Data Processing Agreement

Version in effect on October 13, 2026.

This English version is provided for convenience. In case of discrepancy, the French version prevails.

This data processing agreement (the "Agreement") is entered into between the customer business (the "Customer", controller of the personal information) and [À COMPLÉTER: dénomination légale exacte inscrite au Registraire des entreprises du Québec], NEQ [À COMPLÉTER: numéro d'entreprise du Québec (NEQ, 10 chiffres)] ("Pilotiko", processor). It supplements the Terms of Service and prevails over them regarding personal information processed on the Customer's behalf.

1. Subject matter, nature and duration of processing

• Subject matter: providing the Pilotiko service to the Customer (virtual office, scheduling, clients, accounting, assistant and AI agents, telephony, email, connections).
• Data subjects: the Customer's clients, prospects, suppliers, employees and contacts; people who call or write to the Customer; participants in its meetings.
• Information: contact details, appointments, orders and invoices, message content, call and meeting transcripts, notes, and any other information the Customer chooses to put into the service.
• Duration: the term of the subscription, then until the deletion provided for in section 9.

2. Roles and instructions

The Customer determines the purposes and essential means of the processing; it warrants that it has obtained the consents and given the notices required by law (notably for recording and analysing calls and meetings, and for commercial messages). Pilotiko processes the information only on the Customer's documented instructions — which are the Terms of Service, this Agreement and the Customer's use of the service's features and settings — and for no other purpose. Pilotiko informs the Customer if an instruction appears to it to be unlawful.

3. Confidentiality

Pilotiko ensures that people authorised to process the information are bound by confidentiality and access it only when necessary (support requested by the Customer, security, legal obligation).

4. Security

Pilotiko implements the technical and organisational measures described on the Security page, notably database-level isolation between businesses, role-based access control, mandatory two-factor authentication for owners and managers, encryption in transit and encryption of tokens and secrets, audit logging and verified backups. Pilotiko may evolve these measures without reducing their overall level.

5. Sub-processors

The Customer authorises Pilotiko to use the sub-processors listed on the Subprocessors page. Pilotiko imposes on each, by contract, protection obligations at least equivalent to those of this Agreement and remains responsible for their acts. Pilotiko announces any new sub-processor on that page at least 30 days before using it; the Customer may object on reasonable grounds and, failing a solution, terminate the affected service without penalty.

6. Transfers outside Quebec

Some sub-processors are located outside Quebec (see the Subprocessors page). Pilotiko frames these disclosures by contract and provides the Customer, on request, with the information needed for its own privacy impact assessment (Law 25, s. 17). The Customer can disable the features that involve these transfers (for example, strict AI privacy).

7. Assistance to the Customer

• Data subject requests: Pilotiko forwards to the Customer, without delay, any access, correction, deletion or portability request received about the Customer's information, and helps it answer within the 30-day legal deadline, notably by extracting or deleting the information concerned.
• Assessments and authorities: Pilotiko provides the information reasonably needed for the Customer's privacy impact assessments and its dealings with a supervisory authority.

8. Confidentiality incidents

Pilotiko notifies the Customer without undue delay after becoming aware of a confidentiality incident affecting its information, tells it what it knows (nature, information and people affected, measures taken) and cooperates with the notices the Customer must give to the Commission d'accès à l'information and to the people concerned. Pilotiko takes reasonable measures to reduce the risk of injury and prevent a recurrence.

9. Return and deletion

At the end of the service, or at the Customer's request, Pilotiko provides the Customer with a copy of its data in a structured, commonly used format (JSON for data, original files for documents) and then deletes it, with its files and connection tokens, within 30 jours, subject to legal retention obligations. Backups are overwritten according to their cycle (at most 7 days). Today, this export and deletion are carried out by Pilotiko's team on the written request of the business's owner.

10. Information and verification

Pilotiko makes available to the Customer the information needed to demonstrate compliance with this Agreement (description of security measures, list of sub-processors, written answers to a reasonable questionnaire, once a year). An on-site verification, at the Customer's expense, with 30 days' notice and respecting other customers' confidentiality, may be agreed if an authority requires it or after a serious incident.

11. General provisions

This Agreement is governed by the law applicable to the Terms of Service. In case of conflict with the Terms of Service regarding personal information, this Agreement prevails. For people covered by the GDPR, the parties agree that this Agreement constitutes the contract required by Article 28 of the GDPR.

← Back to the Trust Center