Data Processing Agreement
Last updated August 30, 2026
This DPA is incorporated into the Order and Master Customer Agreement between Alomi and Customer. Processor: 1996058 Alberta Ltd. (o/a "Alomi").
1. Roles and processing
1.1 Scope. In providing the Services, Alomi may Process Customer Data that is personal data/personal information ("Personal Data"), and both parties comply with applicable Data Protection Laws (PIPEDA, Alberta PIPA, EU/UK GDPR, CCPA/CPRA as applicable).
1.2 Roles. Customer is the Controller/Business; Alomi is the Processor/Service Provider (or sub-processor where Customer is itself a processor).
1.3 Instructions. Alomi Processes Personal Data only on Customer's documented instructions (this DPA, the Agreement, Customer's use of the Services, and other reasonable written instructions).
1.4 Personnel. Authorized personnel are bound by confidentiality.
1.5 Service-provider limits (CCPA). Alomi will not retain, use, or disclose Personal Data outside performing the Services or Customer's instructions, will not combine it with other-source data except as permitted, and will not "sell" or "share" it.
2. Security and incidents
2.1 Security. Appropriate technical and organizational measures appropriate to the risk — access controls, tenant isolation, encryption in transit, row-level security.
2.2 Security incident. Alomi notifies Customer without undue delay after becoming aware of a confirmed or reasonably suspected breach affecting Personal Data, and takes reasonable steps to investigate and mitigate.
3. Subprocessing
Customer authorizes the subprocessors listed in the Privacy Policy and successor lists, each under a written agreement no less protective than this DPA. Alomi gives notice of new subprocessors; Customer may object on reasonable data-protection grounds within 10 days, and if unresolved within 60 days may terminate the affected Services with a pro-rated refund.
4. Audit
On request (no more than annually unless required by law), Alomi provides information reasonably necessary to demonstrate compliance; any audit is at Customer's cost, on reasonable notice, under confidentiality, and must not access Alomi's production environments or other customers' data.
5. Assistance
Alomi provides reasonable assistance (at Customer's cost) with data-subject/consumer requests, incident notifications, and data-protection impact assessments.
6. Data-subject requests
Alomi refers data-subject/consumer requests concerning a Customer's tenant to that Customer and reasonably assists in responding.
7. International data transfers
Where required, transfers rely on appropriate safeguards, including the EU Standard Contractual Clauses (Modules 2 and 3), the UK IDTA, and Swiss adaptations, completed with the details in Schedule I.
8. Return and deletion
On termination, Alomi returns or deletes Personal Data on request, except copies as agreed, required by law, or in standard backups purged on a rolling schedule.
Schedule I — Description of Processing
Parties: exporter/Controller = Customer; importer/Processor = Alomi. Data subjects: Customer's personnel/Users; Customer's customers, leads, employees, and contacts. Personal Data: identifiers and contact info, business role, account/login details, financial and HR records Customer stores, communications/notes, and data imported from connected platforms. Sensitive data: not intended. Frequency: continuous. Nature/purpose: hosting, storage, organization, calculation, display, and transmission to provide the Services and enabled integrations, and to generate Telemetry. Duration: term of the Agreement plus the Privacy Policy retention period and as required by law. Subprocessors: as listed in the Privacy Policy.
Contact: privacy@alomi.ai · 1996058 Alberta Ltd. (o/a Alomi), 3740 11A Street NE, Suite C201, Calgary, AB T2E 6M6, Canada.