Customer chooses to connect and that act on Customer's own behalf — such as Customer's NetSuite account — are not our Subprocessors.

8. Requests from individuals

If we receive a request from an individual to access, correct or delete Customer Personal Information, or to withdraw consent, we will pass it to Customer promptly and will not respond ourselves except to direct the individual to Customer, unless the law requires otherwise. The Service lets Customer's administrators view, correct and export Customer Data, and we will give Customer reasonable further help to respond to requests, taking into account the nature of the processing.

9. Other assistance

Taking into account the nature of the processing and the information available to us, we will give Customer reasonable help with privacy impact assessments, with consultations with privacy regulators, and with answering regulators' questions about the Service, mainly by providing documentation such as this DPA and our completed security questionnaire.

10. Security Incidents

We will notify Customer without undue delay after we confirm a Security Incident affecting Customer Personal Information, with a target of no more than 72 hours after confirmation. We will send the notice by email to Customer's administrators and, if different, its billing contact. The notice will describe, as far as then known: what happened and when; the types of information and the approximate number of individuals affected; the likely consequences; what we have done and propose to do to contain the incident and reduce harm; and a contact person. We will update Customer as we learn more, and take reasonable steps to contain, investigate and remedy the incident.

We will cooperate with Customer so that it can meet its obligations under Data Protection Law, including PIPEDA's requirements to assess whether a breach creates a real risk of significant harm, to report such breaches to the Office of the Privacy Commissioner of Canada and notify affected individuals, and to keep records of breaches. We keep our own records of every Security Incident and will share the relevant records with Customer on request. Customer decides whether to notify individuals and regulators about its Customer Personal Information, unless the law requires us to. Notifying Customer of an incident is not an admission of fault or liability.

11. Return and deletion

During the term, including while Customer's organization is read-only, Customer's administrators can export Customer Data using the Service (for example CSV exports of reports and expenses, and receipts by opening and downloading them). After the Terms end or Customer's account is closed, we delete Customer Personal Information from the Service within 90 days, unless the law requires us to keep it, in which case we keep protecting it and use it only for that purpose. Copies in backups, if any, are deleted when those backups expire. Some data is deleted sooner under our standard retention rules, described in our Privacy Policy. On request, we will confirm deletion in writing.

12. Information and audits

We will make available the information reasonably needed to demonstrate our compliance with this DPA. We will first do this through documentation: this DPA and its annexes, our security page, our completed security questionnaire and, when we have them, independent audit reports or certifications.

If that information is not enough to meet Customer's obligations, or a regulator requires it, Customer (or an independent auditor bound by confidentiality and reasonably acceptable to us) may audit our compliance with this DPA, no more than once in any 12 months unless a Security Incident justifies another. Audits require at least 30 days' written notice and an agreed scope, take place during business hours without disrupting the Service or giving access to other customers' data, and are at Customer's cost. Our subprocessors' audits are covered by the reports and certifications they make available.

13. Location and cross-border processing

Customer Personal Information is stored and processed on Google Cloud in the United States, and may be processed in other countries by the Subprocessors listed on the Subprocessors page, for the purposes described there. Customer acknowledges that, while it is outside Canada, Customer Personal Information is subject to the laws of those countries, which may allow their courts, law-enforcement and national-security authorities to access it. We protect it during and after any transfer with contracts and the measures in this DPA. We will tell Customer before moving the primary storage location of Customer Data to another country.

14. Liability, precedence and term

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Terms. If this DPA conflicts with the Terms about the processing of Customer Personal Information, this DPA prevails. This DPA lasts for as long as we process Customer Personal Information, and we may update it under the change process in the Terms; we will not make changes that reduce the protection it gives Customer Personal Information, other than updates to the Subprocessor list under section 7.

Annex 1. Processing activities by feature

• Receipts: text recognition runs on the user's device (Apple Vision on iOS, Google ML Kit on Android, tesseract.js in the browser); receipt images are not sent to anyone for recognition. Images and PDFs are stored in Cloud Storage; recognized raw text is deleted after 365 days.
• Approvals and notifications: reports are routed to approvers defined by Customer; notifications are delivered in the app, by push (Firebase Cloud Messaging, Apple Push Notification service) and by email (Mailgun) without amounts in push messages and without receipts, merchants or receipt text in either.
• Card charges: statement files are read in memory and not stored. Bank connections, when a user chooses to connect one, go through Plaid; personal-card charges are visible only to the card holder and those not added as expenses are deleted after 90 days and on disconnection.
• Accounting export: when Customer connects NetSuite, approved reports are sent to Customer's NetSuite account using credentials Customer provides, which we keep in Google Secret Manager.
• Reporting: CSV exports are generated on request for the requesting user and deleted after 7 days.
• Billing: seat counts and subscription status are exchanged with Stripe; Customer Personal Information in expenses is not sent to Stripe.

Annex 2. Technical and organizational measures

Encryption

• All traffic between the apps, browsers and the Service uses TLS (HTTPS). The website sends HTTP Strict Transport Security; the Android app refuses unencrypted connections.
• Data at rest — the database, file storage and secrets — is encrypted by Google Cloud by default.

Access control and tenant isolation

• Each organization's data lives under its own partition. Deny-by-default Security Rules and server checks re-read the person's current membership, role and the organization's status on every request; disabling a member ends their access on the next request and revokes their sessions.
• Least-privilege roles (employee, manager, company administrator, corporate administrator). Managers lose access to a report when the employee moves to another manager. Personal-card data is readable only by the card holder.
• Receipts are never exposed through public links: other people view them through a server function that re-checks their right to see each one.
• Email verification before anyone can join an organization, and two-step verification (authenticator app) for administrators and company administrators, which organizations can require.
• Firebase App Check (App Attest on iOS, Play Integrity on Android, reCAPTCHA Enterprise on the web) on server functions, in addition to sign-in and permission checks.
• Automated tests cover the Security Rules, cross-organization isolation and the permission checks of server functions.

Vendor access

• By design, our operator tools give our staff no access to reports, expenses or receipts; they show organization-level details and counts only. Operator actions are recorded in our own audit log and in the customer's audit log.
• Access to the production cloud project is limited to the personnel who operate the Service.

Secrets

• Integration and bank-connection credentials are kept in Google Secret Manager, one set per organization (NetSuite) or per connection (Plaid), are write-only from the apps, are never shown again, and are read by the server only when needed. Bank access tokens are deleted when a connection is removed.
• No credentials are embedded in the mobile apps or kept in source control.

Integrity, logging and monitoring

• Every administrative change and approval decision is recorded in an audit log that the apps cannot change or delete.
• Status changes, totals and approvals are computed on the server; a submitted report is frozen as an immutable revision.
• Uploaded receipts are checked for type, size (up to 10 MB), file signature and checksum. Webhooks from Plaid and Stripe are accepted only with valid cryptographic signatures.
• Server logs record identifiers and outcome codes, not receipt text, merchants or amounts.

Data minimization

• On-device receipt text recognition; photos are re-encoded before upload, which removes embedded metadata such as location (on the web, except PDFs and HEIC photos the browser cannot convert); raw receipt text is deleted after 365 days; personal-card charges not added as expenses are deleted after 90 days; statement files are not stored; CSV exports are deleted after 7 days.
• Push notifications contain no amounts, merchants or receipt content; emails contain no receipts, merchants or receipt text and have open and click tracking turned off.
• The web app keeps expense data in memory only; the mobile apps clear their local data when the user signs out.

Web application

• A strict Content Security Policy, framing disabled, and other security headers on every page. No advertising or analytics trackers.