Data processing agreement

This is the template data processing agreement (DPA) for Cowliss, between Capital Enesti Inc. (the processor) and each customer organization (the controller). It is incorporated by reference into the terms of service: accepting the terms at sign-up binds the organization to this DPA.

Template

Bracketed items are filled in when the DPA is executed. Everything else is the operative text for the Cowliss prototype.

1. Parties and roles

Processor: Capital Enesti Inc., registered in Canada at 1185 rue De Bougainville, Saint-Bruno-de-Montarville (Québec) J3V 3E8. NEQ 1181686743. Contact and data protection officer: [email protected].

Controller: the organization that creates a Cowliss workspace and accepts the terms of service — [organization name, address, contact].

Cowliss processes personal data on the controller’s behalf. The controller decides the purposes and the lawful basis; Cowliss never decides what the data is for.

2. Subject matter, nature, and duration

Cowliss provides a customer data platform: the controller’s applications send identify, track, and alias calls; Cowliss stores profiles and events, computes segments, runs durable per-user journeys, and delivers email and webhooks on the controller’s behalf. Processing under this DPA is everything Cowliss does to provide that service, for as long as the controller’s organization uses it, plus the wind-down in section 10. Annex A lists the data categories and data subjects.

3. Documented instructions

Cowliss processes personal data only on documented instructions (Art. 28(3)(a)). The instructions are:

1. The terms of service and this DPA.
2. The product documentation — including the documented defaults in Data protection and your responsibilities, which the controller accepts by using the service:
   • events are ingested regardless of consent state, and consent gates marketing sends (the transactional send class bypasses consent by design, while still stopping on suppression);
   • consent purposes are the fixed enum emailMarketing and dataProcessing, whose meaning the controller defines;
   • consent state is controller-supplied metadata that Cowliss stores and enforces but never interprets.
3. The controller’s in-product actions — API, dashboard, CLI, and MCP operations, each within its surface: setting consent states, configuring retention, requesting erasure or export (API and dashboard), defining journeys, segments, and destinations.

An instruction outside these documents needs written agreement. Cowliss notifies the controller if it believes an instruction infringes data protection law (Art. 28(3), final paragraph).

4. The controller’s responsibilities

• Lawful basis (Art. 6). The controller establishes and documents the lawful basis for every processing purpose. Cowliss takes no position on what the controller’s data is for.
• Consent records (Art. 7(1)). Where consent is the basis, the controller must be able to demonstrate it. Cowliss stores the consent state the controller supplies (emailMarketing / dataProcessing per profile) and the system.consent_revoked system events its own automation emits; proving what the end user saw and agreed to remains the controller’s job.
• Lawful instructions. The controller warrants that its instructions — including the documented defaults above — comply with applicable law.

5. Processor commitments

• Confidentiality. Everyone processing controller data is bound by confidentiality (Art. 28(3)(b)).
• No own-purposes use. Cowliss does not use tenant data for its own purposes: no advertising, no cross-org profiling, no sale of data. The only numbers Cowliss derives are aggregate usage counts for metering and abuse protection — never profile or event content.
• Security. Technical and organizational measures per Annex B (Art. 32).
• Assistance (Art. 28(3)(e)). Cowliss’s controller-assist duties are performed by the product itself:
  • Erasure — DELETE /v1/users/{userId} (and the dashboard action) removes a data subject across Postgres, ClickHouse, and Temporal, including alias-map, suppression-mirror, and quarantine entries. See the users reference.
  • Export — GET /v1/users/{userId}/export returns one JSON document of everything held on a data subject.
  • Retention — the org-level event retention setting applies a ClickHouse TTL, so event data expires on the controller’s schedule. See the settings reference.
  • Consent and unsubscribe — the consent endpoint, and the signed public one-click-unsubscribe and preference endpoints every marketing email carries.
• Breach notification (Art. 33(2)). Cowliss notifies the controller’s organization admins by email without undue delay after becoming aware of a personal data breach affecting their tenant, with what is then known about scope, likely consequences, and mitigation.
• Subprocessors. Per section 6.

6. Subprocessors

The controller authorizes the subprocessors on the subprocessor list (Art. 28(2)). Cowliss gives advance notice of additions or replacements; the controller may object, and where an objection stands, may terminate. The obligations of this DPA flow down to every subprocessor (Art. 28(4)).

7. International transfers

Capital Enesti Inc. is a Canadian processor; where the controller has data subjects in the EEA, the GDPR applies to it directly via Art. 3(2). Transfers of personal data to the Canadian entity are covered by the European Commission’s adequacy decision for Canada (commercial organizations subject to PIPEDA), so no standard contractual clauses are required for the entity itself. Subprocessor hosting locations — including the AWS SES region — are listed separately on the subprocessor list.

8. Other applicable law

Capital Enesti Inc. is also subject to PIPEDA and Québec’s Law 25 as a Canadian organization; this DPA is intended to satisfy their service-provider contract requirements as well.

9. Audits and information

Cowliss makes this documentation, the records of processing, and the security measures in Annex B available to demonstrate compliance (Art. 28(3)(h)), and answers written questions at [email protected]. On-site audits are [not offered during the prototype phase].

10. End of service

On termination the controller may export its data and request erasure; the erasure tooling of section 5 then applies. Residual data ages out per the controller’s retention settings and [the operator’s backup rotation].

11. Governing law and venue

This DPA is governed by the laws of the Province of Québec and the federal laws of Canada applicable therein. The parties submit to the non-exclusive jurisdiction of the courts of the judicial district of Montréal.

Annex A — Processing details

Item	Detail
Data subjects	The controller’s end users (identified and anonymous); the controller’s team members (dashboard accounts)
Personal data	User identifiers, traits, event stream (names, properties, timestamps), email addresses, consent states, suppression state, delivery metadata; team members’ names and emails (via Clerk)
Purposes	Per the controller’s instructions: storage, identity resolution, segmentation, journey automation, email and webhook delivery, abuse protection, usage metering
Retention	Controller-configured event retention (ClickHouse TTL); profiles and state persist until erasure or termination
Categories of processing	Listed per tenant in the records of processing

Annex B — Security measures (Art. 32)

• Access control. Dashboard, CLI, and MCP authenticate through Clerk, and every operation is gated by Clerk organization roles (org:admin / org:member). The APIs authenticate with org-scoped, revocable API keys.
• Tenant isolation. Every query is scoped by organization ID at the data layer; there are no cross-org reads.
• Transport. All public endpoints are served over TLS [per deployment].
• Signed outbound webhooks (Standard Webhooks), with destination URLs restricted against internal-network and non-HTTP targets.
• Signed, single-purpose tokens on the public unsubscribe, preference, and verification endpoints.
• Abuse containment. Complaint-rate auto-pause, bounce-rate flagging, per-user frequency caps, and quota hard-stops bound the blast radius of a compromised or rogue tenant.
• Data minimization by default. Open tracking is off everywhere; click tracking is a per-domain opt-in.
• Erasure and retention tooling as in section 5, so deletion and storage-limitation duties are directly exercisable.

Annex C — Subprocessors

The current list is maintained at Subprocessors and incorporated here by reference.